Dev tools · alternatives · 2026
24 alternatives to I built a PR listener and ruleset to detect malicious code in CI/CD
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
PRevent is a GitHub app that scans pull requests to detect malicious code and can notify or block them. It includes a companion Semgrep ruleset for detecting malicious patterns at any stage of CI/CD pipelines. The tool… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
GitHub▲13Prevent merging of malicious code in pull requests and CI/CD
2025 · github.com · its alternatives →
- 2
We needed something like --dangerously-skip-permissions that doesn’t nuke your untracked files, exfiltrate your keys, or install malware. Claude Code's permission system is allow-or-deny per tool, but that doesn’t really scale. Deleting some files is fine sometimes. And git checkout is sometimes not fine. Even when you curate permissions, 200 IQ Opus can find a way around it. Maintaining a deny list is a fool's errand. nah is a PreToolUse hook that classifies every tool call by what it actually does, using a deterministic classifier that runs in milliseconds. It maps commands to action types…
Mar 2026 · github.com · its alternatives →
- 3
- 4
0github.com is a pull request viewer that color-codes every diff line/token by how much human attention it probably needs. Unlike PR-review bots, we try to flag not just by "is it a bug?" but by "is it worth a second look?" (examples: hard-coded secret, weird crypto mode, gnarly logic, ugly code). To try it, replace github.com with 0github.com in any pull-request URL. Under the hood, we split the PR into individual files, and for each file, we ask an LLM to annotate each line with a data structure that we parse into a colored heatmap. Examples:…
Oct 2025 · 0github.com · its alternatives →
- 5
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com · its alternatives →
- 6
When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a…
2025 · github.com · its alternatives →
- 7
- 8
GitGuardian▲132Detect secrets in source code, public and private!
2018 · gitguardian.com · its alternatives →
- 9
SafeDep Vet▲72GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
- 10
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code
Dec 2025 · github.com · its alternatives →
- 11
Hey HN, We’re two developers (co-founders) with a team of 20 who got tired of spending hours reviewing PRs, so we built Infinitcode.ai, an AI-powered code reviewer that: - *Summarizes PRs in plain English*: No more deciphering 1,000-line diff jungles - *Catches more than bugs*: Security holes, performance pitfalls, code smells, even typos (yes, we’ll flag “vurnerabilities” and vulnerabilities) - *Zero onboarding*: Works instantly—no “let me learn your codebase for weeks” nonsense. Why we’re posting: We’re in alpha and need brutal honesty. Roast our tool, mock our UI, or tell us why AI will…
2025 · infinitcode.ai · its alternatives →
- 12
aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.
2015 · appcanary.com · its alternatives →
- 13SASemgrep App▲79
https://semgrep.dev/products/semgrep-app Hi! I work on Semgrep, an open-source project (discussed on HN previously [0][1)]. We’re one of those companies that maintain an OSS tool and a web app, and then monetize by selling enterprise features on said web app. Our free web app just went through a major revamp (sort of like a v1.0 release) so this feels like the perfect time to share and hear what the HN crowd thinks! Let me start with some backstory on Semgrep. Our team, r2c, has been experimenting with various ways to help organizations step up their application security…
2021 · its alternatives →
- 14
- 15GM
2017 · gitmonkey.io · its alternatives →
- 16
- 17
Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
2025 · github.com · its alternatives →
- 18
Dastardly▲57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
- 19
:cop: GitHub Bot For Validating Pull Request Mergability Requirements and Issues Structure - Schachte/Git-Enforcer
2018 · github.com · its alternatives →
- 20
We now write most of our code with agents. For a while, PRs piled up, causing review fatigue, and we had this sinking feeling that standards were slipping. Consistency is tough at this volume. I’m sharing the solution we found, which has become our main product. Continue (https://docs.continue.dev) runs AI checks on every PR. Each check is a source-controlled markdown file in `.continue/checks/` that shows up as a GitHub status check. They run as full agents, not just reading the diff, but able to read/write files, run bash commands, and use a browser. If it finds…
Feb 2026 · docs.continue.dev · its alternatives →
- 21IB
I've been using Claude Code heavily, and kept hitting the same issue: the agent would push changes, respond to reviews, wait for CI... but never really know when it was done. It would poll CI in loops. Miss actionable comments buried among 15 CodeRabbit suggestions. Or declare victory while threads were still unresolved. The core problem: no deterministic way for an agent to know a PR is ready to merge. So I built gtg (Good To Go). One command, one answer: $ gtg 123 OK PR #123: READY CI: success (5/5 passed) Threads: 3/3 resolved It aggregates CI status, classifies review comments…
Jan 2026 · dsifry.github.io · its alternatives →
- 22
AttackerView▲13Last week I wrote about building a scanner that writes its own exploits. A cron job runs Claude Code every night, it reads new CVEs, writes proof-of-concept checks, tests them against vulnerable and patched Docker instances, and opens PRs. I review and merge in the morning. That post was about how t
Feb 2026 · attackerview.com · its alternatives →
- 23WG
For the past month, we've been monitoring GitHub's public event stream to catch spam comments and fake stars. Today, the spammers are back. Go check out the damage! You can see the spam comments and which users are posting the spam in real time. Also, here's a post we wrote about how we set it up: https://www.trytrench.com/blog/preventing-spam-and-fake-star...
2024 · play.trytrench.com · its alternatives →
- 24IB
2024 · securelog.com · its alternatives →
Also compare
- GitHub alternatives
- A context-aware permission guard for Claude Code alternatives
- Warestack alternatives
- I made a heatmap diff viewer for code reviews alternatives
- MCP-Shield – Detect security issues in MCP servers alternatives
- CLI that spots fake GitHub stars, risky dependencies and licence traps alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →