MCP server for AI agents to run open-source code security and static analysis on Python, TypeScript, and Go. Detects dead code, secrets, vulnerabilities, and diff-aware security regressions.
How to install skylos?
duriantaco/skylos
$git clone https://github.com/duriantaco/skylosInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install skylos by running `git clone https://github.com/duriantaco/skylos`, then use it for the current task and follow its documentation at https://github.com/duriantaco/skylos.
README.md
| 1 | <div align="center"> |
| 2 | <img src="assets/DOG_1.png" alt="Skylos" width="260"> |
| 3 | <h1>Skylos</h1> |
| 4 | <h3>Open-source, local-first checks for dead code, security issues, secrets, quality regressions, and AI-code mistakes before merge.</h3> |
| 5 | </div> |
| 6 | |
| 7 |  |
| 8 | [](https://codecov.io/gh/duriantaco/skylos) |
| 9 |  |
| 10 | [](https://pypi.org/project/skylos/) |
| 11 |  |
| 12 | [](#star-authenticity-audit) |
| 13 | [](https://discord.gg/Ftn9t9tErf) |
| 14 | |
| 15 | [Website](https://skylos.dev) | |
| 16 | [Docs](https://docs.skylos.dev) | |
| 17 | [Repo Map](https://duriantaco.github.io/skylos/repo-map/) | |
| 18 | [Quick Start](https://docs.skylos.dev/quick-start) | |
| 19 | [GitHub Action](./action.yml) | |
| 20 | [VS Code Extension](./editors/vscode/README.md) | |
| 21 | [Real-World Results](./REAL_WORLD_RESULTS.md) | |
| 22 | [Benchmarks](./BENCHMARK.md) | |
| 23 | [Roadmap](./ROADMAP.md) | |
| 24 | [Contributing](./CONTRIBUTING.md) |
| 25 | |
| 26 | **English** | [Deutsch](./docs/i18n/README.de.md) | [简体中文](./docs/i18n/README.zh-CN.md) | [Translations](./docs/i18n/README.md) |
| 27 | |
| 28 | ## What Is Skylos? |
| 29 | |
| 30 | Skylos is an open-source static analysis CLI for Python, TypeScript, |
| 31 | JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment config. It |
| 32 | runs locally by default and can also be used as a CI/CD PR gate. |
| 33 | |
| 34 | Use Skylos when you want one command to check a repo or pull request for: |
| 35 | |
| 36 | - dead code and unused files |
| 37 | - security flaws and dangerous data flows |
| 38 | - secrets and dependency CVEs |
| 39 | - CI/CD and edge-device deployment misconfigurations |
| 40 | - quality regressions such as complexity, duplicate branches, and deep nesting |
| 41 | - common AI-generated code mistakes, including missing guards, fake helpers, |
| 42 | invented package APIs, and impossible dependency versions |
| 43 | - LLM app risks such as unsafe tool use and missing output validation |
| 44 | |
| 45 | ## Start In 60 Seconds |
| 46 | |
| 47 | ```bash |
| 48 | pip install skylos |
| 49 | skylos . |
| 50 | ``` |
| 51 | |
| 52 | The default scan focuses on dead code. Add security, secrets, quality, |
| 53 | dependency, and AI-defect checks with `-a`: |
| 54 | |
| 55 | ```bash |
| 56 | skylos . -a |
| 57 | ``` |
| 58 | |
| 59 | Run only evidence-backed AI defect checks with: |
| 60 | |
| 61 | ```bash |
| 62 | skylos . --ai-defects |
| 63 | ``` |
| 64 | |
| 65 | Verify a changed file or range before an agent hands it to review: |
| 66 | |
| 67 | ```bash |
| 68 | skylos verify . --file src/app.py --range 40:75 --project-context |
| 69 | ``` |
| 70 | |
| 71 | `skylos verify` schema version 2 returns `pass`, `fail`, or `incomplete`. |
| 72 | `incomplete` means a requested proof could not be established, such as a |
| 73 | third-party TS/JS import, computed namespace member, unsupported language-local |
| 74 | API check, or parser surface that Skylos could not prove; it exits `2` unless |
| 75 | `--no-fail` is set. The `coverage` object lists detected languages, expected |
| 76 | checks, language support, missing checks, completed/skipped checks, checked |
| 77 | references, and deterministic skip reasons. |
| 78 | |
| 79 | Deterministic local/workspace API verification currently covers Python, |
| 80 | TypeScript/JavaScript, Go, and Java without executing target code. PHP, Rust, |
| 81 | Dart, C#, Kotlin, and Shell retain their existing static-analysis coverage, |
| 82 | but their local API proof is reported as unsupported and therefore incomplete. |
| 83 | See [AI Code Verification Coverage](./docs/ai-code-verification.md). |
| 84 | |
| 85 | Create a local AI hallucination contract for repo-specific generated-code |
| 86 | truth. `skylos verify` auto-discovers `.skylos/ai-contract.yml`: |
| 87 | |
| 88 | ```bash |
| 89 | skylos contract init |
| 90 | skylos contract inspect |
| 91 | skylos verify . |
| 92 | ``` |
| 93 | |
| 94 | Test a running agent against deterministic response and tool-use scenarios: |
| 95 | |
| 96 | ```bash |
| 97 | skylos agent init |
| 98 | skylos agent test --allow-contract-endpoint |
| 99 | ``` |
| 100 | |
| 101 | Create a project config with |
Related
6 picksType
- code-review-graphLocal-first knowledge graph for token-efficient code review through MCP and CLIJul 2026
- repowiseCodebase intelligence for AI coding agents — graph, git history, docs, decisions, code health.Jul 2026
- mcp-server-atlassian-bitbucketNode.js/TypeScript MCP server for Atlassian Bitbucket. Enables AI systems (LLMs) to interact with workspaces, repositories, and pull requests via tools (list, get, comment, search). Connects AI directly to version control workflows through the standard MCP interface.Mar 2026
- gemini-mcp-toolMCP server for Gemini CLI integrationJul 2026
- socraticodeEnterprise-grade (40m+ LOC) codebase intelligence, zero-setup, local & private Plugin/Skill/Extension or MCP: hybrid semantic search, polyglot dependency graphs, symbol-level impact analysis & call-flow, interactive HTML viewer, cross-project & branch-aware search, DB/API/infra…Jul 2026
- github-mcpProduction-ready Model Context Protocol server providing Claude with complete GitHub integration - comprehensive tools for repository management, branch operations, file handling, issue tracking, and collaboration features with OAuth 2.0 authentication and MongoDB persistence.Jun 2026
