Google OSS VRP

OSS Scanner is an Anthropic service that scans enrolled critical open-source repositories for security vulnerabilities. Maintainers enroll a project by opening a pull request that adds a project directory with a configuration file and Dockerfile; the Dockerfile sets up dependencies and builds the project, initially with network access enabled. After the build, the project is moved into an isolated virtual machine with Internet access disabled for the security analysis. Findings are emailed to the configured contacts with reproduction steps and, where available, a proposed patch. Reports are model-generated and are not reviewed by a human. The repository includes validation and local-checking tools for testing the build and no-network audit environment before enrollment.

Open Code Review is an open-source, AI-powered command-line code-review tool developed from Alibaba Group’s internal review assistant. It reads Git diffs and sends changed files to a configurable LLM through an agent with tool-use capabilities; the agent can read complete files, search the repository, and inspect other changed files for context before producing structured comments tied to source lines. Its hybrid architecture combines deterministic engineering with dynamic agent decisions: deterministic stages select and bundle files, match rules to file characteristics, and apply independent comment-positioning and reflection modules, while scenario-specific prompts and tools guide context retrieval and review. The `ocr scan` command audits complete files or directories without requiring a meaningful diff, and the project provides multilingual rules for issues including null-pointer exceptions, thread safety, cross-site scripting, and SQL injection. It supports configurable model endpoints, including OpenAI- and Anthropic-compatible endpoints, and requires Git 2.41 or newer.

OpenGrok is a Java-based source code search, browsing, and cross-reference engine developed by Oracle. It indexes source trees so users can search and navigate code, understand various programming-language file formats, and cross-reference version-control histories from multiple source-code management systems. It can be deployed as a web application or run in a Docker container. The project is distributed under the license stated in its repository and uses semantic versioning; major and minor updates may require reconfiguration or a full reindex, while micro updates require redeploying the web application.

Vals is a code-generation evaluation product that uses a company's GitHub codebase to build an internal coding benchmark. It evaluates coding models and agents against private, continuously evolving tasks to identify which systems perform best on the company's work and which offer the strongest return on investment. The platform is also described as supporting pre-release testing and evaluation of agentic coding work that may unfold over hours, days, or weeks, while accounting for factors such as token cost and latency.

oss-pr-reviewer is an AI-powered command-line tool for reviewing GitHub pull requests and producing structured Markdown or JSON reports for maintainers. It fetches pull-request metadata and changed-file patches with Octokit, normalizes reviewable content, skips binary, patchless, truncated, and oversized files with explanations, and splits large text diffs into deterministic batches without cloning or executing the repository code. The tool sends batched changes to OpenAI for structured findings, validates responses with Zod, then merges, deduplicates, orders, and filters findings by severity. It can apply repository-specific review rules and ignored paths from a trusted base-branch `.oss-pr-reviewer.yml` file, retry transient GitHub and OpenAI failures, and optionally publish bounded advisory reports through GitHub Actions. It requires Node.js 20 LTS or newer and, according to the repository, is run from a checkout because its package-ready release is not yet published to npm.