Havuz

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support.

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Watch for bugs like a hawk! gohawk is a set of static analyzers for Go, focused on concurrency and resource-lifetime bugs.

Normify · DSH 插件：把项目架构写成归一化的分形模块树，三层校验（写时 / 校验 / 冻结回执）、30 个 normify_* 工具 + normify-gen 技能，一键渲染单文件交互式架构图；支持伴随式开发（change_open → brief → check

Cheaper and better Greptile alternative runs on your own github actions.

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Finds the code your AI wrote twice. Fast, offline duplicate-code detector: scan, history chart, CI gate. No AI required.

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]

ER diagrams, N+1 detection, schema drift & migration-risk linting for Django and SQLAlchemy (Alembic) — VS Code, CLI and MCP server. Static

TypeScript toolkit for Windows x64 native systems programming, memory manipulation, and process instrumentation.

Predict the silent integration traps an AI agent would ship (zero-revenue configs, auth bypasses, immutable wrong choices) — then enforce, i

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Per-entry-point, navigable call-graph visualizations of Solidity repositories — for Web3 security auditors.

A single-binary CLI tool that detects a software project's toolchain, configuration, and conventions, then outputs a structured report.

The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, a

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security a

Turn a security or performance exposure into a reviewable decision

Agent Reliability Analyzer: deterministic scanner that finds and fixes AI agent reliability failures

Local, evidence-based application security assessment engine and Claude Code plugin

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

CodeAutopsy is an AI-powered GitHub repository analyzer that automatically detects architecture patterns, execution flow, tech stack, and ke

SQL as a first-class language: formatting, linting, security auditing and pre-commit hooks for your .sql files, plus type-safe code generati

MCP server for AI coding agents. Instead of reading files one by one, your agent gets dependency graphs, git intent, blast radius, and chang

Semantic code intelligence MCP server for Claude Code - project maps, symbol search, impact analysis, and more

The Rails audit skill for AI coding agents, ranked by blast radius. 🚂☢️

The 10-second codebase tour. Understand any repo in one command.

Excel VBA integration for VS Code - Tree View / Full Direct VBA Read+Write / LiveShare Compatible / Direct Agentic AI Integrations

Evidence-driven Java security review workbench

Roslyn-based MCP server giving AI agents deep semantic understanding of .NET/C# codebases — 67 tools for navigation, call graphs, diagnostic

Code review via the change impact measure

ArchUnitRuby is an architecture testing library. Specify and ensure architecture rules in your Ruby app. Easy setup and pipeline integration

Offline prompt-contract auditor for Hermes, Claude Code, Codex, OpenCode & OpenClaw. Pre-write guard before agents ship vague code. Zero dep

Static analysis and health checks for dbt projects.

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessmen

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests ov

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

🇺🇦🇵🇱 A static analysis tool for OpenTelemetry Collector configurations. Built on OPA/Rego, it validates your pipelines, receivers, processor

Claude Code / agentic security skill for Solana programs and software. Full audit-firm lifecycle, executable PoC + fix-patch delivery, a Rus

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

PE/ELF x86/x64 CFG extractor

Ship agentic. Stay coherent. Self-checking code integrity for AI coding agents, via MCP.

Is your CLI ready for AI agents? Automated checks to ensure optimum agentic CLI use: don't block agents, don't waste tokens, ensure safe use

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

Help your agents find the smoking gun they're looking for. Optimization evidence for agents: find complexity hotspots.

AI code quality toolkit — deterministic linter for the AI coding era. 22 detectors, GitHub Action PR gate, zero LLM required.