Havuz

a cli based static python code reviewer

Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input tha

Relational codebase compiler and spec-driven containment engine for AI coding agents. Compiles polyglot repos (Rust, Python, TS, Go, C/C++,

Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.

Gradual effect, contract, async-safety, and temporal checking for existing TypeScript.

"Review Ducktective" is an automated code review platform based on an LLM: it takes a diff as input and outputs structured findings with sev

A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Hermes Agent-focused architecture and runtime health checks

Prevent cross-repo architectural breakage before merge. Architecture knowledge graph from static analysis, blast radius in CI, MCP server fo

Dead code detector for Dart and Flutter. Finds declarations that are never referenced — classes, functions, methods, fields, constants, enum

🔥 AI agent that ports CUDA code to AMD ROCm using local LLMs — FastAPI + React + Ollama | Live: rocmporter-agent.vercel.app

Turn your Ruby codebase into a galaxy

Briev: a contract-enforced programming language and compiler. Verified state transitions, LLVM backend, reactive execution, multi-target cod

Portable, always-fresh docs for agents and humans. A Surface hub is a conformant OKF concept; Surface adds the freshness OKF leaves out - it

Instantly understand any codebase. One command, zero API keys, works fully offline. Auto-detects 20+ project types, maps architecture, and e

Generate OpenAPI 3.1 specs from Go source code via static analysis — zero annotations, automatic framework detection

Static analysis engine for Python web-applications

Tool to report source code metrics

Your SvelteKit app's code health, checked before it ships. Statically, no browser — SEO, Performance, Correctness, Security, Architecture, A

Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. Cy

Agentic code review with structural graph intelligence — PR gate + branch stewardship. Self-hosted. Apache-2.0.

Structural code intelligence for DeepSeek Harness (dsh) — gives the agent codegraph and codegraph_index tools to find where a symbol is decl

Continuously refine your project’s engineering philosophy — and keep AI coding agents honest with evidence-backed completion.

PHPStan extension for Yii2

🛡️ Explainable AI Malware Analysis Platform with PE Static Analysis, YARA Engine, SHAP Explainability & Real-Time Dashboard

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

MCP server for deep semantic analysis of Scala via SemanticDB — exact find-usages, class hierarchies, implicit resolution & call paths for A

A terminal UI for Yocto/OpenEmbedded static analysis, style checks, layer validation, patch auditing and license compliance.

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

The Polyspace Agentic Toolkit brings trusted Polyspace capabilities to AI agents.

NEXUS REDFOX — Local-first code intelligence and security analysis platform for developers and security researchers.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Universal zero-dependency linter and formatter. One pure-Rust binary (poly) that lints and formats ~30 languages in-process — ruff, oxc, bio

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Deterministic tree-sitter + SQLite/FTS5 code knowledge graph for coding agents and developers: symbols, calls and dependencies over a CLI, a

Local AI security reviews with evidence, severity, and a review UI.

企业自托管 AI Code Review Agent ，一键自动分析 GitLab MR 与 Push，并回填总评和行内 Discussion。

Static, no-execution security checks for Hermes Agent plugins

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Evidence-backed TS/JS repo structure lens for Claude Code

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proof

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

The testing standard for MCP servers. Lint (14 rules), test, and fuzz over real stdio/SSE/HTTP transport. 18 assertion types in YAML. Found

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

AI pull-request reviewer: hybrid RAG + a code graph + Claude Code/Codex. Whole-repo context, inline GitHub comments grounded on exact code.

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

AI Powered Reverse Engineering Tool

A live, graph-verified map of your codebase for AI coding agents — real call graphs, compiler-verified edges, and hard safety gates on the w