47,133 repositories indexed
1–24 of 28 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
Nginx configuration static analyzer
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
🔰 Instant PHP quality checks from your console
An extensible multilanguage static code analyzer.
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
Security-focused static analysis for the Phoenix Framework
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
NGINX configuration static analyzer
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
Scan Nix files for dead code
plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.