Havuz

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Keep Go packages flat without losing their internal boundaries: file-level private and package scopes for declarations, methods and struct f

Turn a public GitHub repository into an interactive software architecture graph. Static analysis, flow tracing, analytics. MIT licensed.

Static analysis for the debt AI agents leave in PHP: 34 rules, Claude Code hooks, git-diff review, a Rector and Pint fix pass, Pest expectat

零依赖的本地 APK/AAR/DEX 结构索引 + MCP Server。17 个工具，为 Xposed 模块开发提供静态反查。

Deterministic code-graph context engine for AI coding agents - PostgreSQL + Apache AGE + pgvector, MCP & REST, no LLM in the loop.

Normify · DSH 插件：把项目架构写成归一化的分形模块树，三层校验（写时 / 校验 / 冻结回执）、30 个 normify_* 工具 + normify-gen 技能，一键渲染单文件交互式架构图；支持伴随式开发（change_open → brief → check

Jadart is a fast Flutter decompiler designed for Agents/Mobile Security Researchers.

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandato

codexqa: 11 local-first Agent Skills for Cursor, Claude Code, Codex & OpenClaw — change impact analysis, AI code review, defect scan, testca

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Spring Boot + MyBatis 框架感知代码地图：静态分析调用链/SQL/事务/实体影响面，通过 MCP 喂给 AI 编程工具（Trae/Cursor/Claude Code），省 token、防幻觉

Offline WebAssembly component inspection and capability-policy toolkit - decode .wasm binaries, classify host capabilities, gate against exp

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

An architectural audit where a finding is admissible only once its cost is measured from git history. A doctrine for coding agents plus a st

A tool that replaces everything that can be deterministic in repository work: search, symbols, callers, task scope, history, review and Git

Audits a repository for how ready it is for AI coding agents, and returns a prioritized fix backlog with evidence for every finding.

Rust-native, multi-session headless IDA Pro MCP server with isolated workers and stdio or Streamable HTTP transports.

Watch for bugs like a hawk! gohawk is a set of static analyzers for Go, focused on concurrency and resource-lifetime bugs.

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

Code review via the change impact measure

FSharp refactoring tool - The tool clarifies the (agent-generated or old) code's intent, reduces non-alphanumeric noise, and uses built-in .

Interactive static pattern discovery tool to locate structures from frequent patterns

Measure and stop structural erosion in AI-written TypeScript. Slop Check finds the mess, the Deslop tools clean it. Based on SlopCodeBench (

Architectural linting for Swift developers and coding agents

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Turn a security or performance exposure into a reviewable decision

A PHPStan extension for analysis of Laravel applications and packages.

DeepSeek Harness (DSH) plugin: a read-only ledger for the plugins you already have installed — a capability inventory with file:line evidenc

A Gradle plugin for auditing Kotlin Multiplatform iOS export surfaces and measuring linked binary size. Finds Objective-C declarations for r

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

LintEval: Benchmarking LLMs on Linter-Guided File Refactoring (EMNLP 2026 Findings) — multi-language benchmark for linter-guided refactoring

Paste a URL, find out something true about the site. Three URL-only readings on one page: Slopmeter scores how much of it is still the templ

Gradual effect, contract, async-safety, and temporal checking for existing TypeScript.

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Local static analysis and baseline-governed CI checks for coding-agent instructions: AGENTS.md, CLAUDE.md, Cursor, Copilot, and Gemini.

Static flow analyzer for PHP applications — trace routes through messages, services, database effects and external HTTP calls without runnin

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Structural code intelligence for DeepSeek Harness (dsh) — gives the agent codegraph and codegraph_index tools to find where a symbol is decl

Senior-developer discipline for AI coding agents. A commit gate that counts unchecked as failing, quality controllers that refuse to call un

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security a

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

🥷 Give your codebase a black belt. Local code intelligence, security analysis, and compiler-backed facts for humans and AI.

Browser-based, syntax-aware code comment stripper that removes comments from source code while preserving strings, URLs, template literals,

A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.

Multi-language static analysis for agents, editors, and large repositories.

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compile

Android Studio plugin that catches common Kotlin coroutine and Flow mistakes (leaks, ANRs, flaky tests) with context-aware quick fixes

Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input tha