Havuz

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

A fast experimental PHP static analyzer written in Rust, a port of Psalm

Static-analysis-based dataset for training LLMs to detect, explain, and patch security vulnerabilities (Java, Korean/English annotations, ve

A static analysis linter for Stellar Soroban smart contracts to catch input-independent resource cost anti-patterns before deployment.

Tool to report source code metrics

Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (rad

Android Studio plugin that catches common Kotlin coroutine and Flow mistakes (leaks, ANRs, flaky tests) with context-aware quick fixes

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Browser-based, syntax-aware code comment stripper that removes comments from source code while preserving strings, URLs, template literals,

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

Rust Based Multi-language Static Analyser & Developer tools for the AI age.

The modern, intelligent codebase aware linter for environment correctness

Instantly understand any codebase. One command, zero API keys, works fully offline. Auto-detects 20+ project types, maps architecture, and e

Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.

Auditable code intelligence for AI agents - map dependencies, predict change impact, select the right tests, and verify refactors before the

Your AI works the night shift — read-only reviews of your projects while you're busy, one digest every morning.

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

A tool that replaces everything that can be deterministic in repository work: search, symbols, callers, task scope, history, review and Git

Compare OpenAPI specs and find potential affected JS, TS, and Python callers. Offline, zero runtime dependencies, with a one-command demo.

Portable, always-fresh docs for agents and humans. A Surface hub is a conformant OKF concept; Surface adds the freshness OKF leaves out - it

Turn a public GitHub repository into an interactive software architecture graph. Static analysis, flow tracing, analytics. MIT licensed.

The Polyspace Agentic Toolkit brings trusted Polyspace capabilities to AI agents.

Relational codebase compiler and spec-driven containment engine for AI coding agents. Compiles polyglot repos (Rust, Python, TS, Go, C/C++,

Auditions Ruby scripts, gems, Rack apps, and Rails applications for the ability to run under Ractors: static analysis of Ractor-isolation vi

EKOS is an AI-native platform that continuously reconstructs, compiles, stores and serves enterprise knowledge.

Evidence-backed TS/JS repo structure lens for Claude Code

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

Static analysis engine for Python web-applications

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

Audits a repository for how ready it is for AI coding agents, and returns a prioritized fix backlog with evidence for every finding.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

🥷 Give your codebase a black belt. Local code intelligence, security analysis, and compiler-backed facts for humans and AI.

Logic-first AI code review via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Catches behavioral bugs, ty

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

DeepSeek Harness (DSH) plugin: a read-only ledger for the plugins you already have installed — a capability inventory with file:line evidenc

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

给 AI 生成代码做安全审阅的终端工具：410 条漏洞清单，20 条本地规则 + 模型逐条判定（带证据核实），看完 diff 再决定要不要写（Rust）

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

Your SvelteKit app's code health, checked before it ships. Statically, no browser — SEO, Performance, Correctness, Security, Architecture, A

🔥 AI agent that ports CUDA code to AMD ROCm using local LLMs — FastAPI + React + Ollama | Live: rocmporter-agent.vercel.app

🎵 Grade your vibe-coded project. One command, instant letter grade across security, quality, dependencies, and testing.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Prevent cross-repo architectural breakage before merge. Architecture knowledge graph from static analysis, blast radius in CI, MCP server fo

Continuously refine your project’s engineering philosophy — and keep AI coding agents honest with evidence-backed completion.

Dead code detector for Dart and Flutter. Finds declarations that are never referenced — classes, functions, methods, fields, constants, enum

Hybrid: a Go superset with compiler-enforced ownership & sendability. Add a .hy file, get plain readable Go. If you know Go, you already kno

A terminal UI for Yocto/OpenEmbedded static analysis, style checks, layer validation, patch auditing and license compliance.

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX