tirth8205 / code-review-graph

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

OWASP / mastg

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

bridgecrewio / checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

repowise-dev / repowise

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

crytic / slither

Static Analyzer for Solidity and Vyper

davidhalter / jedi

Awesome autocompletion, static analysis and refactoring library for python

pylint-dev / pylint

It's not just a linter that annoys you!

PyCQA / flake8

flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.

Ericsson / codechecker

CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.

CodeBoarding / CodeBoarding

Interactive architecture diagrams for codebases

google / mantis

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

MG1937 / ASC

ASC is a super FAST and lightweight Android decompiler designed for Agents/Mobile Researchers.

huhusmang / Awesome-LLMs-for-Vulnerability-Detection

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.

pschanely / CrossHair

An analysis tool for Python that blurs the line between testing and type systems.

ipyflow / ipyflow

A reactive Python kernel for Jupyter notebooks.

morluto / awesome-reverse-engineering

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

Cyber-Buddy / APKHunt

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

duriantaco / skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

MobSF / mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

LukasNiessen / ArchUnitPython

ArchUnitPython is an architecture testing library. Specify and ensure architecture rules in your Python app. Easy setup and pipeline integration.

Privado-Inc / privado

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

Aletheore / Aletheore

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

pep8speaks-org / pep8speaks

A GitHub :octocat: app to automatically review Python code style over Pull Requests

pylint-dev / astroid

A common base representation of python source code for pylint and other projects

Cranot / roam-code

Local codebase intelligence CLI + MCP server for AI coding agents: SQLite code graph, 28 languages, 287 commands, 246 MCP tools, change-safety gates, audit evidence, zero API keys.

pis10 / TraceSurface

发现藏在前端代码里的 API，验证未授权访问风险 · 动态浏览器追踪 × JavaScript 静态分析

XiantingWu / PQCensus

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

openqa-cn / codexqa

codexqa: 11 local-first Agent Skills for Cursor, Claude Code, Codex & OpenClaw — change impact analysis, AI code review, defect scan, testcase generation, browser replay & RCA.

Ablation-Tool / ablation

Ablation is an autonomous reverse engineering system.

1838904818 / audit-repo

A practical Codex skill for evidence-backed repository health audits

bgts-ai-org / bgts-context-engine

Deterministic code-graph context engine for AI coding agents - PostgreSQL + Apache AGE + pgvector, MCP & REST, no LLM in the loop.

Karansingh1999 / PIIFlow

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Yutong0711 / PARAPET

Turn a security or performance exposure into a reviewable decision

Zuimeng-0710 / java-audit-lab

Evidence-driven Java security review workbench

officefloor / ImpactGate

Code review via the change impact measure

Emmimal / context-compiler

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

AgriciDaniel / anti-slop

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests over model judgement, because LLM judges agree with human slop labels at chance.

LE0-Lin / AgentConfigScore

Tamper-resistant regression gate for AI coding-agent instructions—AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and more.

00200200 / repro-lens

Static reproducibility checks, experiment replay, and verification for ML pipelines.

YoavLax / agent-compass

Get your repo ready for AI.

lupingQAQ / JGD

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-model adversarial auditing → weaponized PoC. Solving the last mile.