static analysis

A persistent code knowledge graph and MCP server for AI coding agents. It analyzes codebases, builds a graph of files, symbols, commits, and cross-boundary edges, and exposes MCP tools plus generated markdown artifacts for agent workflows.

A semantic diff tool for Sigil code that highlights contract, effect, signature, and test-impact changes for reviewers and agents.

A TypeScript static scanner that finds AI agent tool calls with no checks before they can trigger real-world side effects. It supports CLI scanning, JSON output, a generated tool-call registry, and CI/pre-commit enforcement.

Exfault is an autonomous Android security testing tool that uses AI agents, static analysis, dynamic analysis, authenticated workflows, and cloud emulators to produce reproducible findings and reports.

Strict Go static analyzer built for LLM-written code, with opinionated checks, annotation-based exceptions, caching, and Claude Code hook integration.

Jo is a secure programming language designed to help catch prompt injection and other unsafe behavior at compile time by enforcing explicit capability boundaries. The repository shows the language’s security model, code examples, installation flow, and current project status.

GitGalaxy is a Python-based static analysis and knowledge graph engine for deep repository intelligence. It maps codebases at the function level, supports 50+ languages, runs locally, and exports JSON and SQLite for querying and AI-agent workflows.

A Codacy blog post explaining GitHub Copilot’s new AI Credits billing for code review and positioning Codacy AI Reviewer as an alternative with fixed per-seat pricing, static analysis, and pull-request review features.