Havuz

Automated quality checks that nudge AI coding agents toward better habits

Watch for bugs like a hawk! gohawk is a set of static analyzers for Go, focused on concurrency and resource-lifetime bugs.

Free open-source toolkit to understand, audit and rescue vibe-coded or legacy codebases: source-linked maps, team handoff, human-approved fi

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Local-first static analysis for EF Core: finds performance and correctness problems (SaveChanges in loops, unbounded queries, cartesian Incl

Agent dashboard runs reliability scans, skills, and network access probes.

Cheaper and better Greptile alternative runs on your own github actions.

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

Local-only Go static analysis engine with a built-in MCP server. Gives AI coding agents deterministic structural awareness: call graphs, imp

Review code changes by what they do, and learn the concepts behind them.

Turn a security or performance exposure into a reviewable decision

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

Kotlin formatter and linter in Rust, drop-in ktfmt and ktlint (2.0 and 1.8) replacements with identical output.

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security a

graf is graphify, rebuilt properly in rust: 1000x faster search, 89x faster updates, and one native binary.

Static reverse engineering of untrusted files with verifiable, byte-anchored evidence. Open tools (Ghidra, JADX, LIEF, YARA-X, Babel) in loc

Static decompiler, deobfuscator, and unpacker for reverse engineering and malware analysis: Python decompiler (3.8-3.15), PyInstaller extrac

Code review via the change impact measure

Keep Go packages flat without losing their internal boundaries: file-level private and package scopes for declarations, methods and struct f

Hybrid: a Go superset with compiler-enforced ownership & sendability. Add a .hy file, get plain readable Go. If you know Go, you already kno

Program dependence graph and architecture/code-flow analysis for BEAM projects

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support.

Recommend AI coding harness changes from repository context and coding signals, then distribute approved rules, skills, hooks and agents to

Framework-aware code intelligence MCP server — 91 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, c

Static reproducibility checks, experiment replay, and verification for ML pipelines.

A codebase scanner that helps you not run malicous code

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

REA (Reverse Engineer Anything) in Docker: one image per analysis engine (Ghidra / Hopper / IDA) with a full reverse-engineering toolchain,

ER diagrams, N+1 detection, schema drift & migration-risk linting for Django and SQLAlchemy (Alembic) — VS Code, CLI and MCP server. Static

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

AI-powered desktop app for migrating Python projects to Rust. Supports multiple LLM providers (OpenAI, Anthropic, Ollama), includes 300+ lib

MCP server that orchestrates language servers into agent-native workflows. 65 tools, 30 CI-verified languages.

Deterministic Git & AST change intelligence engine and Model Context Protocol (MCP) server. Detects breaking changes, maps caller blast radi

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

Architectural linting for Swift developers and coding agents

Finds the code your AI wrote twice. Fast, offline duplicate-code detector: scan, history chart, CI gate. No AI required.

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers i

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests ov

Tamper-resistant regression gate for AI coding-agent instructions—AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and more.

Zero-G Reverse Engineering Anything & Verified Safe Rust Reconstruction for Gemini 4 Argon + Google Antigravity 2.0 (4-Mount Recon Kits, Who

Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compile

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

Help your agents find the smoking gun they're looking for. Optimization evidence for agents: find complexity hotspots.

Agent skills for fallow. They teach coding agents (Claude Code, Codex, Cursor, and others) to check health, complexity, duplication, archite

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Experimental macOS Apple Silicon first recompiler of PS4 programs