static analysis

Rune is a persistent codebase intelligence layer for AI coding agents. It maps a project, serves evidence-backed answers through MCP, and includes project memory plus security-focused static analysis.

A persistent code knowledge graph and MCP server for AI coding agents. It analyzes codebases, builds a graph of files, symbols, commits, and cross-boundary edges, and exposes MCP tools plus generated markdown artifacts for agent workflows.

A semantic diff tool for Sigil code that highlights contract, effect, signature, and test-impact changes for reviewers and agents.

An AI-powered GitHub Action that reviews pull requests with multi-agent analysis, AST-based line verification, and duplicate suppression.

Codeknow turns a codebase into a queryable knowledge graph for architecture analysis, impact detection, drift tracking, onboarding tours, and refactoring guidance. It runs without LLM keys, supports 25+ languages, and exposes a broad CLI plus export formats and interactive views.

A TypeScript static scanner that finds AI agent tool calls with no checks before they can trigger real-world side effects. It supports CLI scanning, JSON output, a generated tool-call registry, and CI/pre-commit enforcement.

Exfault is an autonomous Android security testing tool that uses AI agents, static analysis, dynamic analysis, authenticated workflows, and cloud emulators to produce reproducible findings and reports.

Strict Go static analyzer built for LLM-written code, with opinionated checks, annotation-based exceptions, caching, and Claude Code hook integration.

Hedgemony is a Python tool that checks AI-written code for fabricated packages, invented APIs, impossible calls, and contradictions between code and stated examples, using interpreter and registry checks rather than another model.

HEIDES is a deterministic local harness for AI coding agents that maps a codebase, grounds plans against the current graph, and checks proposed patches for conflicts, edge cases, and security issues before changes land.

Jo is a secure programming language designed to help catch prompt injection and other unsafe behavior at compile time by enforcing explicit capability boundaries. The repository shows the language’s security model, code examples, installation flow, and current project status.

GitGalaxy is a Python-based static analysis and knowledge graph engine for deep repository intelligence. It maps codebases at the function level, supports 50+ languages, runs locally, and exports JSON and SQLite for querying and AI-agent workflows.

A Codacy blog post explaining GitHub Copilot’s new AI Credits billing for code review and positioning Codacy AI Reviewer as an alternative with fixed per-seat pricing, static analysis, and pull-request review features.