Code Scanning Python Packages

lintrunner-adapters

Adapters and tools for lintrunner

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

actenon-scan

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

codescanai

CodeScanAI is an open source tool that utilizes powerful AI models (OpenAI, Gemini, and even self-hosted servers) to scan your codebase for possible security vulnerabilities.

codepathfinder

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

aicaudit

aicaudit — AI-powered code audit for Python: taint-path static analysis + evidence-grounded AI verdicts. Every result ships with a machine-checkable source-to-sink path.

jevg

Static code scanner (SAST linter) that finds insecure usage of Jev / TypeSafe guardrails in Python. Not a guardrail itself — build-time analysis, offline, no API key.

no-phone-home

Does this code phone home? A privacy-focused static analyzer that traces system, user and hardware data to network sinks and flags telemetry sent without an opt-out check — including inverted DO_NOT_TRACK guards. Python, JS/TS, Go. SARIF + Privacy Nutrition Label.

aether-lang

Security checker for Python, aimed at code AI agents write and run: SQL, command and code injection, deserialization, SSTI, XXE, hardcoded credentials. Emits SARIF for GitHub Code Scanning.

pydependence

🕵️🐍 Generate requirements.txt and pyproject.toml extras across modules, with configurable starting points, using import graph traversal and the python AST. Fully configurable and works with pre-commit.

sigilsec

Automated security auditing CLI for AI agent code — quarantine-first workflow for repos, packages, and agent tooling

mcp-riskmap

Local-first static auditor for risky MCP and agent-tool repository patterns.

codetrellis

Open-source project awareness engine for AI coding tools via compressed codebase context, MCP, and editor integrations.

graveyard

Find dead code across Python, JS/TS, Go, and Rust with git-aware confidence scoring.

webanalyzer-security

Open-source attack-surface scanner: subdomains, DNS, tech stack and vulnerabilities in one command. SARIF for GitHub Code Scanning, a GitHub Action, a web dashboard, and plugins that are one file each.

sarif-kit

Convert the native output of scanners and linters that never added SARIF support into valid SARIF 2.1.0 for GitHub Code Scanning