Repository Index

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

• ai-security
• application-security
• cli
• code-scanning

Continuous Inspection

• sonarqube
• code-quality
• static-analysis

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

• semmle-ql
• codeql
• github-advanced-security
• github-security-lab

Catch common Java mistakes as compile-time errors

• java
• static-analysis

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis

Staticcheck - The advanced Go linter

• linters
• static-analysis
• linter
• staticcheck

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

• static-analysis
• php
• type-inference
• security-analysis

Snyk CLI scans and monitors your projects for security vulnerabilities.

• security
• monitor
• snyk
• vulnerabilities

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

• php
• static-analysis
• phan
• analysis

Paste any GitHub URL → interactive architecture map. See how files connect, find what breaks if you change something. No install, no accounts — runs entirely in your browser.

• architecture
• browser-based
• code-analysis
• codebase-visualization

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

An advanced, unified platform for code quality, architectural metrics, and Agile analytics. Features Python AST parsing, Java static analysis (code smells), and interactive project health dashboards built with Streamlit.

• agile
• code-analysis
• dashboard
• data-visualization

EMBA - The firmware security analyzer

• firmware
• linux
• embedded-linux
• security-tools

Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc

• code-analysis
• query-language
• code-browser
• fuzzy-parsing

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter

TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.

• adb
• android
• cli
• kotlin

Real-time architectural sensor that helps AI agents close the feedback loop, enabling recursive self-improvement of code quality. Pure Rust.

• architecture
• code-quality
• developer-tools
• mcp

💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability

• quality
• code-quality
• static-analysis
• formatter

Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.

• cli
• devtools
• homograph-attack
• rust

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

• iac
• infrastructure-as-code
• security
• appsec

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

• license
• copyright
• packages
• dependencies

A command line tool to mine and analyze data from version-control systems

• behavioral-code-analysis
• code-analysis-tool
• repository-mining
• technical-debt

Beautiful and understandable static analysis tool for PHP

• static-analyzer
• quality
• php
• metrics