Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
| Date | Stars |
|---|---|
| 2026-07-31 | 482 |
| 2026-08-05 | 482 |
| 2026-08-06 | 482 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
60.0
growth rate 0.00%/day
[](https://mcptoplist.com/server/io.github.duriantaco%2Fskylos)
<div align="center">
<img src="assets/DOG_1.png" alt="Skylos" width="260">
<h1>Skylos</h1>
<h3>Open-source, local-first checks for dead code, security issues, secrets, quality regressions, and AI-code mistakes before merge.</h3>
</div>
[](https://codecov.io/gh/duriantaco/skylos)
[](https://pypi.org/project/skylos/)
[](#star-authenticity-audit)
[](https://discord.gg/Ftn9t9tErf)
[Website](https://skylos.dev) |
[Docs](https://docs.skylos.dev) |
[Repo Map](https://duriantaco.github.io/skylos/repo-map/) |
[Quick Start](https://docs.skylos.dev/quick-start) |
[GitHub Action](./action.yml) |
[VS Code Extension](./editors/vscode/README.md) |
[Real-World Results](./REAL_WORLD_RESULTS.md) |
[Benchmarks](./BENCHMARK.md) |
[Roadmap](./ROADMAP.md) |
[Contributing](./CONTRIBUTING.md)
**English** | [Deutsch](./docs/i18n/README.de.md) | [简体中文](./docs/i18n/README.zh-CN.md) | [Translations](./docs/i18n/README.md)
## What Is Skylos?
Skylos is an open-source static analysis CLI for Python, TypeScript,
JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment config. It
runs locally by default and can also be used as a CI/CD PR gate.
Use Skylos when you want one command to check a repo or pull request for:
- dead code and unused files
- security flaws and dangerous data flows
- secrets and dependency CVEs
- CI/CD and edge-device deployment misconfigurations
- quality regressions such as complexity, duplicate branches, and deep nesting
- common AI-generated code mistakes, including missing guards, fake helpers,
invented package APIs, and impossible dependency versions
- LLM app risks such as unsafe tool use and missing output validation
## Start In 60 Seconds
```bash
pip install skylos
skylos .
```
The default scan focuses on dead code. Add security, secrets, quality,
dependency, and AI-defect checks with `-a`:
```bash
skylos . -a
```
Run only evidence-backed AI defect checks with:
```bash
skylos . --ai-defects
```
Verify a changed file or range before an agent hands it to review:
```bash
skylos verify . --file src/app.py --range 40:75 --project-context
```
`skylos verify` schema version 2 returns `pass`, `fail`, or `incomplete`.
`incomplete` means a requested proof could not be established, such as a
third-party TS/JS import, computed namespace member, unsupported language-local
API check, or parser surface that Skylos could not prove; it exits `2` unless
`--no-fail` is set. The `coverage` object lists detected languages, expected
checks, language support, missing checks, completed/skipped checks, checked
references, and deterministic skip reasons.
Deterministic local/workspace API verification currently covers Python,
TypeScript/JavaScript, Go, and Java without executing target code. PHP, Rust,
Dart, C#, Kotlin, and Shell retain their existing static-analysis coverage,
but their local API proof is reported as unsupported and therefore incomplete.
See [AI Code Verification Coverage](./docs/ai-code-verification.md).
Create a local AI hallucination contract for repo-specific generated-code
truth. `skylos verify` auto-discovers `.skylos/ai-contract.yml`:
```bash
skylos contract init
skylos contract inspect
skylos verify .
```
Test a running agent against determiniExcerpt of 35,160 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:6e0e7431f6a88143, llm:Repository description: 'Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge.' Topics include ai-agents, ai-code-review, ai-generated-code, code-quality, code-scanning, devsecops, sast, static-analysis, prompt-injection, python-security, github-actions, etc.
matched fp:6e0e7431f6a88143, llm:Repository description: 'Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge.' Topics include ai-agents, ai-code-review, ai-generated-code, code-quality, code-scanning, devsecops, sast, static-analysis, prompt-injection, python-security, github-actions, etc.
matched fp:6e0e7431f6a88143, llm:Repository description: 'Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge.' Topics include ai-agents, ai-code-review, ai-generated-code, code-quality, code-scanning, devsecops, sast, static-analysis, prompt-injection, python-security, github-actions, etc.