Skip to main content
A pattern matcher flags a line and moves on. An agentgg agent reads the code around that line, follows the imports, and traces who calls it. It reports the finding only when the code confirms it.

agentgg on GitHub

The CLI is open source under the Apache 2.0 licence. Read the code, open an issue, or send a pull request.

​
The report

A scan writes a report to an output directory of your choice. The report has two parts.
  • A summary. One page with the counts, the findings grouped by agent and by severity, and a link to each finding.
  • One file per finding. Each names the source file and the exact lines, then explains the problem, how to reproduce it, and what it costs you.
Every finding carries a severity, a CVSS score, and a verdict that says whether a second pass confirmed it. See Resume and reports for the full shape of both parts.

​
What you need

  • Node.js 20 or later.
  • An account with one model provider. See Providers for the list of providers.

​
The hosted platform

The platform runs the same agents on our machines instead of yours. It needs no install, and it provides the model, so you bring no API key.

The agentgg platform

Scan from a dashboard, scan every pull request, and share findings with your team.