#sarif

High-performance open-source secret scanner — detect, verify & report leaked API keys, tokens & credentials in code, Git history, container images, and the cloud.

Automate vulnerability triage which prioritizes remediation over discovery

Find and fix what the MCP 2026-07-28 spec revision breaks in your server. 21 rules, 19 of them with fixers, and a readiness board.

Multi-language taint and graph security scanner. Follows tainted data through your code and shows why each finding is a finding.

Professional code clone detection for Go. AST-based structural + semantic detection with suffix tree algorithms, 3 matching modes, 7 output formats, templ support, and CI baseline gating.

Adapters and tools for lintrunner

Cut AI-agent token waste ~90% — query a local SQLite structural index of your JS/TS/CSS codebase with SQL in one round-trip instead of 3–5 file reads. Symbols, imports, calls, components, CSS tokens, coverage, markers. CLI, MCP (21 tools), HTTP, GitHub Action, ESM API. 71 recipes; AST+resolver; SARIF/audit/baselines for CI.

PHP static analysis for architecture & maintainability — 60+ metrics, complexity analysis, dependency graphs, git churn hotspots, and AI-ready MCP server. Alternative to PHPMetrics.

Opinionated PHP code-quality analyzer that scores findings across quality pillars and emits reports for terminals, CI, SARIF, HTML, and a local dashboard.

An opinionated static analyzer for TypeScript and JavaScript projects - 119 rules across 11 pillars, baselines, SARIF/HTML/Markdown reports, CI annotations, and a local dashboard.

Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.

the cli

Umbrella installer and combined report over the independently installable guardrail gates

Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.

Typosquat detector for AI coding agent dependencies

Convert oxlint JSON output to SARIF

Go library for SARIF - Static Analysis Results Interchange Format

Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.

Tenant-isolation security scanner for self-hosted multi-tenant AI-agent platforms. SARIF, JSON, and MCP output.

Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.