agentgg CLI
Agentic SAST scanner: AI agents read your code, confirm findings through the call graph and scan a whole repository or a diff for pull request review
- 440 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The project's source code goes to the chosen model provider unless you use local Ollama
- agentgg init stores the provider key on disk
- Agents spend tokens on every scan and write reports to the directory given in -o
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/agentggDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The project's source code goes to the chosen model provider unless you use local Ollama
- agentgg init stores the provider key on disk
- Agents spend tokens on every scan and write reports to the directory given in -o
This is third-party code. Review the repository files before installing.
What it does
agentgg looks for vulnerabilities in source code with AI agents. Unlike pattern-matching SAST, its agents read the code and reason about it: they follow imports, check the call graph and confirm a finding before reporting it. Every scan opens with a quick recon pass that briefs the agents on what the project is, and an interrupted scan resumes on re-run. The tool installs through npm (npm install -g agentgg, Node.js 20 or newer) and uses your own model provider: Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter or local Ollama. agentgg init picks the provider and saves the key once. agentgg scan ./src -o ./out checks everything, and --diff origin/main...HEAD limits the scan to a branch's changes. The result is a summary.md plus one markdown file per finding, and agentgg status and agentgg view show the outcome in the terminal and in a local web UI. An agent here is one markdown file: YAML frontmatter says where to look (extensions and file patterns) and whether the agent is worth running on this project, and the body serves as the prompt. The agent catalog downloads on the first scan from the agentgg-agents repository, and agentgg create turns a past incident report into a new agent.
Who it is for. For developers and application security engineers who want a white-box scan with reasoning agents instead of template SAST, including in CI.
Good fit when
- Before merging a pull request you want to scan only the branch's changes with agentgg scan --diff origin/main...HEAD
- A pattern scanner produces many false positives and you want findings the agent confirmed through the call graph
- You want to choose the model yourself: Anthropic, OpenAI, Bedrock, Vertex AI, OpenRouter or local Ollama
- A past incident should become a repeatable check: agentgg create does that
- Results should be readable as markdown files in ./out and browsable in a local web UI
Not a fit when
- Code must not be sent to an outside model provider: without local Ollama, code fragments go to your chosen provider
- You need a proven stable tool: the author labels agentgg beta, so expect rough edges and changes
- You need to scan a running application from outside: agentgg reads source code and does not attack a service
- You want to avoid an account with a model provider: you always need your own key, except in the hosted service at app.agentgg.dev
Example request
Run agentgg on the src folder against changes since origin/main and list the confirmed findings by severityLimitations
Needs Node.js 20 or newer and an account with one model provider (Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter) or a local Ollama. Provider setup is covered in the documentation.
- The author calls the project beta: expect rough edges and changes.
- The quality of findings depends on the chosen model, and so does token spend: a large repository means many requests.
- Re-running with the same -o skips unchanged files, while a different directory starts fresh.
- The OpenAI and Anthropic APIs are unavailable from Russia; among local options Ollama works.
How to disable. Remove the tool with npm uninstall -g agentgg. Scan results live in the directory you passed with -o, and the provider key was stored by agentgg init.
FAQ
How is agentgg different from Semgrep?
Semgrep matches code against rules, while agentgg's agents read the code, follow imports, check the call graph and confirm a finding before reporting it.
How do I scan only a pull request's changes?
Run agentgg scan ./src --diff origin/main...HEAD -o ./out. The result appears in ./out/summary.md and in a separate file per finding.
Which models does agentgg support?
Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter and local Ollama. agentgg init picks the provider.
What is an agent in agentgg?
One markdown file: the YAML frontmatter lists extensions and file patterns and, optionally, a precondition for whether the agent suits the project. The file body serves as the prompt.
Can I use agentgg without installing it?
Yes, the same scanner runs as a hosted service at app.agentgg.dev: you upload a repository, with no install and no provider key of your own.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
19 Google skills to find, reproduce and patch vulnerabilities: from a threat model to a patch and a report, plus an ADK reference harness
Burp Suite extension with AI: analyzes requests, runs scanners and opens Burp over MCP to Claude Desktop, Claude Code, Codex and Gemini CLI
A set of skills that turns the agent into a static code analyzer: finds vulnerabilities and builds a prioritized report
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
Comparison with similar tools
Entries that share the main search query, and how they differ.
README in short
The page briefly describes agentic SAST: the idea, npm installation and five quick-start commands (init, scan, scan with diff, status, view). It continues with documentation links on running scans, providers and flags, a section on what an agent is (a markdown file with search conditions and a prompt) and the agent catalog that downloads on the first run. Contribution rules and the Apache 2.0 license close the page.