#static-analysis

Your AI coding agent is only as reliable as the harness around it. Measure that harness in seconds with harness-score.

Stop your coding agent reading the wrong files. Compiler-grade TS/JS repo map — 100% precision on blast radius vs grep's 60%, measured on public repos. CLI + MCP server, fully local, no vector DB.

Production-ready Claude Code skills for cybersecurity — secret scanning, SAST, prompt-injection testing, HTTP/JWT/dependency auditing. Zero dependencies.

Engineering OS — a suite of Model Context Protocol (MCP) servers that bring engineering discipline to AI coding assistants: dependency & version governance, hallucination detection, security/architecture/QA/performance review, multi-agent code review, self-healing, and compliance.

chennai (chen N ai) is a hybrid AI agent and a terminal user interface for static analysis, data-flow tracing, and AI-assisted code and security analysis.

Scan any codebase for O(n²) hotspots, N+1 queries, and complexity issues — works with 13+ AI coding agents

Zero-trust repo intake for AI coding agents — scan the instruction environment before Claude Code, Cursor, Codex, or Gemini touches a repo. Ships its own false-negative ledger.

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

OmniRank — the SEO/AEO/GEO auditor that runs inside your repo. Audits any site across search, answer and generative-engine gates, resolves each finding to the source file that owns it, and shows the diff that fixes it. Generates llms.txt + facts.json. Claude Code plugin + CLI.

Readiness checker for GitHub Copilot & Claude Code repos: 8 pillars, 100+ rules, zero model calls. Point it at a repo, get a reproducible grade and line-numbered fixes for SKILL.md, CLAUDE.md, AGENTS.md and more.

A statically typed language and compiler for AI agents. Write once, verify statically, compile to a portable Agent IR.

Reverse-engineer any Python codebase into an interactive architecture knowledge graph with AI-powered layer detection, community discovery, and living documentation

Source code security scanner for human-written and AI-generated projects. Rust CLI with explicit coverage, JSON/SARIF, and coding-agent integrations. Built by Tom Koentjes. Pre-alpha.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

Regression-testing CI gate for self-edited Claude Agent Skills (SKILL.md, MEMORY.md) -- golden-transcript record/replay, zero hosted infra.

Local‑only Query Risk & Scope Analyzer for AI coding prompts — estimate risk, scope, likely files, and token pressure before sending queries to agents like Cursor, Copilot, or Claude.

Static analysis for AI agents in GitHub Actions — finds where attacker-controlled text reaches an agent's prompt, and what that agent is allowed to do with it.

🏆 Zama Bounty S2 winner. AI coding-agent skill for Zama fhEVM — Claude Code, Cursor, Windsurf. 20 anti-patterns + 12-rule linter; cut agent fhEVM mistakes 15→0 in A/B tests. MIT. · 🏆 Zama 赏金赛道 S2 获奖。Zama fhEVM 的 AI agent skill — Claude Code、Cursor、Windsurf，20 条 anti-pattern + 12 规则 linter，A/B 实测错误 15→0。MIT。

Static Mutation Exposure Analysis

LLM-based vulnerability hunting agent that verifies findings in a Docker sandbox

Skill de Claude Code que audita si tus pruebas sabrían ponerse rojas. Instalable como plugin desde el marketplace. La misma herramienta que el repositorio hermano, empaquetada para que la use tu asistente.

Ship gate for AI-written code in Claude Code. Four rungs — SAFE, TRUE, OBVIOUS, ALONE — enforced on every response: security at trust boundaries, handled errors, readable code, and nothing stale left behind.

A least-privilege linter for Claude Code agent policies: proves whether an agent can reach credential egress with no gate crossed, or hands back the exact witness. Zero-dependency, deterministic, offline.

Static audit toolkit for Python projects after AI-assisted refactors: finds dead modules, duplicate implementations, contract drift, and hard-coded behavior; forces semantic triage before any deletion.

Your documentation makes claims. This checks whether they are still true, against git and the filesystem. Dead commit references, false merge claims, broken links, tags that never shipped, files that contradict each other. Works on the README you already have.

离线、证据驱动、可审计的 AI Agent Skill 安全审查器：16+ 类风险、简报模式、已审记录、Inspection Ledger、Docker 与云端 CI 扫描

Claude Code slash commands that flag Unicode used outside string literals — a common prompt-injection / homoglyph vector

Agent-ready SvelteKit architecture standard and injectable audit kit

AI-powered legacy code migration platform that transforms .NET (C#) applications into Java using LangChain, Milvus Vector Database, RAG, validation pipelines, security analysis, and automated project generation.

Fix contradictions between AI agent instruction files

Deterministic fact-checker for AI coding agents — verify an agent's claims about its own work against the real code, git diff & logs. Local MCP server, cited verdicts, refuses to bluff.

Cost-free Ollama-powered code-review agent for Claude Code — multi-angle finders, adversarial verify, green/yellow/red CI verdict.

Atomic, build-gated developer tools for AI coding agents: type-checked refactors, semantic search, and verify→fix loops over MCP, CLI, and TUI.

Deterministic repo preflight scanner for AI-assisted development workflows

paranoid auditor for Claude Code skills

Deterministic proof that an AI coding agent built what the plan said it would.

Security scanner for AI-generated code — GitHub Action + CLI wrapping Semgrep, Gitleaks, and an AI-agent-specific rule pack.

Detect deprecated OpenAI, Anthropic, and Gemini model IDs in CI with official evidence.

ESLint guard rules that mechanize conventions agents keep breaking — each rule born from a defect that actually shipped.