S

static-analysis

Structural IR for AI reasoning over code: compact tree-sitter facts for an LLM instead of raw JavaScript files.

GitLab CI/CD component that runs Ruff, a Python linter and formatter, against your codebase.

Clang-based checker for shared-library C++ interfaces: hashing guards API stability, validation of pure virtual interfaces and standard-layout value types guards the ABI.

Reactive architectural governance for Rust: a constitution declared in Rust is weighed against the workspace, and drift fails CI.

Catch AI slop before it ships. Static analysis for AI-generated code, Rust CLI.

Qualor CI/CD component: code quality and security scanning with a quality gate, uploaded to your self-hosted Qualor server. Source: github.com/qualor-dev/qualor

REA (Reverse Engineer Anything) in Docker: Android APK decompilation with JADX, Apktool and adb built in, Ghidra on demand, behind a token-guarded Streamable HTTP MCP endpoint. Also stdio MCP and a CLI.

Static analysis, critical-path simulation and needs inference for GitLab CI/CD pipelines. Finds out why your pipeline is slow, risky or fragile, before you push.

Static security scanner for MCP (Model Context Protocol) servers. Stdlib-only, MIT. Flags risky tool permissions, prompt-injection surfaces and secret exposure.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Static analyzer that turns a Python package's source into a queryable code graph (API surface, dependencies/architecture, impact, change-review, RAG).

A tool for find code duplicated functions in codebases

RefactorIQ (Beta) — measure, prioritize, and communicate technical debt. Native desktop app for Windows and Linux.

Fast, pure-Crystal reStructuredText (RST) linter with automated in-memory fix capabilities

Auditoria de hardening de imagens Docker: orquestra hadolint, trivy e dockle, normaliza a saida numa politica unica de 14 propriedades e preenche as lacunas medidas

Hunt down Go interface implementations like a bloodhound with trust issues. Tired of grep-ing through thousands of lines trying to figure out which structs actually implement that damn interface? This tool does the heavy lifting so you don't have to suffer through another existential crisis at 3am.

PE/ELF x86/x64 CFG extractor

TurboLint CLI: fast Rust JavaScript/TypeScript linting with Oxc, streaming traversal, npm install, and paid config review.

Coordinated Agent Swarm Testing — open-source framework that deploys 100 Claude AI agents in five specialized squads (Security, Logic, Robustness, Performance, Data Integrity) to systematically analyze codebases for bugs, security issues, and code quality problems. A research-backed substitute for human beta testing. Empirical results from the published paper: 100 agents analyzed a 12,500-line React/TypeScript application in 63 minutes, identified 687 unique findings, at a total cost of $7.97 — compared to $2,000-$20,000 for equivalent human beta testing. Available via npm (cast-swarm) and as an MCP server. Apache 2.0 licensed. Published preprint available.

Verification engine for AI-assisted software changes