47,133 repositories indexed
1–24 of 26 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Bandit is a tool designed to find common security issues in Python code.
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
Roslynator is a set of code analysis tools for C#, powered by Roslyn.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
TranslatedA SQL full-lifecycle quality management platform that supports many different types of databases, covers pre-event control, post-event supervision, and standard release scenarios, and helps you establish quality standards
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
Code analyzer for C# and VB.NET projects
A Rake task gem that helps you find the unused routes and controller actions for your Rails 3+ app
Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
SonarQube extension for Visual Studio providing code quality and security feedback directly in the IDE
Turn any codebase into a knowledge graph grounded in formal methods. Your AI agents get exact answers for any code-related task, ensure correctness, and optimize time and token usage.
Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
Roslyn-based analysis for code using the Serilog logging library. Checks for common mistakes and usage problems.
An Elixir tool for checking safety of database migrations.
NsDepCop is a static code analysis tool that enforces namespace and assembly dependency rules in C# projects.
H(igh) A(ssurance) ROS - Static analysis of ROS1 application code.