scanaislop / aislop

Catch and fix the code-quality issues AI coding agents leave behind - dead code, unsafe casts, swallowed errors, duplication, security risks, and more. 50+ deterministic rules across 10 language targets, with CLI, CI, and GitHub Actions. No LLM at runtime. MIT.

phpstan / phpstan-doctrine

Doctrine extensions for PHPStan

LukasNiessen / ArchUnitPython

ArchUnitPython is an architecture testing library. Specify and ensure architecture rules in your Python app. Easy setup and pipeline integration.

SonarSource / sonarqube-mcp-server

Official SonarQube MCP Server for code quality and security in AI agents

gitleaks / gitleaks-action

Protect your secrets using Gitleaks-Action

Privado-Inc / privado

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

SonarSource / sonarlint-intellij

SonarQube plugin for JetBrains IDEs providing code quality and security feedback directly in the IDE

Aletheore / Aletheore

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

SonarSource / sonarlint-vscode

SonarQube extension for Visual Studio Code providing code quality and security feedback directly in the editor

pep8speaks-org / pep8speaks

A GitHub :octocat: app to automatically review Python code style over Pull Requests

Ericsson / CodeCompass

CodeCompass is a software comprehension tool for large scale software written in C/C++, C# and Python.

Roave / BackwardCompatibilityCheck

:ab: Tool to compare two revisions of a class API to check for BC breaks

paladini / harness-score

Your AI coding agent is only as reliable as the harness around it. Measure that harness in seconds with harness-score.

povils / phpmnd

PHP Magic Number Detector

pylint-dev / astroid

A common base representation of python source code for pylint and other projects

crystal-ameba / ameba

A static code analysis tool for Crystal

microsoft / component-detection

Scans your project to determine what components you use

TheOrcDev / shadscan

Deterministic UI audits for shadcn apps, built for your terminal, your CI, and your AI agent.

refactorfirst / RefactorFirst

Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.

phpstan / phpstan-phpunit

PHPUnit extensions and rules for PHPStan

shipmonk-rnd / dead-code-detector

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

slackhq / compose-lints

Lint checks to aid with a healthy adoption of Compose

Cranot / roam-code

Local codebase intelligence CLI + MCP server for AI coding agents: SQLite code graph, 28 languages, 287 commands, 246 MCP tools, change-safety gates, audit evidence, zero API keys.

LukasNiessen / ArchUnitTS

ArchUnitTS is an architecture testing library. Specify and ensure architecture rules in your TypeScript app. Easy setup and pipeline integration.

SonarSource / sonarlint-visualstudio

SonarQube extension for Visual Studio providing code quality and security feedback directly in the IDE

houqp / sqlvet

Go fearless SQL. Sqlvet performs static analysis on raw SQL queries in your Go code base.

pis10 / TraceSurface

发现藏在前端代码里的 API，验证未授权访问风险 · 动态浏览器追踪 × JavaScript 静态分析

ejfkdev / ddc

Android DEX → Java decompiler in Rust, built for speed — full apps in seconds, queries in milliseconds. Progressive analysis, javac-verified output, every DEX version, multi-dex & XAPK/APKS/APKM containers.

lakeday-org / perch

Semantic code linting with Decision Models

XiantingWu / PQCensus

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

Thworry / reposcope

README-first, evidence-backed analysis for understanding public GitHub repositories before adoption.

openqa-cn / codexqa

codexqa: 11 local-first Agent Skills for Cursor, Claude Code, Codex & OpenClaw — change impact analysis, AI code review, defect scan, testcase generation, browser replay & RCA.

Ablation-Tool / ablation

Ablation is an autonomous reverse engineering system.

azrtydxb / procoder

Senior-developer discipline for AI coding agents. A commit gate that counts unchecked as failing, quality controllers that refuse to call unfinished work done, and a lessons loop that closes each escaped bug's class. One Go binary, no runtime deps, works with 20+ agents.

scarletkc / seiso

A Markdown convention and linter for project docs written by AI and read by humans and agents

oooscoos / Benzi

Most coding agents grep and glob raw source into LLM's context window and hope the model is smart. Benzi compiles your codebase into a queryable map of calls, data flow, control flow and class hierarchy first; then it reads, explains, runs, edits and verifies your code using it. Includes a runtime tracer. 82.4% SWE-bench Verified for < $13.

Heyosseus / sloppy

Static analysis for the debt AI agents leave in PHP: 26 rules, Claude Code hooks, git-diff review, a Rector and Pint fix pass, Pest expectations, CI annotations and an MCP server. Deterministic, local, no LLM.

1838904818 / audit-repo

A practical Codex skill for evidence-backed repository health audits

bgts-ai-org / bgts-context-engine

Deterministic code-graph context engine for AI coding agents - PostgreSQL + Apache AGE + pgvector, MCP & REST, no LLM in the loop.

stijnswapped / Myrqen

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Juror-AI / juror

Cheaper and better Greptile alternative runs on your own github actions.

yan-mc / dsh-normify

Normify · DSH 插件：把项目架构写成归一化的分形模块树，三层校验（写时 / 校验 / 冻结回执）、30 个 normify_* 工具 + normify-gen 技能，一键渲染单文件交互式架构图；支持伴随式开发（change_open → brief → check → 实施 → refresh → change_close）。

Karansingh1999 / PIIFlow

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Yutong0711 / PARAPET

Turn a security or performance exposure into a reviewable decision

ooocooc / open-skill-sunset

Local, read-only audit for stale AGENTS.md, CLAUDE.md, and generic SKILL.md instructions.

tool-bunker / code-buster

Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security and style heuristics, quality scores, and remediation plans.

Zuimeng-0710 / java-audit-lab

Evidence-driven Java security review workbench

officefloor / ImpactGate

Code review via the change impact measure

typesafe-docs / iterleak

Go analyzer that reports iter.Pull and iter.Pull2 calls whose stop function can go uncalled and leak a goroutine.

Berserk-hub150 / skillhawk

Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.

Emmimal / context-compiler

A pure-Python reachability and skeletonization layer that decides what a coding agent actually sees before a request reaches the API.

AgriciDaniel / anti-slop

Find and repair substance defects in AI-assisted prose, code, docs, and agent output. Reports defects, never authorship. Structural tests over model judgement, because LLM judges agree with human slop labels at chance.

diyanbogdanov / emend

Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compiles and passes your tests.

theblixguy / swift-bylaws

Architectural linting for Swift developers and coding agents

ctxrs / graf

graf is graphify, rebuilt properly in rust: 1000x faster search, 89x faster updates, and one native binary.

vuglll / EFDoctor

Local-first static analysis for EF Core: finds performance and correctness problems (SaveChanges in loops, unbounded queries, cartesian Includes, sync-over-async, unsafe raw SQL) with evidence and remediation.

LE0-Lin / AgentConfigScore

Tamper-resistant regression gate for AI coding-agent instructions—AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and more.

zygiu-zygis / basecoat-ui-mcp

Offline MCP server for Basecoat UI (shadcn/ui look, no React): templates, macro layouts, theming/dark-mode contract, static validation.

00200200 / repro-lens

Static reproducibility checks, experiment replay, and verification for ML pipelines.

Romandredan / 1c-quality-gate

Контроль качества 1С-разработки для Claude Code: стандарты, принципы ООП и паттерны, XML метаданных, блокирующие гейты и проверяемый след прогона · Claude Code plugin for 1C:Enterprise (BSL) code quality: development standards, SOLID and design patterns, metadata XML, blocking session gates and a machine-readable evidence trail.