» Tag
static-analysis
27 postsClaude Code Review Token Bills Cut 8-49x With Tree-sitter Call Graphs
A Tree-sitter call-graph blast-radius technique cuts Claude Code review token bills 8-49x, plus three traps that can silently erase the savings.
Rethinking MCP Security: A Large-Scale Study of 64K Runtime Servers
MCPZoo tests 64,611 MCP servers, revealing that most security scanner alerts are false positives and scanners disagree widely.
Rust Moves Toward Stabilizing Polonius Alpha Borrow Checker
Rust's Polonius alpha borrow checker nears stabilization, fixing NLL limitations with new tests, a formal model, and performance validation.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comCodeCrucible: A Reusable Blueprint for LLM-Driven SAST
Block's CodeCrucible offers a reusable design blueprint for LLM-driven SAST, using whole-repo analysis instead of snippet-anchored vulnerability scanning.
Static Scanner Finds 30 Unguarded Destructive Actions in AI Agent Frameworks
An open-source scanner analyzed 25 AI agent frameworks and confirmed 30 cases where models can delete data, deploy, or send webhooks unauthorized.
Droidsaw: A Rust Tool for Byte-Perfect Android DEX/Hermes RE
Droidsaw is a Rust-based Android reverse engineering tool that reconstructs DEX and Hermes files byte-for-byte, with built-in security auditing.
Synapse Lets AI Flag False Positives, Never Delete Findings
Synapse's two-model AI triage flags false positives in security scans without deleting findings, preserving gate reliability and audit trails.
CodeEraser: A Deterministic Gate Against LLM-Induced Code Drift
CodeEraser is a deterministic, non-LLM tool that blocks duplicate code and stale docs in AI-assisted codebases at write time and in CI.
Epistemic Engine verifies AI code and predicts what will break
Epistemic Engine is an open-source Python tool that verifies AI-generated code and forecasts future failures using deterministic git-history analysis.
voidguard: A Static Scanner That Catches Tests That Verify Nothing
voidguard is an open-source static scanner that flags tests, type checks, and CI conditions that pass while verifying nothing.