47,133 repositories indexed
1–24 of 44 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Go security checker
Bandit is a tool designed to find common security issues in Python code.
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
Catch common Java mistakes as compile-time errors
Tfsec is now part of Trivy
Staticcheck - The advanced Go linter
Awesome autocompletion, static analysis and refactoring library for python
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
🔰 Instant PHP quality checks from your console
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects
Linting tool for CloudFormation templates
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.