ClawGuard is a security application designed to protect AI agent ecosystems through static code analysis, runtime monitoring, and sandboxed execution. The backend is a FastAPI server providing authentication (JWT), a code security check pipeline (AST scanning + sandbox execution with sys.settrace monitoring), and audit log storage in SQLite. The frontend is a single-page HTML dashboard with Chinese/English i18n, simulating a defense matrix with real-time feedback. The system demonstrates a multi-layered defense: static prevention (AST blacklist), dynamic detection (monkey-patched builtins, runtime behavior monitoring), and mitigation (timeout, permission errors). It is a well-structured, self-contained application with clear separation of concerns, though the frontend is monolithic. The code quality is strong, with reusable components in the core modules, but the overall architecture is tightly coupled to the specific security policy.
OASIS is a CLI-first security analysis tool written in Python. It orchestrates a multi-phase LangGraph pipeline (Discover → Scan → Expand → Deep → Verify → Report) to detect vulnerabilities in source code using local LLMs via Ollama or OpenAI-compatible servers. The tool supports 25+ vulnerability types across multiple languages, produces deterministic verdicts without LLM reliance, and integrates with CI via severity-gated exit codes, suppression registries, and report diffing. It is installed via pipx or Docker and run as `oasis -i /path --models ...`.
vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.
coca is a static code analysis and refactoring CLI tool written in Go, designed to assess code quality, detect bad smells, analyze dependencies, and support migration tasks (specifically Spring MVC to Spring Boot). It operates as a monolithic command-line application using the Clean Architecture pattern, with distinct layers for domain models, application logic, and infrastructure. The tool supports multiple languages including Java, Go, Python, JavaScript, TypeScript, and Groovy, leveraging ANTLR for parsing and generating ASTs for analysis. The system's primary function is to scan codebases for technical debt, architectural issues, and API definitions, outputting results in various formats (JSON, CSV, Graphviz). It includes features for bad smell detection (e.g., Long Method, Large Class), test smell analysis, and dependency usage evaluation. The architecture is modular, allowing individual analysis features to be executed independently, though the tool itself is a single binary. While the codebase demonstrates solid engineering practices with a clean separation of concerns and reusable domain models, it exhibits technical drift in its dependency ecosystem. The Go version specified (1.23) is ahead of current stable releases, and several core dependencies (e.g., spf13/cobra, gomega) are significantly outdated, creating a mismatch between the code's stated requirements and the available ecosystem versions. This suggests the project is either in a transitional state or relies on specific, potentially unstable, dependency versions.
This repository is a curated list (awesome list) of ESLint-related resources, including shareable configs, plugins, parsers, formatters, tools, and tutorials. It serves as a community-maintained index for developers seeking to extend or configure ESLint for various use cases, such as code quality, compatibility, frameworks, security, and style. The primary content is a single README.md file organized into categories, with links to external projects and brief descriptions. The project is not a software application or data pipeline; it is a documentation-focused repository that follows the awesome list convention. It includes a minimal package.json with a test script using awesome-lint to validate the list's formatting and a GitHub Actions CI workflow that runs on pull requests and pushes. The contributing.md outlines guidelines for adding new entries. Despite its simplicity, the repo is actively maintained, with a large number of stars (4766) and forks (270), indicating its value as a reference. It does not contain reusable code components beyond the list itself, but the curation and organization demonstrate good practices for maintaining a community resource.
APKDeepLens is a Python-based CLI static analysis tool for Android APK security assessment. It decompiles APKs using bundled JADX, analyzes AndroidManifest.xml for misconfigurations, scans decompiled source code for OWASP Mobile Top 10 vulnerabilities, detects hardcoded secrets and insecure URLs, and generates reports in JSON/HTML/PDF/TXT formats. The architecture is monolithic with modular components for manifest analysis, code scanning, secret extraction, and report generation. Entry point is APKDeepLens.py with argparse CLI interface. External dependencies include JADX (bundled), xhtml2pdf for PDF generation, and python-bidi for PDF rendering.
GDA (GJoy Dex Analyzer) is a Windows-native, closed-source Dalvik bytecode decompiler and Android APK reversing tool, written in C++. It provides a GUI for interactive analysis, a CLI for batch operations, and a socket-based server for programmatic access. The open-source components in this repository include Java and Python plugin APIs for scripting analysis tasks (e.g., string decryption, method tracing), example scripts, and skill definitions for LLM-driven automated malware analysis. The core decompiler is not open source, but the plugin interfaces and skill scripts are well-structured and reusable for integrating GDA with other tools or AI agents. The repository also contains color themes, documentation images, and a DEX patching utility.
This repository is a curated collection of recipes and tools for Go development, organized into categories such as testing, dependencies, code visualization, code generation, refactoring, errors, build, assembly, deployment, execution, monitoring, benchmarking, documentation, security, static analysis, and guides. The actual codebase is minimal: a Go module with a three-line main.go that generates the README.md from a structured YAML file (page.yaml) using the mdpage library. The primary value is the content itself, which serves as a reference for Go developers to discover and utilize various tools and techniques. The project is actively maintained, with up-to-date dependencies and a simple CI workflow for markdown link validation.
Elpy is an Emacs minor mode that provides a full-featured Python IDE within Emacs. The Python backend (elpy/ directory) implements a JSON-RPC server over stdin/stdout, using Jedi for static analysis (completions, definitions, calltips, refactoring) and external tools for formatting (autopep8, yapf, black) and linting (flake8). The Emacs Lisp frontend (elpy.el and related .el files) defines the minor mode, keymaps, modules for company-mode, eldoc, flymake, yasnippet, pyvenv, and more. The architecture is modular: each feature (completion, folding, multiedit, testing, debugging) is encapsulated in a module that can be enabled/disabled. The project is currently unmaintained with high technical drift due to dependency on evolving Jedi API and deprecated Emacs constructs.
This repository is an ESLint plugin (`@factory/eslint-plugin`) developed by Factory AI. It provides a suite of custom lint rules and shared configurations designed to enforce strict code organization, testing, and logging conventions. The codebase is fully AI-generated and explicitly unmaintained, intended for inspiration rather than direct import. It demonstrates high craftsmanship in AST manipulation (e.g., `jest-mock-require-actual`, `structured-logging` rules with auto-fix) and complex configuration curation (e.g., `frontend.js` config with extensive `no-restricted-syntax` selectors banning specific React/Next.js patterns). The rules enforce a highly opinionated architecture, including specific file naming conventions (`.page.tsx`, `.module.tsx`), mandatory middleware in route handlers, and structured logging over template literals. While the code quality and test coverage are strong, the plugin is technically drifted (ESLint 8.x API, TypeScript 5.x) and relies on outdated dependencies, limiting its direct applicability without significant modernization.
This repository is a distribution point for pre-built binaries of the CodeQL CLI, a static analysis tool for security vulnerabilities. It does not contain source code; instead, it provides release assets (zip files) and changelogs. The repository is primarily used for downloading the CLI and tracking releases. There is no code to analyze for craftsmanship or reusability.
The repository contains only documentation files (README-EN.md and README.md) describing a Java-based SAST tool called 'chanzi'. No source code, binaries, or executable artifacts are present. The documentation outlines the tool's features: taint analysis for vulnerability detection, support for Java frameworks (Spring, Dubbo, etc.), built-in Java runtime, and vulnerability reporting. The repository appears to be maintained with recent commits and issue tracking, but lacks any actual implementation code, rendering it non-functional as a software artifact.