Havuz

Normify · DSH 插件：把项目架构写成归一化的分形模块树，三层校验（写时 / 校验 / 冻结回执）、30 个 normify_* 工具 + normify-gen 技能，一键渲染单文件交互式架构图；支持伴随式开发（change_open → brief → check

Cheaper and better Greptile alternative runs on your own github actions.

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

Framework-aware code intelligence MCP server — 91 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, c

Program dependence graph and architecture/code-flow analysis for BEAM projects

Static decompiler, deobfuscator, and unpacker for reverse engineering and malware analysis: Python decompiler (3.8-3.15), PyInstaller extrac

MCP server that orchestrates language servers into agent-native workflows. 65 tools, 30 CI-verified languages.

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

Agent skills for fallow. They teach coding agents (Claude Code, Codex, Cursor, and others) to check health, complexity, duplication, archite

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support.

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Finds the code your AI wrote twice. Fast, offline duplicate-code detector: scan, history chart, CI gate. No AI required.

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Watch for bugs like a hawk! gohawk is a set of static analyzers for Go, focused on concurrency and resource-lifetime bugs.

The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]

ER diagrams, N+1 detection, schema drift & migration-risk linting for Django and SQLAlchemy (Alembic) — VS Code, CLI and MCP server. Static

Predict the silent integration traps an AI agent would ship (zero-revenue configs, auth bypasses, immutable wrong choices) — then enforce, i

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Per-entry-point, navigable call-graph visualizations of Solidity repositories — for Web3 security auditors.

The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, a

A single-binary CLI tool that detects a software project's toolchain, configuration, and conventions, then outputs a structured report.

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security a

Turn a security or performance exposure into a reviewable decision

Agent Reliability Analyzer: deterministic scanner that finds and fixes AI agent reliability failures

SQL as a first-class language: formatting, linting, security auditing and pre-commit hooks for your .sql files, plus type-safe code generati

CodeAutopsy is an AI-powered GitHub repository analyzer that automatically detects architecture patterns, execution flow, tech stack, and ke

MCP server for AI coding agents. Instead of reading files one by one, your agent gets dependency graphs, git intent, blast radius, and chang

Semantic code intelligence MCP server for Claude Code - project maps, symbol search, impact analysis, and more

The Rails audit skill for AI coding agents, ranked by blast radius. 🚂☢️

The 10-second codebase tour. Understand any repo in one command.

Excel VBA integration for VS Code - Tree View / Full Direct VBA Read+Write / LiveShare Compatible / Direct Agentic AI Integrations

Roslyn-based MCP server giving AI agents deep semantic understanding of .NET/C# codebases — 67 tools for navigation, call graphs, diagnostic

Code review via the change impact measure

Offline prompt-contract auditor for Hermes, Claude Code, Codex, OpenCode & OpenClaw. Pre-write guard before agents ship vague code. Zero dep

Static analysis and health checks for dbt projects.

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessmen

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests ov

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

🇺🇦🇵🇱 A static analysis tool for OpenTelemetry Collector configurations. Built on OPA/Rego, it validates your pipelines, receivers, processor

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

Claude Code / agentic security skill for Solana programs and software. Full audit-firm lifecycle, executable PoC + fix-patch delivery, a Rus

PE/ELF x86/x64 CFG extractor

Ship agentic. Stay coherent. Self-checking code integrity for AI coding agents, via MCP.

Is your CLI ready for AI agents? Automated checks to ensure optimum agentic CLI use: don't block agents, don't waste tokens, ensure safe use

AI code quality toolkit — deterministic linter for the AI coding era. 22 detectors, GitHub Action PR gate, zero LLM required.

Open-source security gateway & static scanner for AI agents. Enforce role-based access control (RBAC), human-in-the-loop approvals, segreg