Havuz

🇺🇦🇵🇱 A static analysis tool for OpenTelemetry Collector configurations. Built on OPA/Rego, it validates your pipelines, receivers, processor

PE/ELF x86/x64 CFG extractor

Ship agentic. Stay coherent. Self-checking code integrity for AI coding agents, via MCP.

AI code quality toolkit — deterministic linter for the AI coding era. 22 detectors, GitHub Action PR gate, zero LLM required.

Architecture-aware code search, dependency graphs, and impact analysis for Python, TypeScript, Rust, C#, Java, Go, Ruby, Rails, Free Pascal,

BPF portability analyzer for compiled eBPF object files. Reports minimum kernel version requirements, data flow patterns, and CO-RE coverage

Static analysis for Sierra adventure games: finds softlocks by abstract interpretation of decompiled SCI scripts, derives and verifies guard

Keep Go packages flat without losing their internal boundaries: file-level private and package scopes for declarations, methods and struct f

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Research-first architecture engine for Python, TS, Go and Rust. Mines GitHub Issues for real production failures before scaffolding, then au

Local-first static analysis for EF Core: finds performance and correctness problems (SaveChanges in loops, unbounded queries, cartesian Incl

Cache-line false sharing linter for Rust structs

AI code review pipeline — review, auto-fix, test generation & HTML report in one command. Zero dependencies, 6 AI providers (OpenAI/DeepSeek

Write oxlint custom lint rules with Effect v4

Static reproducibility checks, experiment replay, and verification for ML pipelines.

A CLI that extracts the useful structure from source files: signatures, imports, types, variables, comments, and Markdown sections.

Comprehensive multi-agent code review for Claude Code

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

Deterministic failure-mode scanner for TypeScript. Catches missing error handling around npm packages like Axios, Stripe, and Prisma before

Local-first static analysis that turns source code into deterministic, source-grounded workflow maps for coding agents via MCP.

The Hale programming language: general-purpose, native and memory-safe, from a five-line script to a dynamic distributed system. Less langua

Open-source design-system drift scanner — audit tokens, components, a11y & docs; score adoption; hand fixes to your coding agent. Local-firs

Briev: a contract-enforced programming language and compiler. Verified state transitions, LLVM backend, reactive execution, multi-target cod

Detect and patch vulnerabilities in AI-generated Python code — VS Code extension

Generate OpenAPI 3.1 specs from Go source code via static analysis — zero annotations, automatic framework detection

Interactive static pattern discovery tool to locate structures from frequent patterns

A codebase scanner that helps you not run malicous code

Solana's SOL-0XX security standard — bug-class rules distilled from $514M of real exploits, firing as you code in every AI tool, editor & CI

phpcpd-next is a token-based copy/paste (clone) detector for PHP 8.4+, a modernized, openly-licensed successor to Sebastian Bergmann's phpc

Hermes Agent-focused architecture and runtime health checks

AI-powered desktop app for migrating Python projects to Rust. Supports multiple LLM providers (OpenAI, Anthropic, Ollama), includes 300+ lib

A PHPStan extension for analysis of Laravel applications and packages.

Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. Cy

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

A fast experimental PHP static analyzer written in Rust, a port of Psalm

Tool to report source code metrics

Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (rad

Android Studio plugin that catches common Kotlin coroutine and Flow mistakes (leaks, ANRs, flaky tests) with context-aware quick fixes

Browser-based, syntax-aware code comment stripper that removes comments from source code while preserving strings, URLs, template literals,

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

The modern, intelligent codebase aware linter for environment correctness

Instantly understand any codebase. One command, zero API keys, works fully offline. Auto-detects 20+ project types, maps architecture, and e

Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.

Auditable code intelligence for AI agents - map dependencies, predict change impact, select the right tests, and verify refactors before the

Your AI works the night shift — read-only reviews of your projects while you're busy, one digest every morning.

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

A tool that replaces everything that can be deterministic in repository work: search, symbols, callers, task scope, history, review and Git

Compare OpenAPI specs and find potential affected JS, TS, and Python callers. Offline, zero runtime dependencies, with a one-command demo.

Portable, always-fresh docs for agents and humans. A Surface hub is a conformant OKF concept; Surface adds the freshness OKF leaves out - it

Turn a public GitHub repository into an interactive software architecture graph. Static analysis, flow tracing, analytics. MIT licensed.