Repository Index

ShellCheck, a static analysis tool for shell scripts

• haskell
• shell
• static-analysis
• bash

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

• agent-security
• agent-skills
• agentic-ai
• ai-security

Go security checker

• golang
• security
• security-tools
• security-automation

Bandit is a tool designed to find common security issues in Python code.

• linter
• bandit
• security-tools
• security-scanner

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

[mirror] Go Tools

A static analysis security vulnerability scanner for Ruby on Rails applications

• ruby
• rails
• security
• static-analysis

Static code analysis for Kotlin

• static
• analysis
• kotlin
• codesmells

Staticcheck - The advanced Go linter

• linters
• static-analysis
• linter
• staticcheck

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

• php
• static-analysis
• phan
• analysis

An extensible multilanguage static code analyzer.

• code-analysis
• code-quality
• static-analysis
• static-code-analysis

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

Detect copy-pasted and structurally similar code

• code-analysis
• duplication
• refactoring
• clean-code

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter

Roslynator is a set of code analysis tools for C#, powered by Roslyn.

• csharp
• roslyn
• visual-studio
• dotnet

A Golang tool that does static analysis, unit testing, code review and generate code quality report.

• codereview
• reporter
• golang
• golang-tools

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

• iac
• infrastructure-as-code
• security
• appsec

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

• findbugs
• java
• security-audit
• owasp

TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.

• adb
• android
• cli
• kotlin

grep rough audit - source code auditing tool

• security
• shell
• vulnerability-detection
• source-code

The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.

• ruby-on-rails
• activerecord
• tool
• database

Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.

• business-logic
• code-analysis
• code-understanding
• codebase-analysis