static-analysis-tools

"chanzi" is a simple and user-friendly JAVA SAST tool that utilizes taint analysis technology, includes built-in common vulnerability rules, supports decompile, custom rule, and is compatible with the technology stacks of Servlet&filter, Spring,struts,Dubbo,Thrift, jax-rs,jax-ws,JFinal,Netty,MyBatis,and JSP.

CodeNarc is a static analysis tool for Groovy source code

eBurger is a static analysis tool that provides a way to quickly query and analyze solidity smart contracts.

An analysis tool providing insight into the portability and maintainability of an application’s source code.

mobile application (ipa & apk) static analysis tool

Hawkeye is an architectural analysis engine for AI coding agents. It provides structured, deterministic context about a codebase—dependencies, impact, cycles, and system health—so agents can make safe, architecture-aware decisions before modifying code.

VScode extension for analyzing the energy state of Python, TypeScript, Kotlin, C++, C#, and F# code

Analyze different types of malware with the use of static and dynamic analysis techniques.

Polyglot security analysis framework — AST/CFG dataflow, Z3 symbolic execution, concolic fuzzing, OWASP Top 10, IaC & container scanning across 14 languages.

Static analysis CLI that scans a PE (EXE/DLL) file for anti-debug and anti-VM techniques and obfuscation indicators, without requiring IDA, x64dbg, or any other disassembler installed.

GitHub Action to detect adversarial Unicode in PRs: invisible characters, bidi attacks, homoglyphs, PUA code points, and encoding issues. Zero-config, language-agnostic.

Security scanner and install-time gate for Agent Skills (Claude Code / Cowork) - detects malicious code, data exfiltration, prompt injection, and supply-chain risk, and quarantines risky skills before you install them.

This is my experiment to gain a better understanding of SonarQube as a code analyzer for PL/SQL and Oracle SQL code.

Semgrep rules compiled from incidents by an LLM, gate-verified before commit. First reference of the Compiled AI paradigm - open to collaborators on this and adjacent compile targets (OPA, Terraform, Actions).

🤖 Multi-agent AI system for automated code review | 74% bug detection | 240x faster than manual | Built with Google ADK & Gemini 2.0 | Kaggle Capstone Project

Deterministic context protocol for AI-assisted code understanding. Early validation / research preview. Local-first, no LLM inference in its contracts.

Static-analysis-first, evidence-grounded, AI-adjudicated codebase intelligence CLI written in Go.

Offline-first repository intelligence: understand, debug, document, and review any codebase from the terminal.

AI skill checker and agent skill validator for folders, ZIPs, .skill bundles, SKILL.md files, scripts, references, links, assets, and token budget.

CI guardrails for AI-edited codebases and architecture boundaries.