S

static-analysis

Clang-based checker for shared-library C++ interfaces: hashing guards API stability, validation of pure virtual interfaces and standard-layout value types guards the ABI.

Catch AI slop before it ships. Static analysis for AI-generated code, Rust CLI.

A tool for find code duplicated functions in codebases

Static security scanner for MCP (Model Context Protocol) servers. Stdlib-only, MIT. Flags risky tool permissions, prompt-injection surfaces and secret exposure.

Qualor CI/CD component: code quality and security scanning with a quality gate, uploaded to your self-hosted Qualor server. Source: github.com/qualor-dev/qualor

Static analyzer that turns a Python package's source into a queryable code graph (API surface, dependencies/architecture, impact, change-review, RAG).

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

RefactorIQ (Beta) — measure, prioritize, and communicate technical debt. Native desktop app for Windows and Linux.

Auditoria de hardening de imagens Docker: orquestra hadolint, trivy e dockle, normaliza a saida numa politica unica de 14 propriedades e preenche as lacunas medidas

Fast, pure-Crystal reStructuredText (RST) linter with automated in-memory fix capabilities

Hunt down Go interface implementations like a bloodhound with trust issues. Tired of grep-ing through thousands of lines trying to figure out which structs actually implement that damn interface? This tool does the heavy lifting so you don't have to suffer through another existential crisis at 3am.

PE/ELF x86/x64 CFG extractor

GitLab CI/CD component that runs Ruff, a Python linter and formatter, against your codebase.

TurboLint CLI: fast Rust JavaScript/TypeScript linting with Oxc, streaming traversal, npm install, and paid config review.

Coordinated Agent Swarm Testing — open-source framework that deploys 100 Claude AI agents in five specialized squads (Security, Logic, Robustness, Performance, Data Integrity) to systematically analyze codebases for bugs, security issues, and code quality problems. A research-backed substitute for human beta testing. Empirical results from the published paper: 100 agents analyzed a 12,500-line React/TypeScript application in 63 minutes, identified 687 unique findings, at a total cost of $7.97 — compared to $2,000-$20,000 for equivalent human beta testing. Available via npm (cast-swarm) and as an MCP server. Apache 2.0 licensed. Published preprint available.

Verification engine for AI-assisted software changes

Structural and behavioral signals for large, AI-assisted code changes.

Complete GitLab CI pipeline including linting, type checking, testing, build, and security scanning stages.

Hadolint is a Dockerfile linter that helps developers write secure, efficient, and maintainable Dockerfiles. It detects syntax errors, enforces best practices, and integrates with ShellCheck to validate shell scripts in RUN instructions. Ideal for CI/CD pipelines and DevSecOps workflows.

Static analysis of C/C++ code.