Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

security security-audit owasp ci-cd cybersecurity penetration-testing pentesting appsec offensive-security ethical-hacking security-automation sarif security-tools devsecops security-testing api-security red-teaming ai-security pentesting-tools ai-penetration-testing

• Updated Nov 11, 2026
• TypeScript

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

rust cli typescript ai skills mcp linter static-analysis duplicates developer-tools code-quality cpd copy-paste dry sarif code-duplication github-action clones-detection coding-agents copy-paste-detection

• Updated Nov 12, 2026
• Rust

The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.

cli npm security mcp static-analysis secrets owasp hermes sarif security-tools devsecops ai-security supply-chain-security prompt-injection llm-security agentic-ai agent-security

• Updated Oct 17, 2026
• JavaScript

User-friendly documentation for the SARIF file format.

tutorial static-analysis sarif

• Updated Dec 15, 2023

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

security ai sarif bill-of-materials ai-security sbom github-actions cyclonedx llm

• Updated May 24, 2026
• Python

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

rust cli security tree-sitter linter static-analysis pre-commit sarif vulnerability-scanner sast code-security semgrep opengrep

• Updated Nov 3, 2026
• Rust

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

javascript kotlin python java go php typescript static-code-analysis dotnet static-analysis actions code-review code-quality sarif devsecops code-scanning azure-pipelines github-actions azure-extensions qodana

• Updated Oct 29, 2026
• JavaScript

Local MCP/AI attack-surface audit and evidence gate for authorized testing

python security ai mcp static-analysis sarif attack-surface

• Updated Nov 12, 2026
• Python

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

python security cryptography static-analysis post-quantum-cryptography sarif code-scanning pqc cyclonedx cryptographic-inventory

• Updated Sep 5, 2026
• Python

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

vex spdx appsec post-quantum-cryptography vulnerability-management sarif oss-compliance licence-management security-compliance sbom pqc cyclonedx software-supply-chain-security sbom-tool sbom-quality aibom cbom cryptographic-inventory eu-ai-act cyber-resilience-act

• Updated Nov 11, 2026
• Rust

Corax for Java: A general static analysis framework for java code checking.

java security security-audit static-code-analysis static-analysis code-analysis owasp vulnerability software-analysis program-analysis taint-analysis soot abstract-interpretation cwe sarif sast flowdroid

• Updated Dec 3, 2024
• Kotlin

Lint, format and auto-fix your Groovy / Jenkinsfile / Gradle files using command line

lint groovy gradle nextflow ci groovy-language linter codenarc jenkinsfile hacktoberfest sarif code-quality-analyzer sarif-report megalinter

• Updated Nov 10, 2026
• JavaScript

🔧 JetBrains Qodana’s official command line tool

javascript kotlin python java cli php typescript static-code-analysis ci code-review code-quality sarif devsecops code-scanning qodana sarif-report

• Updated Nov 12, 2026
• Go

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions.

python mcp ai-safety sarif security-tools devsecops ai-agents red-teaming ai-security opentelemetry supply-chain-security mlsecops ml-security prompt-injection llm-security model-context-protocol agent-security ai-red-teaming owasp-llm model-security

• Updated Nov 9, 2026
• Python

Open-source red-team testing for AI agents. 266 bundled probes with OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF mappings. Selected probes use recorded browser requests, MCP tool calls, or mock payments. CLI, SARIF, GitHub Action.

python mcp jailbreak owasp sarif devsecops ai-agents security-testing red-teaming ai-security github-actions mitre-atlas llm prompt-injection llm-security owasp-llm-top-10 agent-security ai-red-teaming nist-ai-rmf browser-agents

• Updated Nov 12, 2026
• Python

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

python open-source security developer-tools application-security cwe autonomous-agents sarif devsecops ai-agents vulnerability-scanner graphql-security sast ai-security llm agentic-ai agentfield

• Updated Nov 2, 2026
• Go

Evaluator-neutral AI evaluation evidence, baseline regression gates, and JSON, JUnit, and SARIF reports for CI.

python testing junit sarif quality-gates rag mlops github-actions ai-evaluation llm-evaluation

• Updated Oct 26, 2026
• Python

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, explainable findings, source exploration, AI-assisted investigation and professional reporting.

python react-native static-analysis reverse-engineering apk owasp cybersecurity beetle application-security pentesting flutter mobsf android-security mobile-security ios-security sarif devsecops sbom fastapi masvs

• Updated Jul 21, 2026
• Python

Open-source CI/CD security tool: finds the security checks your pipeline is missing, and the ones that can never fail the build. GitHub Actions, GitLab CI and more.

cli golang security devops static-analysis ci-cd code-quality sarif security-tools devsecops sast github-actions supply-chain-security pipeline-security

• Updated Nov 12, 2026
• Go

Local-first Git diff triage. Turn patches into actionable review checklists in your browser, CLI or GitHub Actions. Zero dependencies, no AI keys, no uploads. By brunnodev.

nodejs javascript cli privacy static-analysis ci-cd static-site developer-tools code-review code-quality pull-requests git-diff sarif security-tools github-actions zero-dependencies developer-productivity local-first review-checklist

• Updated Nov 7, 2026
• JavaScript