Havuz

Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Cod

Mantis, AI coding agents ile kod tabanlarındaki güvenlik açıklarını araştırma, yeniden üretme ve düzeltme iş akışları kurmaya yönelik modüler bir toolkit ve referans harness sunuyor.

Neden yükseliyor · AI agent’lar ile güvenlik açığı bulma ve düzeltme ilgisinin artması projeye görünürlük kazandırmış olabilir; ancak yalnızca verilen ölçümlerden yükselişin nedenini doğrulamak mümkün değil. 104 günlük yaşında 1717 yıldız dikkat çekici ilgi gösterse de son 28 gündeki 5 commit ve 1 farklı yazar, güncel geliştirme hareketliliğinin sınırlı olduğuna işaret ediyor.

Local, evidence-based application security assessment engine and Claude Code plugin

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

codexqa: 11 local-first Agent Skills for Cursor, Claude Code, Codex & OpenClaw — change impact analysis, AI code review, defect scan, testca

Evidence-driven Java security review workbench

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

Know which security findings to fix first, across the scanners you already run. SAST, SCA, secrets, IaC and containers, every finding ranked

Static-analysis-based dataset for training LLMs to detect, explain, and patch security vulnerabilities (Java, Korean/English annotations, ve

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

The AI security agent guards your code.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

GitFlic is a GitLab and GitHub alternative for Git repository hosting, code review, issues, CI/CD, package registry, SAST/DAST/SCA, availabl

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

Outside-in replication of Anthropic's Mythos Preview / Project Glasswing — open-source agentic vulnerability-discovery scaffold on Claude Op

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

A fast experimental PHP static analyzer written in Rust, a port of Psalm

Security gate for AI-generated code - blocks the build until vulnerabilities are fixed

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

🥷 Give your codebase a black belt. Local code intelligence, security analysis, and compiler-backed facts for humans and AI.

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen

ImpactGuard — Lightweight multi-language API impact analyzer

DianXing - AI-Driven End-to-End Code Security Auditing