Why a security company hardened Kimi's coding CLI, and why we're giving the fork away.
At DefectDojo we're genuinely excited about what AI can do for security teams. We built Sensei, the AI engine behind DefectDojo’s auto-remedation capabilities for AppSec and CSPM, and Claude models do heavy lifting across our company every single day.
But you know what I don't love about AI? My Anthropic bill. 💀
So when Moonshot AI released Kimi K3 in July with open weights, we paid attention. The capabilities are not hype. K3 sits within three points of Claude Fable 5 on the Artificial Analysis Intelligence Index (57 vs 60), takes the top spot on Frontend Code Arena (1,679 Elo to Fable's 1,631), and solves 2.8x more coding tasks per dollar on the DeepSWE benchmark. It lists at $3 per million input tokens and $15 per million output. That is literally Sonnet pricing (Claude Sonnet 5's standard list price is the same $3/$15) for a model within shouting distance of Fable, which lists at $10/$50.
At that price the math changes. "Run an agent on every finding" stops being the line item your CFO circles in red. Autonomous pipelines you would never fund at frontier prices suddenly pencil out.
There's a catch, and the catch is why this post exists.
Two separate problems hide inside "just use the cheap model."
The first is where your tokens go. Our context windows are full of security findings and customer-adjacent data, and we're not sending that to any API we haven't vetted, at any price. Open weights solve this completely: you pick the inference. We point ours at US-hosted inference with the privacy and retention guarantees we need. Your own GPUs work too. Control over the data path is the entire point of open weights.
The second is the agent harness itself, and this one gets ignored. A coding CLI runs with your shell, your filesystem, and your credentials. Before we let kimi-code (Moonshot's coding CLI, their answer to Claude Code) anywhere near real work, we audited it the way we'd audit anything with that much reach. It's genuinely nice software. It also shipped with behaviors we would flag in any customer's environment. So we did what we tell everyone else to do with findings: triage, fix, ship.
Ten pull requests on top of upstream v0.34.0, each one reviewable on its own:
Some of these are bugs by anyone's definition. Others are opinionated defaults for our threat model: an agent working unattended inside a company whose repos are full of security context. Take what fits yours.
We still pay Anthropic, happily. Fable 5 does the planning, the adversarial review, and anything investigative, because it's the best model in the world at exactly that. The hardened Kimi CLI does the well-scoped execution work in between, where volume drives the bill, not brilliance. Plan expensive, execute cheap, review expensive. Your Anthropic budget goes to the problems that deserve it.
The fork is public and MIT-licensed: github.com/DefectDojo/kimi-code, baseline upstream v0.34.0, hardening in PRs #1 through #10. If you're dabbling with Kimi for engineering work, start from the hardened fork instead of stock defaults.
And if you find something we missed, file an issue. Finding problems in security tools is the most DefectDojo thing there is.
Happy coding!
About DefectDojo: DefectDojo is the open source unified vulnerability management platform, enabling security teams to focus on prioritizing and remediating the most critical vulnerabilities. Parse any security finding, aggregate across your stack, and report on your security posture and compliance.