OpenAnt - OpenAnt from Knostic is the leading open source LL

项目说明

<p align="center">
<img src="assets/open-ant-black.png" alt="OpenAnt" width="180" />
</p>

OpenAnt

OpenAnt from Knostic is the first open source LLM-based discovery product (now called a harness) that helps defenders proactively find security flaws while minimizing both false positives and false negatives. Stage 1 detects. Stage 2 attacks. What survives is real.

Do keep in mind that this started as a research project, and as we develop new capabilities, we often release them as beta. We welcome contributions.

Paper

You can find our research paper on building OpenAnt on arXiv: OpenAnt: LLM-Powered Discovery Through Code Decomposition, Ad , and Dynamic Testing, by Nahum Korda and Gadi Evron.

Why open source?

This was a relevant question in the readme when we first released OpenAnt, since, many other harnesses have been released. We still hope that with the explosion of AI-discovered , OpenAnt will help open source maintainers stay ahead of attackers, where they can use it themselves. Or submit their repo for scanning at no cost.

There is also the fact that Knostic's focus is on protecting agents and coding assistants and not research or application security, and we like open source, so we decided to release OpenAnt under the Apache 2 license.
Besides, you may ha about Aardvark from OpenAI (now Codex Security) and Claude Code Security from Anthropic, and we have zero intention of competing with them.

Technical details and free scanning for open source projects

For technical details, limitations, and token costs, check out this blog post:

To submit your repo for scanning:

Supported languages

Credits

Maintainer and research: Gadi Evron

Original research, ideation, and original prototype: Nahum Korda.
Original productization: Alex Raihelgaus, Daniel Geyshis.

With thanks to: Michal Kamensky, Imri Goldberg, Daniel Cuthbert. Josh Grossman, and A.

Check out Knostic

If you like our work, check out what we do at Knostic to defend your agents and coding assistants, prevent them from deleting your hard drive and code, and control associated supply chain risks such as MCP servers, extensions, and skills.

Local setup

Build the CLI binary (requires Go 1.25+):

This compiles the Go source and outputs the binary to apps/openant-cli/bin/openant.

Symlink it onto your PATH so you can run openant from anywhere:

_Note: run this from the repo root so $(pwd) resolves to the correct absolute path._

Setting up an LLM

OpenAnt routes each pipeline phase through a configurable (provider, model) pair. The fastest path is the interacti:

You name the config (e.g. my-llm), pick a provider per pipeline phase (any of the shipped adapters below), enter its API key once per provider (Bedrock uses the AWS credential chain instead — leave the key blank), and the wizard probes each unique provider+model pair with a 1-token request before writing ~/.config/openant/config.json. Run a scan against it with --llm-config:

Wizard defaults reflect the project's per-phase recommendations (stronger reasoning models for detection / / reachability review; lighter models for context, report, and test generation) — o any answer to taste.

#### Shipped adapters

| Provider type | API key from | Notes |
|---|---|---|
| anthropic | console.anthropic.com | Reference adapter. NOT included in Claude Pro / Max subscriptions — separate billing. |
| openai | platform.openai.com | NOT included in ChatGPT / Codex subscriptions — separate billing. |
| google | aistudio.google.com | NOT included in Gemini Ad — separate billing. |
| bedrock | — (AWS credential chain) | Claude on AWS Bedrock. No api_key: credentials come from AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars or a ~/.aws profile, region from AWS_REGION. Model IDs are inference profiles (us.anthropic.claude-sonnet-4-6, global.anthropic.claude-haiku-4-5-20251001-v1:0, ...) — enable them under "Model access" in the Bedrock console and list them with aws bedrock list-inference-profiles. Offered by openant setup llm (leave the API key blank — AWS credential chain, probe skipped) — full guide: utilities/llm/pro/BEDROCK.md. |
| openrouter | openrouter.ai | Gateway to many pro with one key and one prepaid balance (also reads OPENROUTER_API_KEY). Model IDs are /model slugs (anthropic/claude-sonnet-4.6, openai/gpt-4o-mini, ...) — browse them at openrouter.ai/models. Offered by openant setup llm (leave the base URL blank for the OpenRouter default) — full guide: utilities/llm/pro/OPENROUTER.md. |
| ollama | — (local server) | Local models via Ollama. No api_key: leave it blank (a placeholder is sent automatically); base URL defaults to . Models must be pulled first (ollama pull <model>); model IDs are exactly what ollama list shows. Local inference is free — $0 cost reporting. Offered by openant setup llm — full guide: utilities/llm/pro/OLLAMA.md. |

All of them support tool calling, so any of them can drive the enhance and phases that use the agentic tool-use loop. For Ollama, pick a tools-capable model for those phases — very small local models may not handle tool calls reliably.

#### Quick path for Anthropic-only setups

If you want today's per-phase Claude defaults and nothing else, skip the wizard:

This uses the built-in openant-default config (compiled into the binary, no config.json needed) — Claude Opus 4.6 for detection phases, Sonnet 4 for the rest.

#### Hand-authored config

The wizard writes ~/.config/openant/config.json for you, but you can edit it directly too. Every llm-config must list all se phases:

llm_pro[name].request_timeout (seconds, positi or null) sets the adapter's per-request HTTP timeout — consumed by the google provider type (the only one whose SDK default is unbounded); other types warn loudly at startup if it is set.

Pro accept a custom base_url for OpenAI-compatible / Anthropic-compatible proxies (vLLM, Bedrock, internal gateways); OpenRouter has its own first-class openrouter provider type. The openant-default config (Claude across all phases) is built in and always a regardless of file contents.

#### Adding a new provider adapter

OpenAnt's adapter layer is a small Python recipe — one Python file implementing the LLMAdapter Protocol, one factory for the contract-test harness, plus a registry entry — and that alone is enough to run the adapter from a hand-authored config. To also have it offered by the openant setup llm wizard and pass its pre-sa, add a few Go touch-points in apps/openant-cli/cmd/setup.go (the supported-provider list, a probe case, the per-phase default-model maps) plus a Go probe function. The 12 contract tests run automatically against your adapter once it's wired in. See docs/features/llm-pro/HOW_TO_ADD_AN_ADAPTER.md for the full recipe.

Python runtime

OpenAnt's parsing, enhancement, analysis, and reporting code is Python 3.11+. The Go CLI picks an interpreter in this order:

1. OPENANT_PYTHON env var (set this to pin a specific interpreter — e.g. OPENANT_PYTHON=python3.11).
2. Managed venv at ~/.openant/venv/ (auto-created on first use). The CLI uses bin/python on Linux/macOS and Scripts\python.exe on Windows.
3. python3 / python on PATH.

If none yield Python 3.11+, the command exits with an error pointing at python.org. To rebuild a stale managed venv (e.g. after upgrading Python), delete ~/.openant/venv/ and rerun any openant command.

Data directories

OpenAnt creates two directories:

Analyzing a project

1. Initialize

Point OpenAnt at a repository. The -l flag (language) is required — use go or python.

This creates a project workspace and sets it as the acti. All subsequent commands operate on the acti automatically — no path arguments needed.

2. Run the pipeline

Each step picks up the output of the previous one from the project's scan directory:

Or run the full pipeline in one command:

#### Exit codes (important for CI)

openant scan — and each step verb (analyze, , …) when run step-by-step —
exits 1 when it finds — that is the tool working, not failing. The
contract:

| Exit code | Meaning |
|---|---|
| 0 | Clean scan — no found |
| 1 | found (a successful run) |
| 2 | Error — the scan itself failed (check errors in the JSON en on stdout) |

Generic CI steps and process super treat any non-zero exit as a failure, which
misclassifies a healthy findings run. Gate on the contract instead of parsing stdout:

The || rc=$? form matters: CI defaults to set -e (GitHub Actions run:, Jenkins sh),
where a bare openant scan exiting 1 would terminate the script before the capture line —
reproducing exactly the misclassification this section exists to prevent.

Web UI

openant serve starts a local web UI over the same scan pipeline: submit a
repository URL or local path, watch the scan logs stream live, and read the HTML
report, markdown summary, and disclosures — all from the browser.

The ser to loopback only (it refuses any non-loopback --addr) and is
intended for local single-user use. Scan outputs persist under
~/.openant/webui/ across restarts. Analysis still sends source code to your
configured LLM provider, the same as the CLI.

Incremental and diff-based scans

For repositories where a full scan is too slow or expensi can
restrict the pipeline to units whose bodies o a git diff hunk:

--staged reads git diff --cached and is intended for pre-commit hooks or
local "scan what I'm about to commit" runs. The base is HEAD; the head is the
index, so files staged with git add are scanned and worktree-only edits are
not.

The shorter openant diff form takes the same flags, e.g.:

Working with multiple projects

The pipeline operates on one project at a time. Running openant init sets the newly initialized project as the active one, so all subsequent commands target it by default.

If you're working with several projects, you have two options:

Project management

PRs welcome — open an issue first if the scope is non-trivial so we can align before you build.

LICENSE

This project is licensed under Apache 2. See the LICENSE file for details.

Disclaimer and legal notice

This project is intended for defensive and research purposes only. OpenAnt is still in the research phase, use it carefully and at your own risk. Knostic, OpenAnt, and associated de, researchers, and maintainers assume no responsibility whatsoever for any misuse, damage, or consequences arising from the use of this tool.

Only scan code you own or ha permission to test. If you discover a in someone else's project through legitimate means, please follow coordinated disclosure practices and report it to the maintainers before making it public.

项目信息

开发语言：Python

Star 数：756

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws while minimizing both false positives and false negatives. Stage 1 detects. Stage 2 attacks. What survives is real.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。