ShellCheck, a static analysis tool for shell scripts
- haskell
- shell
- static-analysis
- bash
Repository Index
47,133 repositories indexed
1–24 of 28 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
- agent-security
- agent-skills
- agentic-ai
- ai-security
Go security checker
- golang
- security
- security-tools
- security-automation
Bandit is a tool designed to find common security issues in Python code.
- linter
- bandit
- security-tools
- security-scanner
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
- ai
- code-intelligence
- dead-code
- developer-tools
[mirror] Go Tools
A static analysis security vulnerability scanner for Ruby on Rails applications
Staticcheck - The advanced Go linter
- linters
- static-analysis
- linter
- staticcheck
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
- cli
- code-quality
- dead-code
- developer-tools
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
- code-analyzer
- code-style
- coding-standards
- formatter
Roslynator is a set of code analysis tools for C#, powered by Roslyn.
- csharp
- roslyn
- visual-studio
- dotnet
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
- codereview
- reporter
- golang
- golang-tools
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
grep rough audit - source code auditing tool
- security
- shell
- vulnerability-detection
- source-code
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
- business-logic
- code-analysis
- code-understanding
- codebase-analysis
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
- code-quality
- ci-tools
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
- bugbounty
- security
- security-tools
- mobile-security
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
- sast
- security-tools
- security-scanner
- security-automation
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
- maven-plugin
- maven
- java
- report
The Exakat Engine : smart static analysis for PHP
- php
- php7
- gremlin
- neo4j