Havuz

Static-analysis-based dataset for training LLMs to detect, explain, and patch security vulnerabilities (Java, Korean/English annotations, ve

A static analysis linter for Stellar Soroban smart contracts to catch input-independent resource cost anti-patterns before deployment.

Tool to report source code metrics

Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (rad

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Android Studio plugin that catches common Kotlin coroutine and Flow mistakes (leaks, ANRs, flaky tests) with context-aware quick fixes

Browser-based, syntax-aware code comment stripper that removes comments from source code while preserving strings, URLs, template literals,

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

Rust Based Multi-language Static Analyser & Developer tools for the AI age.

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

ArchUnitRuby is an architecture testing library. Specify and ensure architecture rules in your Ruby app. Easy setup and pipeline integration

The modern, intelligent codebase aware linter for environment correctness

Instantly understand any codebase. One command, zero API keys, works fully offline. Auto-detects 20+ project types, maps architecture, and e

Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.

Auditable code intelligence for AI agents - map dependencies, predict change impact, select the right tests, and verify refactors before the

Experimental macOS Apple Silicon first recompiler of PS4 programs

Your AI works the night shift — read-only reviews of your projects while you're busy, one digest every morning.

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Relational codebase compiler and spec-driven containment engine for AI coding agents. Compiles polyglot repos (Rust, Python, TS, Go, C/C++,

The Polyspace Agentic Toolkit brings trusted Polyspace capabilities to AI agents.

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

A tool that replaces everything that can be deterministic in repository work: search, symbols, callers, task scope, history, review and Git

Compare OpenAPI specs and find potential affected JS, TS, and Python callers. Offline, zero runtime dependencies, with a one-command demo.

Portable, always-fresh docs for agents and humans. A Surface hub is a conformant OKF concept; Surface adds the freshness OKF leaves out - it

Turn a public GitHub repository into an interactive software architecture graph. Static analysis, flow tracing, analytics. MIT licensed.

Architecture quality gate for polyglot codebases: declare components and allowed dependencies, fail the build on drift

Auditions Ruby scripts, gems, Rack apps, and Rails applications for the ability to run under Ractors: static analysis of Ractor-isolation vi

EKOS is an AI-native platform that continuously reconstructs, compiles, stores and serves enterprise knowledge.

Evidence-backed TS/JS repo structure lens for Claude Code

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

Static analysis engine for Python web-applications

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

🔥 AI agent that ports CUDA code to AMD ROCm using local LLMs — FastAPI + React + Ollama | Live: rocmporter-agent.vercel.app

Audits a repository for how ready it is for AI coding agents, and returns a prioritized fix backlog with evidence for every finding.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

🥷 Give your codebase a black belt. Local code intelligence, security analysis, and compiler-backed facts for humans and AI.

Logic-first AI code review via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Catches behavioral bugs, ty

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

DeepSeek Harness (DSH) plugin: a read-only ledger for the plugins you already have installed — a capability inventory with file:line evidenc

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

Jadart is a fast Flutter decompiler designed for Agents/Mobile Security Researchers.

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Hybrid: a Go superset with compiler-enforced ownership & sendability. Add a .hy file, get plain readable Go. If you know Go, you already kno

给 AI 生成代码做安全审阅的终端工具：410 条漏洞清单，20 条本地规则 + 模型逐条判定（带证据核实），看完 diff 再决定要不要写（Rust）

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

Your SvelteKit app's code health, checked before it ships. Statically, no browser — SEO, Performance, Correctness, Security, Architecture, A

🎵 Grade your vibe-coded project. One command, instant letter grade across security, quality, dependencies, and testing.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Prevent cross-repo architectural breakage before merge. Architecture knowledge graph from static analysis, blast radius in CI, MCP server fo

Rust-native reverse-engineering workspace for SLEIGH lifting, semantics-first decompilation, emulation, and validated binary-to-source recon