Havuz

EvalForge, AI evaluation sonuçlarını baseline karşılaştırmaları ve CI quality gate’leriyle değerlendirip standart rapor formatlarında yayımlar.

Neden yükseliyor · RAG evaluation sonuçlarını CI’da denetlenebilir kanıta ve release gate’lerine bağlama ihtiyacına odaklanıyor; repo 34 günde 211 yıldız almış. Ancak README bağımsız doğrulanmış downstream benimsemenin henüz bulunmadığını belirtiyor ve son 28 günde katkı tek yazardan gelmiş; ilginin gerçek kullanımın kanıtı olduğu söylenemez.

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandato

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, a

Offline prompt-contract auditor for Hermes, Claude Code, Codex, OpenCode & OpenClaw. Pre-write guard before agents ship vague code. Zero dep

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

ImpactGuard — Lightweight multi-language API impact analyzer

Scan agents and auto-remediate agent reliability issues in GitHub Actions

phpcpd-next is a token-based copy/paste (clone) detector for PHP 8.4+, a modernized, openly-licensed successor to Sebastian Bergmann's phpc

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks. 100% open source (MIT).

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

An architectural audit where a finding is admissible only once its cost is measured from git history. A doctrine for coding agents plus a st

Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or d

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Deterministic security analysis for agent skill files.