AgentGG

AgentGG is an agentic static application security testing (SAST) tool from agentgg-dev. Its agents read code, follow imports, and confirm findings before reporting them. It is available as an Apache 2.0 CLI and as a hosted platform that scans repositories and pull requests. The GitHub README marks the CLI as in beta.

What It Is

AgentGG is a white-box security scanner that uses AI agents instead of pattern-matching rules. Each agent is a readable markdown file with YAML frontmatter that declares where to look and an optional precondition, plus a prompt body describing the bug class and what counts as proof. The CLI can scan a whole repository or only a git diff for pull request review, and every scan begins with a recon pass that briefs the agents on what the project is. Interrupted scans resume when re-run with the same output directory.

How a Scan Works

After running agentgg init to choose a provider, users run agentgg scan on a directory, optionally with a diff range. Output is a summary.md plus one markdown file per finding, along with a state directory that supports resume, status, and revalidation. A local web viewer lets users browse findings. Findings go through a second validation pass that assigns a CVSS severity. The agent catalog of 100+ open-source agents downloads automatically on first scan, and agentgg create turns a past incident report into a reusable agent.

Hosted Platform and Custom Agents

The hosted platform runs the same scanner as a service. Users install the GitHub App, pick repositories, or scan a ZIP or git URL. Pull request scans return as a GitHub check run with inline comments on diff lines. Full-repo baseline scans run on demand. A dashboard offers deduplicated, CVSS-scored findings with roles, workspaces, and filters by severity, verdict, or agent. A guided custom-agent service builds agents from a team's past security reports, pentest findings, and product context.

Model Providers and Disclosures

The CLI works with Anthropic, OpenAI, OpenRouter, AWS Bedrock, Google Vertex AI, or a local Ollama setup, and requires Node.js 20+. The vendor says its agents have found hundreds of previously unknown vulnerabilities in open-source projects, reported privately to maintainers and published after fixes ship. Its advisories page lists examples.