Trending on GitHub

Alibaba has open-sourced its internal AI code review CLI, which combines deterministic static analysis pipelines with LLM agents to identify millions of defects at scale. The tool supports OpenAI and Anthropic endpoints, offering precise line-level comments across multiple languages while enforcing built-in rulesets for critical issues like SQL injection and thread safety. It is designed for rapid integration by simply configuring a model endpoint to analyze Git diffs.

• Hybrid architecture merges deterministic security rules with LLM reasoning for higher precision.
• Validated at Alibaba's scale, targeting NPE, XSS, and SQL injection vulnerabilities.
• CLI-based workflow simplifies integration into existing CI/CD pipelines via Git diffs.
• Supports major model providers including OpenAI and Anthropic for flexibility.

Cloudflare has released a coding-agent skill that transforms AI agents into structured security auditors. The tool orchestrates isolated sub-agents through six phases, including reconnaissance, coverage-led hunting, and independent verification of findings. It serves as the single-repo starting point for the multi-stage vulnerability discovery harness previously described in a Cloudflare blog post.

• Orchestrates multiple isolated agents to handle distinct audit phases like recon and validation.
• Generates machine-readable, independently verified findings for structured reporting.
• Provides a modular entry point for building custom vulnerability discovery harnesses.
• Focuses on deterministic coverage and mapping trust boundaries before hunting for issues.