Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents
Repository Index
73,362 visible repositories in the index
1–24 of 31 · Most stars
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
- ai
- code-intelligence
- dead-code
- developer-tools
TranslatedDeepAudit: An AI hacker team for everyone, putting vulnerability discovery within reach. Beginners can deploy and run it with one click, with autonomous collaborative auditing + automated sandbox PoC verification. Supports private deployment with Ollama and one-click report generation. Supports relay stations. Making security no longer expensive and auditing no longer complicated.
- ai
- bug-detection
- code-audit
- code-quality
Tfsec is now part of Trivy
- terraform
- security
- scanner
- static-analysis
Paste any GitHub URL → interactive architecture map. See how files connect, find what breaks if you change something. No install, no accounts — runs entirely in your browser.
- architecture
- browser-based
- code-analysis
- codebase-visualization
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
- cli
- code-quality
- dead-code
- developer-tools
An MCP server plus a CLI tool that indexes local code into a graph database to provide context to AI assistants.
- hacktoberfest2025
- social-winter-of-code
- codegraph
- codegraphcontext
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.
- static-analysis
- software-characterization
- application-inspector
- detection
Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
- code-analysis
- query-language
- code-browser
- fuzzy-parsing
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
- static-analysis
- software-verification
- abstract-interpretation
- program-analysis
Interactive architecture diagrams for codebases
A tool for refurbishing and modernizing Python codebases
- cli
- mypy
- python
- python310
weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.
KunLun-M — Open-source static code analysis for PHP, Nodejs/JavaScript, Python, Golang, Java and C/C++, with AST-based semantic scanning and one-click AI Agent integration (OpenClaw, Codex, Claude Code, Hermes, and more).
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
- business-logic
- code-analysis
- code-understanding
- codebase-analysis
The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
- maven-plugin
- maven
- java
- report
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
- dead
- phpstan
- phpstan-rules
- unused-code
eBPF verifier based on abstract interpretation
- abstract-interpretation
- static-analyzer
- ebpf
- ebpf-verifier
Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
Roslyn-based analysis for code using the Serilog logging library. Checks for common mistakes and usage problems.
- serilog
- roslyn
- analysis
- refactor
An Elixir tool for checking safety of database migrations.
- elixir
- static-analysis
- code-analysis
- credo
Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.
- dependency-analysis
- reverse-dependencies
- dependency-resolution
- file-dependencies