Dev tools · alternatives · 2026
24 alternatives to Contract-Guard
Free and local code, config, dependency and security scanner
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
- 2CG
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code…
2023 · its alternatives →
- 3
Codex▲247Discuss and understand your code base from within your IDE
2022 · usecodex.com · its alternatives →
- 4
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev · its alternatives →
- 5
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 6FL
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40%…
2025 · its alternatives →
- 7
aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.
2015 · appcanary.com · its alternatives →
- 8
GitGuardian▲132Detect secrets in source code, public and private!
2018 · gitguardian.com · its alternatives →
- 9
Vyper Guard ▲6Open-Source Security for Vyper Contracts
Jul 2026 · vyper-web.vercel.app · its alternatives →
- 10
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com · its alternatives →
- 11
- 12
Learn more about Snyk’s security plugins for JB, VS Code, Eclipse, and Visual Studio that provide real-time vulnerability scanning and actionable fix advice.
2020 · snyk.io · its alternatives →
- 13
Open sourced application to detect security vulnerabilities.
2020 · github.com · its alternatives →
- 14
CommitGuard▲18Hi HN, I’m experimenting with commit-based code review as an alternative to PR-based review. Instead of analyzing large PR diffs, this reviews each commit incrementally, while context is still fresh. It’s fully configurable and intentionally low-noise, high signal - focused on catching issues that tend to slip through and compound over time. The goal isn’t to replace CI or PR review, but to move some feedback earlier: risky changes hidden in small diffs architectural or consistency drift performance or security footguns Happy to answer questions
Jan 2026 · commitguard.ai · its alternatives →
- 15
Automated security assistant for developers
2020 · shieldfy.io · its alternatives →
- 16
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 17
- 18
Instant AI legal analysis for founders & freelancers
May 2026 · ai-contract-risk-analyzer-ncxs.vercel.app · its alternatives →
- 19
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code
Dec 2025 · github.com · its alternatives →
- 20
Turn complex contracts into instant clarity
Nov 2025 · app.contractguardhq.com · its alternatives →
- 21
- 22
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
- 23
- 24
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →