Skip to content

Back to the catalog

agentgg
github.comrepo

agentgg

agentgg is an open-source, agentic SAST scanner that uses LLM agents to read source code, follow imports, trace the call graph, and confirm findings before reporting — aiming to reduce the pattern-matching false positives of traditional SAST. It runs locally or as a hosted service, supports full-repo scans or git-diff PR review, and works with multiple model providers (Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, Ollama); agents are defined as markdown files with YAML frontmatter and are pulled from a community agents catalog.

TL;DR Open-source CLI that runs LLM agents over your code to validate SAST findings via call-graph and import analysis, with PR-diff scanning and a customizable agent catalog.
Open original ↗
Document

What it is

agentgg is an Apache-2.0 licensed, beta-stage CLI scanner installed with npm install -g agentgg (Node.js 20+). It needs an account with one model provider. The page also lists a hosted version at app.agentgg.dev, where you upload a repo and need no provider key of your own. The page warns that things will move and edges will be rough.

How it works

Each scan starts with a fast recon pass that briefs the agents on what the project is. Agents then read the code, follow imports, check the call graph, and confirm a finding before reporting it.

An agent is one markdown file. YAML frontmatter declares where to look and an optional precondition that decides whether the agent is worth running on the repo. The markdown body is the prompt. An agent that declares neither extensions nor filePatterns in its where gets no pre-selected files and searches the whole repository with its own tools.

The agents catalog downloads automatically on first scan from agentgg-dev/agentgg-agents. agentgg create turns a past incident report into a reusable agent.

A scan writes summary.md and one markdown file per finding into the output directory, plus a state/ directory. That directory supports resume, status and revalidate. Re-running with the same -o skips unchanged files and resumes an interrupted scan. A different -o starts fresh.

Preconditions / Affected

  • Node.js 20+.
  • An account with Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, or a local Ollama.
  • Docker, only for live validation (--live-validate). If Docker is missing or stopped, agentgg offers to install or start it when the command begins.

What to do

agentgg init                                            # one-time: pick a provider, paste a key
agentgg scan ./src -o ./out                             # scan everything
agentgg scan ./src --diff origin/main...HEAD -o ./out   # PR-style: scan only what changed
agentgg status ./out                                    # what got found and validated
agentgg view ./out                                      # browse findings in a local web UI

The diff form fits pull request review in CI. Persist the output directory between runs if you want unchanged files skipped.

Caveats

  • The page is a README. It gives no benchmarks, false-positive rates or comparisons with other SAST tools, so the claim of fewer false positives is unmeasured here.
  • It does not state scan cost or token usage per run.
  • It does not say what code leaves your machine with each provider. Using Ollama is the local-model option the page lists.
  • The page describes the tool as beta.

Technologies named here

Techniques named here

  • Agentic, reasoning-based static analysis

Related in AppSec