static-analysis

morluto/rea

A single MCP server that lets AI agents reverse engineer anything — REA plugs into agents like Claude Code and Codex via MCP, pairing them with tools like Ghidra and Hopper to decompile binaries and trace app behavior. Install with one npx command and let an agent explain how a feature works down to the binary level.

Reverse engineer anything with agents, from app behavior down to native binaries.

astral-sh/ruff

A Rust-based linter that replaces Flake8, isort and Black at once — Ruff combines linting, import sorting and formatting in one fast tool, claiming 10-100x speed gains over Flake8 and Black. It offers over 900 built-in rules, reimplements popular Flake8 plugins natively, supports pyproject.toml, caching and autofixes—useful for teams wanting a single, quick Python tooling setup.

An extremely fast Python linter and code formatter, written in Rust.

tirth8205/code-review-graph

A local knowledge graph that feeds AI reviewers only relevant code — Builds a persistent, local-first graph of your codebase using tree-sitter and static analysis, exposed via MCP so AI coding tools like Claude read only relevant context instead of whole files. Aimed at developers doing code review or working in large repos, with benchmarked reductions in context size.

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

MobSF/Mobile-Security-Framework-MobSF

All-in-one pen-testing framework for Android, iOS and Windows apps — MobSF combines static and dynamic analysis for APK, IPA and APPX binaries, plus runtime instrumentation and network traffic inspection. REST APIs and CLI tools let it plug into CI/CD pipelines, making it useful for security researchers, pentesters and DevSecOps teams who need repeatable mobile app assessments.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

anchore/syft

Pink owl that turns containers and filesystems into SBOMs — Syft is a CLI tool and Go library that scans container images, filesystems, and archives to generate SBOMs in SPDX or CycloneDX format. It covers dozens of packaging ecosystems and pairs with the Grype scanner for vulnerability detection, making it useful for supply-chain security workflows.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

repowise-dev/repowise

Codebase intelligence that indexes code, git history and docs once — Repowise indexes code, call graphs, git history, tests and docs locally, letting devs and AI agents query what breaks on change, what's dead, and why decisions were made. Core analysis runs with zero LLM calls, deterministic and reproducible, with REST/MCP access and CI policy checks via SARIF. Free for solo use, scales to whole companies.

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

MG1937/ASC

A stateless Android decompiler built for fast, on-demand code queries — ASC skips the heavy preprocessing of traditional decompilers by querying compiled APKs directly, probing the Deflate bitstream and Huffman tables to extract code relationships in milliseconds instead of minutes. It targets agents and mobile researchers needing fast reverse engineering; a 10x faster Rust rewrite (rust_ASC) now exists, with this Python version staying the fastest Python option.

ASC is a super FAST and lightweight Android decompiler designed for Agents/Mobile Researchers.

winnin/farol

A risk map for pull requests, sitting after your AI reviewer — farol is a free CLI and GitHub Action that runs after AI code review to show approvers which files carry the real risk of a merge, what they reach, diff coverage, and contract breaks. It relies on static analysis rather than model guesses, covering TypeScript/React, Go, and Python, and runs in shadow mode so it never blocks merges.

Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.

tmatens/compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

mpyw/declscope

A linter that enforces file-private scope inside flat Go packages — declscope is a static-analysis linter that adds a third visibility level Go lacks: file-scoped privacy for declarations, methods, and struct fields, checked at build time. It lets teams keep packages flat and avoid splitting them just to get boundaries, which otherwise forces exporting shared names and risks import cycles or costly refactors.

Keep Go packages flat without losing their internal boundaries: file-level private and package scopes for declarations, methods and struct fields

La5u/Parsimony

A leaderboard that measures code bloat in AI coding patches — Parsimony parses patches already published for benchmarks like SWE-bench and DeepSWE, counting syntax units added and removed without running any code. It ranks models by net code added per solved task relative to peers, useful for researchers comparing AI coding agents' verbosity, not just solve rates.

Measures how much code AI coding agents add, from patches benchmarks already publish