Every agent change is checked before it reaches main.
Agents write more code than a reviewer can read. gitta checks each change while the agent works and again before it reaches main. A risky change is reported in the merge and on the record.
What gitta watches for.
The checks run on every agent and in every language gitta reads. The agent hears about a problem in its own session, while the fix is still small.
- Risky new code
- New lines are checked for well known risks, such as database or shell commands built from text, certificate checks turned off and secrets in code or logs.
- Weakened protection
- When an agent removes a login, permission or input check that other code relies on, both agents are told and the merge reports it.
- Weakened tests
- A test or CI check that an agent weakens is reported in the merge output and goes on the record. In CI such a merge stops by default.
- Credentials in code
- Work that holds what looks like a password or key is reported before it reaches main.
- Agent instructions
- Changes to files that steer agents, such as AGENTS.md, are flagged. gitta scan finds instruction files that a package planted in your dependencies.
- Mainframe code
- With gitta Enterprise, job steps and programs that give code more authority are reported in the merge and on the record.
Where your code is
Your code stays with you. gitta runs on your own machines.
With gitta Enterprise, the team server runs in your own cloud account. It receives only the files an agent changed, and it calls out only to your sign in provider. gitta uses fixed rules and your own tests, and sends your code to no AI model.
Ready for your security review.
Your security team can see what runs, where it runs and who can reach it.
- 01Software you can read
The gitta command is open source. Each release comes with a full list of its parts and of every algorithm and key it uses.
- 02A small, locked down server
One program in a small container with no shell, running without root rights on a read only file system.
- 03Your company sign in
People sign in with your OpenID Connect provider, such as Okta, Entra ID or Google. Every person and CI runner gets a token that expires and can be revoked.
Bring AI agents into your security process.
Tell us how your team reviews code today, and we will show you where gitta fits.
