Havuz

Continuously refine your project’s engineering philosophy — and keep AI coding agents honest with evidence-backed completion.

Dead code detector for Dart and Flutter. Finds declarations that are never referenced — classes, functions, methods, fields, constants, enum

A terminal UI for Yocto/OpenEmbedded static analysis, style checks, layer validation, patch auditing and license compliance.

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

MCP server for deep semantic analysis of Scala via SemanticDB — exact find-usages, class hierarchies, implicit resolution & call paths for A

Turn your Ruby codebase into a galaxy

Which of your Home Assistant custom integrations stop working, and in which future release. Daily crawl of every HACS integration for deprec

Additional linting rules for Rust projects

Living docs for you and your AI assistant. VibeSequence reads your code and draws every route, command and handler as a zoomable sequence d

a cli based static python code reviewer

Live code graph that fuses static analysis (tree-sitter) with OpenTelemetry runtime traces, queried over MCP so AI coding agents get real fu

Static flow analyzer for PHP applications — trace routes through messages, services, database effects and external HTTP calls without runnin

Most tools give AI access to the codebase. Archon gives AI access to the change itself. Structural Analysis tool intergrated for AI planning

An eraser against LLM-induced code & document entropy. Support if you like it!

Deterministic code quality gate for AI coding agents (Claude Code, Codex, pi): git hooks that block test tampering, hold the CRAP bar on cha

An architectural audit where a finding is admissible only once its cost is measured from git history. A doctrine for coding agents plus a st

Deterministic tree-sitter + SQLite/FTS5 code knowledge graph for coding agents and developers: symbols, calls and dependencies over a CLI, a

Evidence-grounded AI agent for Java code repair with LLM-guided patches and human-in-the-loop review.

Lint CSS cascade layers across a whole project — contradictory order between files, silent name merges, unlayered rules winning.

Flag ATTACH DATABASE footguns — cross-database atomicity, alias shadowing, ambiguous unqualified tables.

Multi-language static analysis for agents, editors, and large repositories.

Universal zero-dependency linter and formatter. One pure-Rust binary (poly) that lints and formats ~30 languages in-process — ruff, oxc, bio

🔍 AI-powered automated code review tool that analyzes syntax, performance bottlenecks, and security flaws in pull requests.

AI pull-request reviewer: hybrid RAG + a code graph + Claude Code/Codex. Whole-repo context, inline GitHub comments grounded on exact code.

PHPStan extension for Yii2

"Review Ducktective" is an automated code review platform based on an LLM: it takes a diff as input and outputs structured findings with sev

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

Nuitka Assembly analyzer (as well as PyInstaller and other packagers) and native exe-files for extracting metadata, strings, modules, and st

LintEval: Benchmarking LLMs on Linter-Guided File Refactoring (EMNLP 2026 Findings) — multi-language benchmark for linter-guided refactoring

Delphi-native, MIT-licensed RAG + linter for Delphi/Pascal source code. Symbol-exact + fuzzy + tree-sitter lint. Pure Delphi at runtime.

Agentic code review with structural graph intelligence — PR gate + branch stewardship. Self-hosted. Apache-2.0.

Laravel compatibility preset and runner for Mago static analysis

🛡️ Explainable AI Malware Analysis Platform with PE Static Analysis, YARA Engine, SHAP Explainability & Real-Time Dashboard

See the full type-inference chain of any value in PHPStan, not just a single snapshot.

Defensive binary analysis and reverse-engineering toolkit for PE, ELF, and Mach-O executables with local web reporting.

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

REA (Reverse Engineer Anything) in Docker: one image per analysis engine (Ghidra / Hopper / IDA) with a full reverse-engineering toolchain,

Measure and stop structural erosion in AI-written TypeScript. Slop Check finds the mess, the Deslop tools clean it. Based on SlopCodeBench (

Deterministic semantic linter and PR reviewer for IEC 61131-3 Structured Text. 80 checks across diff-based, static integrity, FB-instance, P

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

A Gradle plugin for auditing Kotlin Multiplatform iOS export surfaces and measuring linked binary size. Finds Objective-C declarations for r

Recommend AI coding harness changes from repository context and coding signals, then distribute approved rules, skills, hooks and agents to

Static analysis for Redis Lua scripts — cluster-unsafe key access, unbounded loops, sandbox violations.

Static reverse engineering of untrusted files with verifiable, byte-anchored evidence. Open tools (Ghidra, JADX, LIEF, YARA-X, Babel) in loc

A live, graph-verified map of your codebase for AI coding agents — real call graphs, compiler-verified edges, and hard safety gates on the w

Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input tha

Offline WebAssembly component inspection and capability-policy toolkit - decode .wasm binaries, classify host capabilities, gate against exp

Heuristic Solidity/DeFi security review toolkit — flags suspicious patterns to review, backed by Foundry scenarios. Educational / authorized

Ontology-driven codebase indexer and query service. Parses C#, TypeScript/JS, Go, Python, and SQL into an embedded graph database. Exposes M