Havuz

Static, no-execution security checks for Hermes Agent plugins

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Evidence-backed TS/JS repo structure lens for Claude Code

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

AI pull-request reviewer: hybrid RAG + a code graph + Claude Code/Codex. Whole-repo context, inline GitHub comments grounded on exact code.

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

AI Powered Reverse Engineering Tool

A live, graph-verified map of your codebase for AI coding agents — real call graphs, compiler-verified edges, and hard safety gates on the w

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

Nuitka Assembly analyzer (as well as PyInstaller and other packagers) and native exe-files for extracting metadata, strings, modules, and st

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

Logic-first AI code review via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Catches behavioral bugs, ty

Obsidian Graph View, but for source code — scan a JS/TS, HTML/CSS, Python, Ruby, Rust or Shopify Liquid project into a dependency graph and

Defensive binary analysis and reverse-engineering toolkit for PE, ELF, and Mach-O executables with local web reporting.

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Laravel compatibility preset and runner for Mago static analysis

Delphi-native, MIT-licensed RAG + linter for Delphi/Pascal source code. Symbol-exact + fuzzy + tree-sitter lint. Pure Delphi at runtime.

Additional linting rules for Rust projects

🔍 AI-powered automated code review tool that analyzes syntax, performance bottlenecks, and security flaws in pull requests.

Deterministic security analysis for agent skill files.

🎵 Grade your vibe-coded project. One command, instant letter grade across security, quality, dependencies, and testing.

See the full type-inference chain of any value in PHPStan, not just a single snapshot.

路由器品牌插件！[BroTech] Router enhancement script for Xiaomi, ASUS, HUAWEI & TP-Link. Built for network geeks! Rebuilds dashboards with high-preci

Fast iOS decompiler & Mach-O disassembler in Rust — arm64, Objective-C class-dump, Swift metadata, and a native desktop GUI. Reads .ipa/App

fallow for Neovim — see your unused code, dups, and health in a native split

Live code graph that fuses static analysis (tree-sitter) with OpenTelemetry runtime traces, queried over MCP so AI coding agents get real fu

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen

Ontology-driven codebase indexer and query service. Parses C#, TypeScript/JS, Go, Python, and SQL into an embedded graph database. Exposes M

Static ROS 2 architecture analysis, visualization, auditing, and CI policy enforcement for Python and C++ workspaces.

Evidence-grounded AI agent for Java code repair with LLM-guided patches and human-in-the-loop review.

Deterministic semantic linter and PR reviewer for IEC 61131-3 Structured Text. 80 checks across diff-based, static integrity, FB-instance, P

Most tools give AI access to the codebase. Archon gives AI access to the change itself. Structural Analysis tool intergrated for AI planning

🩺 Zero-intrusion runtime diagnostic and architectural analyzer for Spring Boot. Automatically detects cyclic dependencies, proxy overheads,

Static security & correctness linter for Payload CMS. Zero-config, deterministic, ts-morph-based. Catches access-control gaps, unsafe Local

Succeeded by SAUR: [https://github.com/PicasoTheDeal/SAUR](https://github.com/PicasoTheDeal/SAUR)

Deterministic code-graph (GraphRAG) over your repo for LLM agents — local-first, git-native, zero-infra, served via MCP. Python, TS/JS, Rust

Agent-ready CLI for static page inspection, search triage, and browser handoff.

Pi extension that brings Fallow codebase intelligence into Pi as an agent tool and slash command.

Local code-intelligence pipeline for AI coding agents: architecture maps, hotspots, change impact, and structural regression gates before th

Local-first repository context for coding agents: codegraph, cited project knowledge, change impact, and evidence-backed workflows.

Spring Boot + MyBatis 框架感知代码地图：静态分析调用链/SQL/事务/实体影响面，通过 MCP 喂给 AI 编程工具（Trae/Cursor/Claude Code），省 token、防幻觉

Normalize Tailwinds. A zero-config CLI and GitHub Action that finds bloated Tailwind utility classes and rewrites them into their short, can

Static secret scanner for source trees — regex rules, entropy scoring, and SARIF output for CI pipelines.

AI-powered vulnerability triage platform for Python projects. KIRTA combines SBOM, SCA, static code analysis, call maps, and AI explanations

Static file analyzer for malware triage — hashing, binary headers, entropy, signature rules, and IOC matching.