56,638 visible repositories in the index
1–24 of 34 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
Remove unused CSS. Also works with single-page apps.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
An extensible multilanguage static code analyzer.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
Pretty good call graphs for dynamic languages
Agent harness to make your slop code well-engineered and beautiful.
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Manage translation and localization with static analysis, for Ruby i18n
Static analyzer and linter for Clojure code that sparks joy
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
Protect against malicious open source packages 🤖
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).
TypeScript Language Service Plugin for GraphQL developers
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
Chronos - A static race detector for the go language