55,140 visible repositories in the index
1–24 of 84 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
A static analyzer for Java, C, C++, and Objective-C
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
Continuous Inspection
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.
TranslatedDeepAudit: An AI hacker team for everyone, putting vulnerability discovery within reach. Beginners can deploy and run it with one click, with autonomous collaborative auditing + automated sandbox PoC verification. Supports private deployment with Ollama and one-click report generation. Supports relay stations. Making security no longer expensive and auditing no longer complicated.
Tfsec is now part of Trivy
Static analysis for GitHub Actions (and more)
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
Awesome autocompletion, static analysis and refactoring library for python
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
An advanced, unified platform for code quality, architectural metrics, and Agile analytics. Features Python AST parsing, Java static analysis (code smells), and interactive project health dashboards built with Streamlit.
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
Detect copy-pasted and structurally similar code
A Ruby code quality reporter
Static analyzer for C/C++ based on the theory of Abstract Interpretation.