Havuz

Deterministic code quality gate for AI coding agents (Claude Code, Codex, pi): git hooks that block test tampering, hold the CRAP bar on cha

Measure and stop structural erosion in AI-written TypeScript. Slop Check finds the mess, the Deslop tools clean it. Based on SlopCodeBench (

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Contract intelligence, inspection, interface analysis, compatibility, deployment verification, and reproducibility tooling for Stellar and S

Static, no-execution security checks for Hermes Agent plugins

Multi-language cognitive complexity linter, as a single static binary

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Repo dependency analyzer with **blast-radius impact scoring** for AI-assisted development.

Local-only Go static analysis engine with a built-in MCP server. Gives AI coding agents deterministic structural awareness: call graphs, imp

A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scorin

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

A single-binary CLI tool that detects a software project's toolchain, configuration, and conventions, then outputs a structured report.

SQL as a first-class language: formatting, linting, security auditing and pre-commit hooks for your .sql files, plus type-safe code generati

The Rails audit skill for AI coding agents, ranked by blast radius. 🚂☢️

Code review via the change impact measure

Static analysis and health checks for dbt projects.

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

A statistical code analyzer built from your repository's history.

Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.

Write oxlint custom lint rules with Effect v4

The Hale programming language: general-purpose, native and memory-safe, from a five-line script to a dynamic distributed system. Less langua

Open-source design-system drift scanner — audit tokens, components, a11y & docs; score adoption; hand fixes to your coding agent. Local-firs

Get your repo ready for AI.

A PHPStan extension for analysis of Laravel applications and packages.

Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. Cy

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

A static analysis linter for Stellar Soroban smart contracts to catch input-independent resource cost anti-patterns before deployment.

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Rust Based Multi-language Static Analyser & Developer tools for the AI age.

Instantly understand any codebase. One command, zero API keys, works fully offline. Auto-detects 20+ project types, maps architecture, and e

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

A tool that replaces everything that can be deterministic in repository work: search, symbols, callers, task scope, history, review and Git

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

Audits a repository for how ready it is for AI coding agents, and returns a prioritized fix backlog with evidence for every finding.

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Dead code detector for Dart and Flutter. Finds declarations that are never referenced — classes, functions, methods, fields, constants, enum

Multi-language static analysis for agents, editors, and large repositories.

"Review Ducktective" is an automated code review platform based on an LLM: it takes a diff as input and outputs structured findings with sev

Delphi-native, MIT-licensed RAG + linter for Delphi/Pascal source code. Symbol-exact + fuzzy + tree-sitter lint. Pure Delphi at runtime.

Deterministic semantic linter and PR reviewer for IEC 61131-3 Structured Text. 80 checks across diff-based, static integrity, FB-instance, P

Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input tha

A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.

路由器品牌插件！[BroTech] Router enhancement script for Xiaomi, ASUS, HUAWEI & TP-Link. Built for network geeks! Rebuilds dashboards with high-preci

MIT-licensed code knowledge graph: index any source repo into a queryable graph of symbols, call chains and blast radius — with wiki generat

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Fast iOS decompiler & Mach-O disassembler in Rust — arm64, Objective-C class-dump, Swift metadata, and a native desktop GUI. Reads .ipa/App