code-analysis

Open-Kritt is an open-source security research platform that orchestrates multiple AI agents to analyze code in parallel, automating discovery of real vulnerabilities, and supports deduplication, validation, and prioritization. The team behind it has used it to earn significant bounties and win the Firedancer audit contest.

ReadmeAI is a Python CLI tool that automatically generates structured README files from local or remote repositories using AI models or offline mode, supporting multiple providers and customization.

Google DeepMind's 3.5 Flash Cyber model enables defense specialists to check more code paths and detect complex vulnerabilities missed by standard models, as tested on Google Chrome and Android codebases.

Simon Willison deeply analyzed the open-source code of Grok Build, revealing the inner workings of a terminal programming agent, including system prompts, tool implementations, and privacy issues.

A developer built a tool using MiniMax AI's M3 model to analyze entire GitHub repositories in a single prompt, producing code health reports and bug detection. It successfully processed react's 780k-token codebase for $0.23.

Decypher is a deep semantic code graph tool that helps AI agents understand code structure, data flow, and security issues, now in beta for Java and JVM languages.

A user expresses frustration with Fable 5's safeguards preventing security bug analysis in their own code, questioning the model's usefulness compared to Opus 4.8 and seeking actual use cases from the community.

Slopo is a lightweight CLI tool that detects non-exact code duplication across a codebase using embedding models, helping developers find similar code snippets that are hard to spot manually.

CodeFlow is a browser-based tool that visualizes code dependencies from a GitHub URL or local folder, providing interactive graphs, security scanning, pattern detection, and health scores without uploading code.

GitNexus is a tool that indexes codebases into interactive knowledge graphs, mapping dependencies, call chains, and execution flows. It provides a CLI with MCP integration for AI agents and a web UI for exploration.

Understand Anything is an open-source AI agent plugin for Claude Code, Codex, and OpenCode that analyzes codebases and turns them into interactive knowledge bases, enabling users to query and explore their code rather than just viewing structure.

Introducing a TypeScript CLI tool Repo-to-Agent-Context that can compress any code repository into a structured context package readable by AI programming agents, saving tokens and avoiding context loss.

SocratiCode is an open-source codebase context engine that allows AI to analyze and understand large codebases (40M+ lines) locally, with zero configuration and full privacy.

Graphify is a tool that helps trace hidden couplings, navigate important files, and provide better context for AI agents.

Potpie is an open-source tool that converts entire codebases into knowledge graphs, enabling AI agents to reason about code for debugging, feature development, and other tasks.

Introducing a tool called GitReverse: simply replace 'github' with 'gitreverse' in a GitHub URL to get project analysis prompts, greatly lowering the barrier to code comprehension, making reading code no longer a rare skill.

Alibaba has open-sourced Open Code Review, an AI-powered CLI tool for code review that combines deterministic engineering with LLM agent capabilities. Originally an internal tool serving tens of thousands of developers and identifying millions of defects, it reads Git diffs and produces structured, line-level review comments using a configurable model endpoint.

Anthropic has released an open-source reference implementation for autonomous vulnerability discovery and remediation using Claude, featuring a full pipeline (recon → find → verify → report → patch) with sandboxing support. It accompanies Claude Security, a hosted product for managing vulnerabilities across codebases.

We released Trustabl Agent Analyzer, an open-source tool that scans AI agent repositories to find missing validation, retries, and error handling, generating a privacy-preserving local report.

IBM Research explores how agent logic—software primitives like knowledge graphs and program analysis—can guide LLM-based agents to efficiently handle complex enterprise workflows, reducing hallucinations and costs while improving outcomes.