Skip to content

Back to the catalog

knostic/OpenAnt
github.comrepo

knostic/OpenAnt

OpenAnt is Knostic's open-source Apache 2 licensed LLM-based vulnerability discovery tool that runs source code through a two-stage pipeline, an agentic detection phase followed by an attack and verification phase, to filter out false positives and surface exploit-verified findings. It is a Go CLI with a Python analysis backend supporting Go, Python, and several beta languages including JavaScript, C, PHP, Ruby, Zig, Swift, and Rust, with pluggable LLM providers such as Anthropic, OpenAI, Google, Ollama, OpenRouter, and Bedrock, plus diff and PR scoped scanning for CI and a local web UI.

TL;DR Open-source LLM-driven vulnerability scanner from Knostic that detects then agentically verifies findings to cut false positives.
Open original ↗
Document

What it is

OpenAnt is a Go CLI (with a Python 3.11+ backend) wrapping Knostic's two-stage LLM vulnerability scanner. This page is the setup/operations reference: how to build it, wire LLM providers per pipeline phase, and run a scan. Notably, only Go and Python are non-beta — JavaScript/TypeScript, C/C++, PHP, Ruby, Zig, Swift, and Rust (not in the summary's list) are all marked beta.

Preconditions / Affected

  • Building the CLI needs Go 1.25+; the backend needs Python 3.11+. If no 3.11+ interpreter is found, commands abort.
  • Interpreter selection order: OPENANT_PYTHON env var → managed venv at ~/.openant/venv/ (auto-created) → python3/python on PATH.
  • There is a compiled-in openant-default config (Claude Opus 4.6 for detection phases, Sonnet 4 for the rest) that works with no config.json.

What to do

Build and put it on PATH (from repo root):

cd apps/openant-cli && make build
ln -sf "$(pwd)/apps/openant-cli/bin/openant" /usr/local/bin/openant

Fastest custom setup — the wizard probes each provider+model with a 1-token request before writing ~/.config/openant/config.json:

openant setup llm
openant scan /path/to/repo --llm-config my-llm

Claude-only defaults, skipping the wizard entirely:

openant set-api-key sk-ant-...
openant scan /path/to/repo

A hand-edited config must list all seven phases (app_context, llm_reach, enhance, analyze, verify, dynamic_test, report), each mapping to a (provider, model) pair. Providers accept a base_url for OpenAI-/Anthropic-compatible proxies (vLLM, Bedrock, internal gateways); OpenRouter has its own openrouter type. Bedrock uses the AWS credential chain — leave the API key blank.

To submit a repo for free scanning: https://knostic.ai/blog/oss-scan. Token costs and limitations are in the blog: https://knostic.ai/blog/openant.

Caveats

  • The maintainers state this started as a research project and many features are beta; they are still in the vulnerability-disclosure process for its findings.
  • The enhance and verify phases use an agentic tool-use loop — for Ollama you must pick a tools-capable model, as very small local models may not handle tool calls reliably.
  • Adding a new provider is two-tier: a Python adapter file alone runs from a hand-authored config, but wizard support and its pre-save probe require Go touch-points in apps/openant-cli/cmd/setup.go. See docs/features/llm-providers/HOW_TO_ADD_AN_ADAPTER.md.

Technologies named here

Techniques named here

  • Code decomposition
  • Adversarial verification
  • Dynamic testing
  • Diff-scoped scanning

Related in AppSec