Discover the Best AI Tools

Jev Review exposes one local MCP tool that scores caller-supplied tasks, diffs and files across review dimensions through the remote TypeSafe API. It does not scan a repository automatically or generate a prose diagnosis. A provider key is required; the coding agent must interpret scores, fix issues and validate changes, since scores are not proof of correctness.

dep-diff-mcp analyzes package-version changes using release notes, security advisories and migration links, returning ranked upgrade guidance through MCP. It depends on external registries and GitHub access; missing release information and API limits constrain results, and recommendations do not establish application compatibility.

Jev Review evaluates Git diffs or a codebase through staged Jev judgments and displays structured findings in a local dashboard. It needs Node.js 24+ and a TypeSafe key; this experiment lacks compiler/static-analyzer integration, and findings are review prompts rather than proof of defects.

mcp-gateway-scan statically checks repository code and configuration for MCP gateway risks, producing readiness scores and connection recommendations via CLI or MCP. It does not execute target code; a green result cannot guarantee publisher trust or runtime safety.

Veris models code changes and their affected behaviors, then reports risks and available verification evidence through CLI and MCP. It needs Git history and a real comparison baseline; it does not execute tests or prove runtime correctness.

Signalint runs and caches JavaScript/TypeScript diagnostics, clusters repeated issues and tracks recurring diagnostic loops through MCP. It requires a supported Node.js version and project tools; TypeScript checks need tsconfig.json and other languages are unsupported.

SpecShield MCP Server sends API specifications to the SpecShield backend for breaking-change comparison, deployment-risk decisions, migration guides and release notes. It is read-only and does not deploy or modify code. Node.js 20 or later and an API key are required; governance review needs a paid plan, and spec analysis is not a runtime guarantee.

mcp-code-sanitizer sends code to Groq for reviews, version comparisons, explanations and test drafts through MCP, with file analysis and HTML reports. It requires a Groq API key and remote service access. Scores and suggested fixes are model outputs requiring review; they do not prove security or that generated tests pass.

Repo Forensics scans agent repositories, skills, plugins and MCP servers locally for suspicious code and supply-chain indicators, producing severity-ranked reports and optional hooks. Feed refresh uses the network although scanning can run offline. A clean report is not proof of safety; its noncommercial license has a limited small-business exception.

The public lite scanner flags agent configuration, sensitive-file names and risky command patterns in a local repository before agent use. It is a review aid, not a sandbox or security audit; fuller scanners and guardrail materials are sold separately.

Coding-agent skills with an optional local review runner that preserves findings and Git targets and caps review attempts. Requires Bash, Git, Python and a coding-agent executor; intended for a trusted single-maintainer host, not a merge gate.

JevLint sends selected source files and plugin rules to TypeSafe Jev to score semantic lint violations. It requires Node.js 24 or later and service credentials, and reports at file level without line diagnostics or autofixes. Dry-run skips Jev calls but still loads plugins with normal Node.js permissions.

Runnable rule-based linters for configuration, security and compliance checks via MCP, CLI and CI. Local text/file checks are free; workspace scans and CI reporting require a paid license. Source-available, not a compliance certification.

Local quality gate for Bazel monorepos, combining analyzer results, coverage and architecture checks against a baseline. Exposes CLI and MCP tools and requires a Bazel 8+ bzlmod workspace.

GitHub Action that applies configurable rules to agent context files, checking exposed keys, structure and vague or conflicting instructions. Rule-based findings do not guarantee secure or correct agent behavior.

A harness for documenting business decisions and auditing code changes against them, using Git diff rules, an audit chain, and snapshots.

Cynative provides security agents for auditing cloud, code, and runtime infrastructure through read-only access, supporting AWS, GCP, Azure, Kubernetes, GitHub, and GitLab.

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents. It supports parallel scanning, PR diff review, and CI/CD integration.

OpenCodeReview is an AI-powered code review CLI from Alibaba with deterministic pipelines + LLM agent, line-level precision, and built-in security rulesets (NPE, thread-safety, XSS, SQL injection).

API governance server that detects breaking changes in OpenAPI specs

AI code quality gate detecting hallucinated packages, phantom dependencies, stale APIs, and AI-specific code defects.

An opinionated AI code reviewer with 6-layer deep review and Devil's Advocate mode.

Multi-perspective architecture review for AI-assisted development using expert viewpoints.

Semgrep Pro Rules to ensure code using LLMs follows best practices.