Add it to Claude Code
claude mcp add skylos -- skylos mcpMake your agent remember this setup
skylos's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session.
npx conare@latestFree · one command · indexes the sessions already on disk. Set up in the browser instead →
What it does
- Detects dead code in Python, TypeScript, and Go projects
- Identifies security vulnerabilities like SQLi and hardcoded secrets
- Framework-aware analysis for FastAPI, Django, pytest, and Next.js
- Provides AI-powered analysis and remediation suggestions
- Supports CI/CD integration with quality gates and PR annotations
Tools 2
scanScans the codebase for dead code, security vulnerabilities, and quality issues.defendPerforms AI defense checks for Python LLM integrations.Try it
Original README from duriantaco/skylos
📖 Website · Documentation · Blog · VS Code Extension
What is Skylos?
Skylos is a local-first scanner for Python, TypeScript, and Go that helps teams catch dead code, secrets, and exploitable flows before they land in main.
The core use case is straightforward: run it locally, add it to CI, and gate pull requests on real findings with GitHub annotations and review comments. Advanced features like AI defense, remediation agents, VS Code, MCP, and cloud upload are available, but you do not need any of them to get value from Skylos.
Start here
| Goal | Command | What you get |
|---|---|---|
| Scan a repo | skylos . -a |
Dead code, risky flows, secrets, and code quality findings |
| Gate pull requests | skylos cicd init |
A GitHub Actions workflow with a quality gate and inline annotations |
| Audit an LLM app | skylos defend . |
Optional AI defense checks for Python LLM integrations |
Why teams adopt it
- Better dead code signal on real frameworks: Skylos understands FastAPI, Django, Flask, pytest, Next.js, React, and more, so dynamic code produces less noise.
- One workflow instead of three tools: Dead code, security scanning, and PR gating live in the same CLI and CI flow.
- Local-first by default: You can keep scans on your machine and add optional AI or cloud features later if you need them.
Why Skylos over Vulture?
| Skylos | Vulture | |
|---|---|---|
| Recall | 98.1% (51/52) | 84.6% (44/52) |
| False Positives | 220 | 644 |
| Framework-aware (FastAPI, Django, pytest) | Yes | No |
| Security scanning (secrets, SQLi, SSRF) | Yes | No |
| AI-powered analysis | Yes | No |
| CI/CD quality gates | Yes | No |
| TypeScript + Go support | Yes | No |
Benchmarked on 9 popular Python repos (350k+ combined stars) + TypeScript (consola). Every finding manually verified. Full case study →
🚀 **New to Skylos? Start with CI/CD Integration**
# Generate a GitHub Actions workflow in 30 seconds
skylos cicd init
# Commit and push to activate
git add .github/workflows/skylos.yml && git push
What you get:
- Automatic dead code detection on every PR
- Security vulnerability scanning (SQLi, secrets, dangerous patterns)
- Quality gate that fails builds on critical issues
- Inline PR review comments with file:line links
- GitHub Annotations visible in the "Files Changed" tab
No configuration needed - works out of the box with sensible defaults. See CI/CD section for customization.