OSS Scanner

OpenSSF Scorecard is an open-source security assessment tool developed as part of the Open Source Security Foundation. It evaluates open-source projects and dependencies for software supply-chain risks through automated checks covering source code, build processes, dependencies, testing, and project maintenance. Each check produces a score and risk level, which are combined into an aggregate security-posture score with remediation guidance. Scorecard can run automatically through a GitHub Action on repositories a user controls or manually through its command-line interface, which can assess other repositories and allows users to select checks and control result detail.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

oss-pr-reviewer is an AI-powered command-line tool for reviewing GitHub pull requests and producing structured Markdown or JSON reports for maintainers. It fetches pull-request metadata and changed-file patches with Octokit, normalizes reviewable content, skips binary, patchless, truncated, and oversized files with explanations, and splits large text diffs into deterministic batches without cloning or executing the repository code. The tool sends batched changes to OpenAI for structured findings, validates responses with Zod, then merges, deduplicates, orders, and filters findings by severity. It can apply repository-specific review rules and ignored paths from a trusted base-branch `.oss-pr-reviewer.yml` file, retry transient GitHub and OpenAI failures, and optionally publish bounded advisory reports through GitHub Actions. It requires Node.js 20 LTS or newer and, according to the repository, is run from a checkout because its package-ready release is not yet published to npm.

ODS is a self-hosted local AI server stack developed by Osmantic for Linux, Windows with WSL2 and Docker Desktop, and Apple Silicon macOS. Its installers detect the host hardware, select an installable model, generate credentials, and launch a preconfigured stack containing local LLM inference, Open WebUI, a management dashboard, LiteLLM, embeddings, speech-to-text, text-to-speech, agents, n8n workflows, Qdrant-based RAG, search, ComfyUI image generation, and operational and privacy tools. Local mode is the default; cloud and hybrid modes can route through OpenAI, Anthropic, or Together APIs. The stack uses a bootstrap model so chat can begin while the hardware-selected full model downloads in the background. A manifest-based extension system discovers service folders and merges their Docker Compose definitions into the stack, while the `ods` CLI manages services, models, modes, configuration, presets, and lifecycle operations. The repository documents GPU and unified-memory paths for NVIDIA, AMD, Intel Arc, and Apple Silicon hardware, along with model selection, recovery, validation, and operator workflows. ODS is distributed as an Apache-2.0-licensed open-source repository and can be installed with shell or PowerShell installers. The repository identifies version 2.6.0 as its stable release and states that no cloud account or subscription is required for local operation.

Open Code Review is an open-source, AI-powered command-line code-review tool developed from Alibaba Group’s internal review assistant. It reads Git diffs and sends changed files to a configurable LLM through an agent with tool-use capabilities; the agent can read complete files, search the repository, and inspect other changed files for context before producing structured comments tied to source lines. Its hybrid architecture combines deterministic engineering with dynamic agent decisions: deterministic stages select and bundle files, match rules to file characteristics, and apply independent comment-positioning and reflection modules, while scenario-specific prompts and tools guide context retrieval and review. The `ocr scan` command audits complete files or directories without requiring a meaningful diff, and the project provides multilingual rules for issues including null-pointer exceptions, thread safety, cross-site scripting, and SQL injection. It supports configurable model endpoints, including OpenAI- and Anthropic-compatible endpoints, and requires Git 2.41 or newer.