Packages
Lints, verifies, and gates plugins, skills, MCP servers, and packages in CI workflows to detect security risks before release.
Install it if you maintain plugins, skills, or MCP servers and want automated security gating before release.
Scans uv.lock, pylock.toml, and requirements.txt files for known vulnerabilities in PyPI dependencies by querying the PyPI API.
njsscan is a static application security testing (SAST) tool that finds insecure code patterns in Node.js applications using pattern matching and semantic code analysis.
Formats, validates, and checks SQL SELECT statements for syntactic and semantic correctness, with command-line and Python API interfaces.
Validates that `__slots__` are correctly implemented across class hierarchies, detecting overlapping slots, inheritance errors, and duplicate slot definitions by running and inspecting your code.
clangd-tidy wraps clangd to provide faster static analysis of C++ code as a drop-in replacement for clang-tidy, leveraging clangd's speed while maintaining compatibility with existing build systems and CI scripts.
Provides core configuration and SDK infrastructure for building test reporters that integrate with Qase TestOps, supporting single-project, multi-project, and local reporting modes.
Translates pylint's bit-encoded exit codes into scripting-friendly return codes (0 or 1) for use in shell scripts and CI pipelines.
However, it is abandoned (last release 2020-07-15) and will not receive updates; verify it works with your pylint version before relying on it in production automation.
Converts Bandit security analysis output into SARIF 2.1.0 format for integration with tools and workflows that consume standardized security reports.
Prevents unintended database queries in Django views and serializers by enforcing explicit query execution zones through context managers and decorators.
Beautysh automatically formats and beautifies Bash shell scripts with configurable indentation, function styles, and variable formatting, handling complex Bash syntax including here-docs and special cases.
A standalone CLI linter that enforces keyword arguments in Python function calls, with automatic rewriting support for positional arguments.
A pytest plugin that adds benchmarking capabilities for CodeFlash's automatic code performance optimization pipeline.
However, verify the license terms first, and confirm that the plugin's benchmarking output meets your performance measurement needs before committing to it in…
Runs the Clang static analyzer on C/C++ projects using a compilation database and generates HTML or plist reports of potential bugs without modifying the build.
Install it if you need to run Clang static analysis on C/C++ projects with a compilation database.
A mypy plugin that enforces keyword-argument-only calls to functions, rejecting positional and mixed argument styles during type checking.
Runtime validation of Python objects against type hints, with three speed tiers: one-off checks, cached validators, and compiled validators optimized to near hand-written performance.
SlipCover is a fast code coverage tool that tracks which parts of a Python program execute and which don't, using just-in-time bytecode instrumentation or the sys.monitoring API to minimize runtime overhead.
Install it if coverage speed matters to your workflow; skip it only if you have no coverage requirement or are already satisfied with your current tool's performance.
Detects import cycles in Python projects by walking packages, collecting modules, extracting imports via ast, and computing cycles to identify structural weak points.
Integrates Robot Framework test execution with Allure Report, capturing test results and generating detailed HTML reports with steps, attachments, and test history.
Install it if you use Robot Framework and want rich, interactive test reporting; skip it only if you have no need for Allure's reporting features.
Automatically reorders Python imports into a standardized format (stdlib, third-party, first-party) using static analysis, with one import per line to reduce merge conflicts.
Detects and logs blocking I/O and CPU calls in asyncio code using Python's sys.audit hooks, helping you identify where your event loop is being frozen.
flux-local provides CLI tools and a Python library to validate Flux GitOps repositories locally by building and diffing Kubernetes manifests without requiring a live cluster.
Install only if you are maintaining existing flux-local code and cannot migrate immediately.
Generates default "unknown" status results for test cases that don't run, so they appear in Allure Report instead of being omitted entirely.
However, verify the current license status before use, and confirm that the "unknown" status integration with allure-pytest has been implemented (the package notes it…
A runtime type-checking decorator that validates function arguments against their type annotations and raises TypeMismatch on mismatch, with dedicated async support and mypyc compilation for performance.
gersemi is a command-line formatter for CMake code that automatically reformats CMakeLists.txt and .cmake files to a consistent style, with support for custom command definitions and configurable formatting rules.
Install it if you maintain CMake code and want automated, configurable formatting.
A flake8 plugin that detects unintended one-element tuples in Python code, flagging them with warning T801.
However, be aware that it is abandoned and may not work with very recent Python or flake8 versions—test it in your environment first.
mobsfscan is a static analysis tool that detects insecure code patterns in Android and iOS source code, supporting Java, Kotlin, Swift, Objective-C, and Android XML files.
Install it if you develop mobile apps and want automated pattern-based vulnerability detection integrated into your workflow.
A Jupyter Notebook and JupyterLab extension that automatically formats Python code cells using Black after they are run.
However, note that the project is dormant (last release 2024-08-30); if you need active maintenance or encounter compatibility issues with newer versions, you may…
Validates Kubernetes resource definitions against official Kubernetes JSON schemas, reporting schema mismatches and type errors.
A pytest plugin that reports test results to Qase TestOps, linking automated tests to test cases and capturing metadata, attachments, and step-level details.
Install it if you use pytest and need to report results to Qase TestOps or want centralized test observability.
Detects N+1 query problems in Django applications by monitoring database queries during web requests, Celery tasks, and tests, with configurable thresholds and allowlisting.
yesqa automatically removes unnecessary `# noqa` comments from Python code, detecting and cleaning up suppressions that no longer apply due to configuration changes, code modifications, or mistakes.
A flake8 plugin that detects overly broad exception handlers—bare except: statements and catch-all except Exception: blocks—flagging them as B901 and B902 respectively.
However, do not install if you require active maintenance or compatibility with very recent Python versions—test thoroughly first, since the package is abandoned and…
Provides type annotations for the geopandas library, enabling static type checkers like mypy and pyright to validate code that uses geopandas.
Flawfinder scans C/C++ source code to identify potential security flaws and ranks them by likely severity.
Tower is a CLI and Python runtime for deploying Python data apps, pipelines, and AI agents to production with built-in orchestration, analytical storage, and multi-tenant APIs.
A pytest plugin that links test cases to JIRA tickets, allowing tests to be skipped or marked as expected failures based on ticket status without creating or closing tickets.
However, the GPL-2.0-only copyleft license means proprietary projects must either dual-license or avoid it.
A flake8 plugin that enforces the use of the spec or spec_set argument when creating mock objects, helping catch bugs from incorrectly specified mocks.
However, be aware that it is abandoned and will not receive updates or bug fixes—if you encounter issues with newer versions of flake8 or Python, you will need to…
Mailosaur is a Python client library for automating email and SMS testing, letting you retrieve and inspect messages sent to test inboxes as part of CI/CD workflows.
Install it if you need to automate email or SMS verification in your test suite.
A JupyterLab plugin that integrates code formatters directly into the notebook interface, allowing you to format code cells with a single action.
Install it if you regularly work in JupyterLab and want in-notebook formatting without context-switching—just remember to restart JupyterLab after setup and install…