code-quality

usestrix/strix

Autonomous AI agents that hack and patch your app like a red team — Strix deploys autonomous AI agents that act like real attackers, running actual exploits to find and validate vulnerabilities in your application, then help fix them. It targets developers, security teams, and bug bounty hunters who want automated, agent-driven pentesting instead of manual testing.

keploy/keploy

Turning real user traffic into API tests, automatically — Keploy records live API traffic and converts it into test cases and mocks, aiming for 90% test coverage faster than hand-written unit tests. It targets developers building API, integration, and E2E tests in AI-assisted workflows, and is listed in the CNCF landscape.

repowise-dev/repowise

Codebase intelligence that indexes code, git history and docs once — Repowise indexes code, call graphs, git history, tests and docs locally, letting devs and AI agents query what breaks on change, what's dead, and why decisions were made. Core analysis runs with zero LLM calls, deterministic and reproducible, with REST/MCP access and CI policy checks via SARIF. Free for solo use, scales to whole companies.

tach-org/tach

Rust-powered dependency boundaries for Python monorepos — Tach is a pip-installable, Rust-built CLI that enforces module boundaries in Python codebases: declared dependencies, public interfaces for cross-module calls, and no import cycles. It adopts incrementally with no runtime impact, making it useful for teams moving toward a modular monolith without a full rewrite.

ivankovic/omnidiff

Content-aware diffing that goes beyond line-based diff — OmniDiff is a Rust diff tool that diffs by content type instead of just lines, using structural/AST-aware algorithms for code and dedicated comparisons for images, fonts, PDFs, archives and more. It works as a git difftool with a terminal UI (ratatui), and the README backs claims with measured accuracy and speed stats across content types versus plain diff.

open-policy-agent/regal

Regal is a linter and language server for Rego, bringing your policy development experience to the next level!

HexmosTech/LiveReview

Risk-ranked AI code review built for critical codebases — LiveReview is a Go-based AI code review tool that focuses on flagging risk in business-critical systems rather than just style nits. It ships with built-in gitleaks secret scanning and OSV dependency vulnerability checks, making it useful for teams that need security-aware review automation alongside standard code-quality checks.

mpyw/declscope

A linter that enforces file-private scope inside flat Go packages — declscope is a static-analysis linter that adds a third visibility level Go lacks: file-scoped privacy for declarations, methods, and struct fields, checked at build time. It lets teams keep packages flat and avoid splitting them just to get boundaries, which otherwise forces exporting shared names and risks import cycles or costly refactors.

La5u/Parsimony

A leaderboard that measures code bloat in AI coding patches — Parsimony parses patches already published for benchmarks like SWE-bench and DeepSWE, counting syntax units added and removed without running any code. It ranks models by net code added per solved task relative to peers, useful for researchers comparing AI coding agents' verbosity, not just solve rates.

sator-imaging/MeticulousAnalyzer

A Roslyn Analyzer That Digs Into Static Init Order and Move Semantics — This C# analyzer goes beyond typical style checks, catching flaky static field initialization, cross-type reference problems, missing await on Task/ValueTask, disposable mistakes, and even enforcing move-only/no-copy semantics and CRTP TSelf mismatches. It's aimed at C#/.NET developers wanting deeper correctness checks during build time rather than just formatting rules.