47,133 repositories indexed
1–24 of 35 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Your agent writes bad React. This catches it
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
An extensible multilanguage static code analyzer.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
Pretty good call graphs for dynamic languages
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Manage translation and localization with static analysis, for Ruby i18n
Static analyzer and linter for Clojure code that sparks joy
Linting tool for CloudFormation templates
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
Turn any codebase into a knowledge graph grounded in formal methods. Your AI agents get exact answers for any code-related task, ensure correctness, and optimize time and token usage.
Chronos - A static race detector for the go language