Find dead code, secrets, and exploitable flows in Python, TypeScript, and Go.
Skylos: Dead Code and Security PR Gate for Modern Codebases
Find dead code, secrets, and exploitable flows in Python, TypeScript, and Go. Add a pull request gate in minutes.
📖 Website · Documentation · Blog · VS Code Extension
What is Skylos?
Skylos is a local-first scanner for Python, TypeScript, and Go that helps teams catch dead code, secrets, and exploitable flows before they land in main.
The core use case is straightforward: run it locally, add it to CI, and gate pull requests on real findings with GitHub annotations and review comments. Advanced features like AI defense, remediation agents, VS Code, MCP, and cloud upload are available, but you do not need any of them to get value from Skylos.
Start here
| Goal | Command | What you get |
|---|---|---|
| Scan a repo | skylos . -a |
Dead code, risky flows, secrets, and code quality findings |
| Gate pull requests | skylos cicd init |
A GitHub Actions workflow with a quality gate and inline annotations |
| Audit an LLM app | skylos defend . |
Optional AI defense checks for Python LLM integrations |
Why teams adopt it
- Better dead code signal on real frameworks: Skylos understands FastAPI, Django, Flask, pytest, Next.js, React, and more, so dynamic code produces less noise.
- One workflow instead of three tools: Dead code, security scanning, and PR gating live in the same CLI and CI flow.
- Local-first by default: You can keep scans on your machine and add optional AI or cloud features later if you need them.
Why Skylos over Vulture?
| Skylos | Vulture | |
|---|---|---|
| Recall | 98.1% (51/52) | 84.6% (44/52) |
| False Positives | 220 | 644 |
| Framework-aware (FastAPI, Django, pytest) | Yes | No |
| Security scanning (secrets, SQLi, SSRF) | Yes | No |
| AI-powered analysis | Yes | No |
| CI/CD quality gates | Yes | No |
| TypeScript + Go support | Yes | No |
Benchmarked on 9 popular Python repos (350k+ combined stars) + TypeScript (consola). Every finding manually verified. Full case study →
🚀 **New to Skylos? Start with CI/CD Integration**
# Generate a GitHub Actions workflow in 30 seconds
skylos cicd init
# Commit and push to activate
git add .github/workflows/skylos.yml && git push
What you get:
- Automatic dead code detection on every PR
- Security vulnerability scanning (SQLi, secrets, dangerous patterns)
- Quality gate that fails builds on critical issues
- Inline PR review comments with file:line links
- GitHub Annotations visible in the "Files Changed" tab
No configuration needed - works out of the box with sensible defaults. See CI/CD section for customization.
Tools (2)
scanScans the codebase for dead code, security vulnerabilities, and quality issues.defendPerforms AI defense checks for Python LLM integrations.Configuration
{"mcpServers": {"skylos": {"command": "skylos", "args": ["mcp"]}}}