Havuz

PHPStan extension for Yii2

🛡️ Explainable AI Malware Analysis Platform with PE Static Analysis, YARA Engine, SHAP Explainability & Real-Time Dashboard

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

MCP server for deep semantic analysis of Scala via SemanticDB — exact find-usages, class hierarchies, implicit resolution & call paths for A

A terminal UI for Yocto/OpenEmbedded static analysis, style checks, layer validation, patch auditing and license compliance.

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

The Polyspace Agentic Toolkit brings trusted Polyspace capabilities to AI agents.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Universal zero-dependency linter and formatter. One pure-Rust binary (poly) that lints and formats ~30 languages in-process — ruff, oxc, bio

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Deterministic tree-sitter + SQLite/FTS5 code knowledge graph for coding agents and developers: symbols, calls and dependencies over a CLI, a

企业自托管 AI Code Review Agent ，一键自动分析 GitLab MR 与 Push，并回填总评和行内 Discussion。

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Evidence-backed TS/JS repo structure lens for Claude Code

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

AI pull-request reviewer: hybrid RAG + a code graph + Claude Code/Codex. Whole-repo context, inline GitHub comments grounded on exact code.

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

AI Powered Reverse Engineering Tool

A live, graph-verified map of your codebase for AI coding agents — real call graphs, compiler-verified edges, and hard safety gates on the w

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

Nuitka Assembly analyzer (as well as PyInstaller and other packagers) and native exe-files for extracting metadata, strings, modules, and st

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

Logic-first AI code review via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Catches behavioral bugs, ty

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Laravel compatibility preset and runner for Mago static analysis

Delphi-native, MIT-licensed RAG + linter for Delphi/Pascal source code. Symbol-exact + fuzzy + tree-sitter lint. Pure Delphi at runtime.

Additional linting rules for Rust projects

🔍 AI-powered automated code review tool that analyzes syntax, performance bottlenecks, and security flaws in pull requests.

Deterministic security analysis for agent skill files.

🎵 Grade your vibe-coded project. One command, instant letter grade across security, quality, dependencies, and testing.

See the full type-inference chain of any value in PHPStan, not just a single snapshot.

fallow for Neovim — see your unused code, dups, and health in a native split

Live code graph that fuses static analysis (tree-sitter) with OpenTelemetry runtime traces, queried over MCP so AI coding agents get real fu

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Static ROS 2 architecture analysis, visualization, auditing, and CI policy enforcement for Python and C++ workspaces.

Evidence-grounded AI agent for Java code repair with LLM-guided patches and human-in-the-loop review.

Deterministic semantic linter and PR reviewer for IEC 61131-3 Structured Text. 80 checks across diff-based, static integrity, FB-instance, P

Most tools give AI access to the codebase. Archon gives AI access to the change itself. Structural Analysis tool intergrated for AI planning

Static security & correctness linter for Payload CMS. Zero-config, deterministic, ts-morph-based. Catches access-control gaps, unsafe Local

Succeeded by SAUR: [https://github.com/PicasoTheDeal/SAUR](https://github.com/PicasoTheDeal/SAUR)

Agent-ready CLI for static page inspection, search triage, and browser handoff.

Pi extension that brings Fallow codebase intelligence into Pi as an agent tool and slash command.

Local-first repository context for coding agents: codegraph, cited project knowledge, change impact, and evidence-backed workflows.

Spring Boot + MyBatis 框架感知代码地图：静态分析调用链/SQL/事务/实体影响面，通过 MCP 喂给 AI 编程工具（Trae/Cursor/Claude Code），省 token、防幻觉

Normalize Tailwinds. A zero-config CLI and GitHub Action that finds bloated Tailwind utility classes and rewrites them into their short, can

Static secret scanner for source trees — regex rules, entropy scoring, and SARIF output for CI pipelines.