MCP servers and skills: search, filter by where they run, and compare.
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/r
PythonApache-2.0★ 847No key
Scan MCP servers for potential threats & security findings.
PythonApache-2.0★ 1.1kNo key
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
Node.jsMIT★ 860No key
Real-time architectural sensor that helps AI agents close the feedback loop, enabling recursive self-improvement of code quality. Pure Rust.
SkillMIT★ 3.3kNo key
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
SkillApache-2.0★ 584No key
Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.
SkillMIT★ 239No key
Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input that can reach privileged actions. Runs locally, no network, no
PythonApache-2.0★ 17No key
Architectural X-Ray for React Native, AST-driven static analysis for layout gaps, performance anti-patterns and component structure.
Node.jsMIT★ 4Few starsNo key
Evidence-backed AppSec for AI applications and agents. Powered by HAIEC.
Node.jsMIT★ 4Few starsNo key
Static security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, calibrated to a 1% false-positive rate over 196 public MCP servers. In the official MCP Regis
DockerMIT★ 5No key
Visualize React state flow through static analysis
Node.jsMIT★ 2Few starsNo key
PythonMIT★ 2Few starsNo key
Catch the LLM/AI calls you didn't need. A fast, deterministic linter that flags LLM API calls where plain code is simpler, cheaper, and more reliable. Your GPT call is a regex.
PythonMIT★ 3Few starsNo key
Extract every string in a codebase, with its position, so a person can read them
Node.jsMIT★ 1Few starsNo key
Deterministic code map for AI coding agents: a tree-sitter symbol and call graph served over MCP and a CLI, with no embeddings, network or telemetry.
Node.jsApache-2.0★ 1Few starsNo key
Extract every URL in a codebase, with its protocol and exact position
Node.jsMIT★ 1Few starsNo key
Extract every file path in a codebase, and say whether it still points at anything
Node.jsMIT★ 1Few starsNo key
Extract every date and timestamp, and the exact instant each one resolves to
Node.jsMIT★ 1Few starsNo key
Replay-verified minimal JSON reproductions and deterministic TypeScript/OpenAPI drift checks. Local-first CLI and MCP server.
Node.jsMPL-2.0★ 1Few starsNo key
Node.jsMITFew starsNeeds a key
Static analysis tools for Frappe Framework and ERPNext projects via local stdio MCP.
Node.jsNo licenseFew starsNo key
The static analyzer your AI agent reads — 59 rules, MCP server, CLI, VS Code extension, GitHub Action, one byte-identical JSON report
Node.jsMIT★ 2Few starsNo key
Find tool calls that could fire the same effect twice. Reports evidence, renders no verdict. npx fencescan — zero dependencies.
Node.jsMITFew starsNo key
DVERA agent skills for CT C/C++ verification workflows: project setup, analysis, test generation, coverage, reporting, and regression.
SkillMITFew starsNo key
Who stands behind it
