MCP servers and skills: search, filter by where they run, and compare.
Offline MCP server for Basecoat UI (shadcn/ui look, no React): templates, macro layouts, theming/dark-mode contract, static validation.
Node.jsMIT★ 46No key
MIT-licensed code knowledge graph: index any source repo into a queryable graph of symbols, call chains and blast radius — with wiki generation. Code is a graph; treat it like one.
SkillMIT★ 15No key
Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.
GoApache-2.0★ 23No key
Release gate for public GitHub repositories. Give it a repo URL and it returns a ship-or-block verdict with file-and-line evidence, the fixes that clear the gate, and the deployment plan and launch co
SkillMIT★ 4Few starsNo key
Find which APIs of your pinned Python dependencies changed after your coding model's training cutoff, and give the agent short AGENTS.md / CLAUDE.md notes from a static API diff. No model calls, no AP
PythonMIT★ 10No key
An MCP server that cuts coding-agent token usage by retrieving only the relevant JS/TS code using the TypeScript compiler and Jev.
Node.jsMIT★ 3Few starsNo key
Know what changed inside your app: inspect Electron apps and binaries, trace findings to file and line, compare releases. Locally, without executing the target. CLI, MCP server, web UI.
Node.jsMIT★ 5No key
功能点 → 代码：把一个项目变成单文件、离线、可交互的 HTML 地图，点开功能点即可看到横跨前端/后端/数据库的全部代码并跳转编辑器。An agent skill that maps every feature of a project to its cross-stack code.
SkillMIT★ 7No key
Local, offline MCP server for jevify: find the AI calls that are really decisions, then plan their migration to JEV in shadow mode.
Node.jsApache-2.0★ 2Few starsNo key
Scan Agent Skills before your coding agent installs them. Offline static analysis for prompt injection, hidden text, exfiltration and remote code, with install gates for Claude Code, Codex, OpenCode,
SkillMIT★ 3Few starsNo key
Deepsleuth — read the fine print. Deterministic deep-visibility security scanner for MCP servers (no LLM).
PythonApache-2.0★ 1Few starsNo key
Build-time permission checker for TypeScript and AI agents: fails the PR when code adds a new server, file, secret, database table, risky MCP tool, or CI permission.
Node.jsApache-2.0★ 1Few starsNo key
An inventory of the cryptography a JavaScript or TypeScript codebase uses, and which of it a large quantum computer would break. An inventory and pointers, not a compliance certificate.
Node.jsApache-2.0★ 1Few starsNo key
Node.jsMITFew starsNeeds a key
Local-first repository security and configuration audits: CLI, GitHub Action and MCP server
Node.jsMITFew starsNo key
Deterministic, local-first change-impact analysis for Python, JavaScript, and TypeScript—trace blast radius, suggest tests, and gate risky PRs.
PythonMITFew starsNo key
Local-first deprecation intelligence for software repositories.
Node.jsApache-2.0Few starsNo key
Spec-led Rust port of REA — reverse-engineering tool provider for agents (MCP/A2A), with evidence-carrying findings and a fail-closed policy gate.
SkillApache-2.0Few starsNo key
A .NET architecture checker that enforces one C# spec and renders the same rules for coding agents.
SkillMITFew starsNo key
SkillMITFew starsNo key
SQL query, migration and plan analysis for AI agents (MCP server)
Node.jsMITFew starsNo key
Local Git change impact and test discovery over MCP
PythonMITFew starsNo key
Verifiable AI agent for engine test data: every number in the report traces back to a reproducible computation.
PythonMITFew starsNo key
Who stands behind it
