Havuz

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Language-agnostic code navigation CLI powered by tree-sitter

Repo dependency analyzer with **blast-radius impact scoring** for AI-assisted development.

Kotlin formatter and linter in Rust, drop-in ktfmt and ktlint (2.0 and 1.8) replacements with identical output.

Automated quality checks that nudge AI coding agents toward better habits

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Local-first static analysis for EF Core: finds performance and correctness problems (SaveChanges in loops, unbounded queries, cartesian Incl

Free open-source toolkit to understand, audit and rescue vibe-coded or legacy codebases: source-linked maps, team handoff, human-approved fi

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

Cheaper and better Greptile alternative runs on your own github actions.

Local-only Go static analysis engine with a built-in MCP server. Gives AI coding agents deterministic structural awareness: call graphs, imp

Review code changes by what they do, and learn the concepts behind them.

Turn a security or performance exposure into a reviewable decision

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

Static reverse engineering of untrusted files with verifiable, byte-anchored evidence. Open tools (Ghidra, JADX, LIEF, YARA-X, Babel) in loc

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security a

graf is graphify, rebuilt properly in rust: 1000x faster search, 89x faster updates, and one native binary.

Static decompiler, deobfuscator, and unpacker for reverse engineering and malware analysis: Python decompiler (3.8-3.15), PyInstaller extrac

Code review via the change impact measure

Hybrid: a Go superset with compiler-enforced ownership & sendability. Add a .hy file, get plain readable Go. If you know Go, you already kno

确定性取证 × 大模型定性 × Agent 反证复核的恶意代码审计智能体 · Deterministic forensics × LLM verdict × agent falsification for malicious-code audits

Keep Go packages flat without losing their internal boundaries: file-level private and package scopes for declarations, methods and struct f

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

Program dependence graph and architecture/code-flow analysis for BEAM projects

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support.

Framework-aware code intelligence MCP server — 91 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, c

Recommend AI coding harness changes from repository context and coding signals, then distribute approved rules, skills, hooks and agents to

Static reproducibility checks, experiment replay, and verification for ML pipelines.

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

A codebase scanner that helps you not run malicous code

ER diagrams, N+1 detection, schema drift & migration-risk linting for Django and SQLAlchemy (Alembic) — VS Code, CLI and MCP server. Static

REA (Reverse Engineer Anything) in Docker: one image per analysis engine (Ghidra / Hopper / IDA) with a full reverse-engineering toolchain,

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

MCP server that orchestrates language servers into agent-native workflows. 65 tools, 30 CI-verified languages.

AI-powered desktop app for migrating Python projects to Rust. Supports multiple LLM providers (OpenAI, Anthropic, Ollama), includes 300+ lib

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

Architectural linting for Swift developers and coding agents

Deterministic Git & AST change intelligence engine and Model Context Protocol (MCP) server. Detects breaking changes, maps caller blast radi

ArchUnitRuby is an architecture testing library. Specify and ensure architecture rules in your Ruby app. Easy setup and pipeline integration

Finds the code your AI wrote twice. Fast, offline duplicate-code detector: scan, history chart, CI gate. No AI required.

Tamper-resistant regression gate for AI coding-agent instructions—AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and more.

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests ov

Experimental macOS Apple Silicon first recompiler of PS4 programs

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers i

Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compile

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

Zero-G Reverse Engineering Anything & Verified Safe Rust Reconstruction for Gemini 4 Argon + Google Antigravity 2.0 (4-Mount Recon Kits, Who

Help your agents find the smoking gun they're looking for. Optimization evidence for agents: find complexity hotspots.