#static-analysis

Your AI coding agent is only as reliable as the harness around it. Measure that harness in seconds with harness-score.

Senior-developer discipline for AI coding agents. A commit gate that counts unchecked as failing, quality controllers that refuse to call unfinished work done, and a lessons loop that closes each escaped bug's class. One Go binary, no runtime deps, works with 20+ agents.

Stop your coding agent reading the wrong files. Compiler-grade TS/JS repo map — 100% precision on blast radius vs grep's 60%, measured on public repos. CLI + MCP server, fully local, no vector DB.

Get your repo ready for AI.

Eight security skills for Claude Code with no dependencies: standard library only, tested, and usable as a CI step. Secret scanning, Python SAST, prompt-injection testing, plus HTTP, JWT, Dockerfile, CORS and dependency auditing.

OmniRank — the SEO/AEO/GEO auditor that runs inside your repo. Audits any site across search, answer and generative-engine gates, resolves each finding to the source file that owns it, and shows the diff that fixes it. Generates llms.txt + facts.json. Claude Code plugin + CLI.

Scan any codebase for O(n²) hotspots, N+1 queries, and complexity issues — works with 13+ AI coding agents

🐀 Fuzz your verifier before an RL agent does. Static + dynamic LLM security auditor to detect reward-hacking in RL post-training environments (OpenEnv, verifiers-spec, Gymnasium).

Engineering OS — a suite of Model Context Protocol (MCP) servers that bring engineering discipline to AI coding assistants: dependency & version governance, hallucination detection, security/architecture/QA/performance review, multi-agent code review, self-healing, and compliance.

chennai (chen N ai) is a hybrid AI agent and a terminal user interface for static analysis, data-flow tracing, and AI-assisted code and security analysis.

Prism Reviewer is an agentic, AI-driven multi-agent code review system orchestrated via LangGraph and LiteLLM. It acts as an autonomous gatekeeper for pull requests by performing targeted static analysis, dependency scanning, AST-based symbol inspection, and parallel LLM-guided code evaluation.

Offline repo inspection and change review for AI coding agents. Scan instructions, compare saved scans, explain findings, and export local reports.

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

Local code-context engine for AI coding agents: structural answers within a token budget.

Self-hosted. Your monitoring already told you something broke — Celmis is what happens next: it knows which repository the alert belongs to, and an embedded Claude Code session on your own subscription fixes it and opens a pull request. One symbol graph also answers cross-repo questions, reviews PRs, and exports a CycloneDX SBOM. AGPL-3.0.

A statically typed language and compiler for AI agents. Write once, verify statically, compile to a portable Agent IR.

🪨 why input many code when few code do trick. Slashes input tokens by up to ~80% across 9 languages via AST pruning, ultra-dense "caveman" syntax and more for AI coding agents.

Local SwiftUI diff checks with SwiftPM, Tuist, and Xcode module ownership.

Local-first codebase search and MCP context packs for coding agents — SQLite FTS5, tree-sitter symbol graphs, and reusable briefings.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

Deterministic fact-checker for AI coding agents — verify an agent's claims about its own work against the real code, git diff & logs. Local MCP server, cited verdicts, refuses to bluff.

Detects capability drift in Claude Agent Skills and MEMORY.md files before an edit ships. npm + PyPI CLI.

Reverse-engineer any Python codebase into an interactive architecture knowledge graph with AI-powered layer detection, community discovery, and living documentation

Evidence-first source security scanner for human-written and AI-generated code. Rust CLI with AST review, bounded taint, explicit coverage, JSON/SARIF, and agent workflows.

离线、证据驱动、可审计的 AI Agent Skill 安全审查器：16+ 类风险、简报模式、已审记录、Inspection Ledger、Docker 与云端 CI 扫描

Local‑only Query Risk & Scope Analyzer for AI coding prompts — estimate risk, scope, likely files, and token pressure before sending queries to agents like Cursor, Copilot, or Claude.

Evidence-driven Repo → Agent Skill compiler. Pinned high-star CLI benchmarks, source provenance, portable Skills and Codex plugins.

Catch AI coding-agent scope creep before you commit. Overscope compares Claude Code and Codex sessions with your git diff to flag out-of-scope edits, deleted tests, hidden dependencies, and false completion claims. Local, deterministic, no model or API key.

🏆 Zama Bounty S2 winner. AI coding-agent skill for Zama fhEVM — Claude Code, Cursor, Windsurf. 20 anti-patterns + 12-rule linter; cut agent fhEVM mistakes 15→0 in A/B tests. MIT. · 🏆 Zama 赏金赛道 S2 获奖。Zama fhEVM 的 AI agent skill — Claude Code、Cursor、Windsurf，20 条 anti-pattern + 12 规则 linter，A/B 实测错误 15→0。MIT。

Static analysis for AI agents in GitHub Actions — finds where attacker-controlled text reaches an agent's prompt, and what that agent is allowed to do with it.

Cost-conscious JavaScript identifier recovery with LLMs, relation-aware batching, and a live web playground.

Find Rust test-oracle gaps before mutation testing: static RIPR evidence for CI, editors, and agents.

LLM-based vulnerability hunting agent that verifies findings in a Docker sandbox

FastAPI service that reviews pull-request diffs for security, performance and design issues, generates documentation and scores technical debt - powered by the Claude API with a regex/AST static-analysis fallback that runs without an API key.

Claude Code plugin: deterministic PreToolUse guardrails for the Bash tool. Blocks known-wrong shell commands and bash-only syntax that breaks under zsh, handing back the correct form.

Structural checks for an agent memory archive: size budget, frontmatter, per-line provenance, perishable state, personal data, and suppression instructions. Six detectors, one CLI, no network calls.

paranoid auditor for Claude Code skills

Deterministic repo preflight scanner for AI-assisted development workflows

Atomic, build-gated developer tools for AI coding agents: type-checked refactors, semantic search, and verify→fix loops over MCP, CLI, and TUI.

Cost-free Ollama-powered code-review agent for Claude Code — multi-angle finders, adversarial verify, green/yellow/red CI verdict.