# GitHub

Run GitHub Actions locally for fast feedback

Act is an open-source tool that runs GitHub Actions workflows locally using Docker containers that match GitHub's execution environment. It provides instant feedback on workflow changes without pushing to a repository, supports matrix builds, secret management, and artifact handling. Act can also replace Makefiles by using workflow files as task definitions, making it useful for both CI/CD development and local task automation across development teams.

Official MCP server for GitHub repo operations

GitHub MCP Server is the official Model Context Protocol server from GitHub that connects AI assistants to repositories, issues, pull requests, workflows, and code search. It exposes 100+ operations with toolset filtering, permission scoping, and audit logging, available in both remote-hosted and self-hosted Docker deployment modes.

AI-powered code review

AI-powered code review tool that automatically analyzes pull requests and provides line-by-line feedback on code quality, bugs, security vulnerabilities, and best practices. Integrates with GitHub and GitLab as a bot that comments on PRs. Uses LLMs to understand code context and suggest improvements. Learns from your codebase patterns and team preferences. Supports all major programming languages. Reduces review cycle time while catching issues human reviewers might miss.

Merge queue, CI insights, flaky-test controls, and stacked pull requests for GitHub teams

Mergify is a pull request automation platform that keeps main branches green with merge queue batching, merge protections, CI Insights, flaky-test detection, and stacked pull requests. Its Stacks workflow turns commits on one local branch into focused PR chains, helping teams review large AI-generated or feature-heavy changes without losing queue safety.

Unified code-to-cloud security platform for developers

Aikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.

AI code review with full codebase context

Greptile is a Y Combinator-backed AI code review tool that indexes your entire codebase to build a semantic code graph of functions, classes, and dependencies. Unlike diff-only reviewers, it catches cross-file issues, architectural drift, and convention violations with an 82% bug catch rate. Supports GitHub, GitLab, Jira, Slack, and VS Code. Offers cloud and self-hosted VPC deployment with SOC2 Type II compliance. Used by 250+ companies including Stripe and Amazon.

Automated code quality platform with AI autofix

DeepSource is a code quality, security, and AI review platform for repositories across GitHub, GitLab, Bitbucket, and Azure DevOps. It combines static analysis, SCA, coverage, license compliance, quality gates, Autofix, and AI Review. Team is listed at $24/user/month yearly; Open Source is limited to public repositories with 1,000 PR reviews/month, while AI Review/Autofix use credits or pay-as-you-go.

Secrets security and non-human identity governance across code, CI/CD, endpoints, CLI/IDE/API, and MCP workflows.

GitGuardian is a secrets security and non-human identity governance platform for finding, triaging, and remediating leaked credentials across repositories, CI/CD, developer endpoints, CLI/IDE workflows, APIs, and MCP-connected environments. It combines managed incident workflow with developer-side prevention, Endpoint Protection, and broader credential lifecycle governance.

Open-source secret detection for Git repositories

Gitleaks is an open-source secret scanner with 27K+ GitHub stars that detects hardcoded passwords, API keys, tokens, and private keys in Git repositories, files, directories, and full Git history. It integrates via GitHub Actions, pre-commit hooks, CI/CD pipelines, and single-binary local scans.

AI developer productivity platform with stacked PRs

Graphite is an AI-powered developer productivity platform that combines stacked pull requests with intelligent code review. Its AI agent catches real bugs with an under 3% unhelpful comment rate and offers one-click fixes directly in the PR flow. The stacked PR workflow breaks large changes into smaller, sequenced diffs that merge independently, keeping developers unblocked. Includes a stack-aware merge queue, CLI tool, VS Code extension, unified PR inbox, and deep GitHub integration.

Slack-native incident management with AI SRE agent

Incident.io is a Slack- and Microsoft Teams-native incident management platform with AI SRE investigation, on-call scheduling, status pages, and post-incident learning in one product. Vendor case studies cite Buffer reducing critical incidents by 70% and Favor reducing MTTR by 37%. It integrates with PagerDuty, Datadog, GitHub, Jira, and 100+ tools for incident response and operational workflows.

AI code review by Cursor with multi-pass parallel analysis

BugBot is Cursor's AI pull request review layer for teams that want automated PR comments, custom rules, learned repository standards, and agent-assisted fixes close to their coding environment. Current docs list GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Hosted, and Bitbucket Cloud setup paths. Pricing is usage-based, so Cursor-heavy teams should manage effort levels, privacy/storage settings, and review spend.

Google async coding agent for GitHub tasks, plans, and PRs

Jules is Google's async coding agent for GitHub repositories. Users start work from a prompt, GitHub issue label, scheduled task, or opt-in Suggested Task; Jules runs in a Google Cloud VM, proposes a plan, and opens PR-ready diffs. Free Jules offers 15 tasks/day and 3 concurrent tasks on Gemini 2.5 Pro; Pro/Ultra raise limits and start with Gemini 3 Pro access.

Managed SonarQube Cloud code quality and security analysis for CI/CD workflows.

SonarQube Cloud, still commonly associated with the SonarCloud name, is SonarSource’s managed code quality and security SaaS for GitHub, GitLab, Bitbucket, and Azure DevOps. It scans pull requests for bugs, vulnerabilities, security hotspots, code smells, duplication, and coverage regressions, then enforces Quality Gates without running SonarQube Server. Current Sonar docs frame the cloud service around 40+ languages, with Team from $32 monthly and Enterprise custom.

LLM evaluation and tracking with RAG triad metrics

TruLens is an open-source framework for evaluating and tracking LLM experiments with feedback functions, RAG triad metrics (answer relevance, context relevance, groundedness), and Honest/Harmless/Helpful evaluations. Features a unified Metric API for systematic evaluation of RAG pipelines and AI agents. 3,200+ GitHub stars, MIT licensed. Snowflake partnership adds enterprise integration. Supports LangChain, LlamaIndex, and custom LLM applications.

Cross-agent messaging for CLI coding agents

agmsg is an MIT-licensed Bash and SQLite messaging layer for CLI coding agents. It lets Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Antigravity, OpenCode, Hermes, and other terminal agents exchange messages through a shared local database instead of relying on a human copy-paste relay. It is intentionally not MCP, not a broker, and not a subagent framework.

Telemetry-aware AI code reviewer that checks how pull requests may affect real services.

Baz is an AI code-review platform focused on production-aware pull requests. Instead of only reading the diff, Baz connects code changes to application telemetry so reviewers can understand what endpoints, services, and runtime behavior may be affected. That makes it a useful complement to existing AI PR bots when the question is not just whether a change looks correct, but whether it could break a live system.

Autonomous Java unit test generation in CI

Diffblue Testing Agent orchestrates verified regression unit test generation for Java and Python projects through existing AI coding platforms such as GitHub Copilot CLI and Claude Code. It measures baseline coverage, generates tests, verifies that they compile and pass, and charges for net new coverage lines added rather than per seat or API call.

100% private document Q&A powered by local LLMs

PrivateGPT enables fully private document interaction using GPT-powered RAG without any data leaving your machine. Ingest documents (PDF, DOCX, TXT, and more) and chat with them using local LLMs via Ollama or remote providers. Built on LlamaIndex with Qdrant vector storage. 57,200+ GitHub stars, Apache 2.0 licensed. The go-to solution for air-gapped environments, regulated industries, and anyone who needs document Q&A without cloud data exposure.

Kubernetes-native testing for coding agents

Signadot is a Kubernetes-native validation platform that lets developers test agent-generated code in isolated preview environments mimicking production. It creates lightweight sandboxes within existing clusters where code changes can be validated against real microservice dependencies, ensuring that AI-generated modifications do not break cross-service interactions before merging to main.

Meta's open-source LLM security suite with Llama Guard and CodeShield

PurpleLlama is Meta's open-source suite of tools for evaluating and improving LLM safety. It includes Llama Guard models for input/output content safety classification, LlamaFirewall for multi-layer defense, CodeShield for insecure code detection, and CyberSecEval benchmarks for measuring LLM security. Llama Guard 4 supports multimodal safety across text and images. 4,100+ GitHub stars, backed by Meta AI with 44+ contributors.

GitHub Copilot in your terminal

Brings GitHub Copilot to the terminal, giving developers AI assistance for shell commands, error explanations, and code generation directly from the command line. Supports natural language queries to generate complex shell commands, explains error messages in plain English, and integrates with the broader GitHub Copilot ecosystem including model selection and premium request management.

Modern task queue and workflow orchestration built on PostgreSQL

Hatchet is an open-source task queue and workflow orchestration platform designed as a modern alternative to Celery and BullMQ. Built on PostgreSQL for durability, it handles background jobs, AI agent workflows, RAG pipelines, and GPU task scheduling with TypeScript and Python SDKs. YC W24 batch with 7,400+ GitHub stars, MIT licensed. Supports fan-out, rate limiting, retries, and real-time observability through a web dashboard.

Unified API, performance, and contract testing DSL

Karate is an open-source testing framework that unifies API testing, performance testing, UI automation, and contract testing in a single BDD-style DSL. Write tests in plain Gherkin-like syntax without any Java knowledge. Built-in assertions, data-driven testing, parallel execution, and HTML reports. 8,900+ GitHub stars, MIT licensed. Mature, actively maintained project with commercial support options for comprehensive API quality assurance.

Open-source AI-powered PR review with slash commands

PR-Agent by Qodo is the most widely adopted open-source AI code review tool with 11,500+ GitHub stars and 207 contributors. It provides automated PR description generation, intelligent line-by-line code review, and actionable improvement suggestions through intuitive slash commands like /describe, /review, and /improve, integrating natively with GitHub Actions, GitLab CI, Bitbucket, and Azure DevOps.

AI-powered pull request summaries and code review

WhatTheDiff is an AI tool that generates human-readable pull request summaries and suggests code improvements. It analyzes code diffs to explain what changed and why in plain language, helping reviewers understand PRs faster. Integrates with GitHub and supports automated refactoring suggestions through a /wtd command. Useful for teams wanting to improve PR review speed and maintain changelog quality.

AI-powered code review and refactoring assistant

Automated code reviewer that integrates with GitHub PRs. Detects code quality issues, suggests refactoring, and auto-generates reviews. Python specialist with growing JS/TS support and 1.8k+ GitHub stars. Enforces team coding standards consistently and helps developers learn best practices through inline suggestions on every pull request.

Agentic DevOps automation via ChatOps

Kubiya is an agentic automation platform for DevOps and platform teams that uses specialized agents with connectors for Kubernetes, AWS, GitHub, Jira, and Terraform to automate operational tasks through Slack or web portals. It provides Terraform module support for infrastructure-as-code configuration and manages agent behaviors with policy-based controls for enterprise-grade governance.

AI-native security for coding agents

Corridor is an AI-native security platform that intercepts vulnerabilities at the code generation layer, providing real-time guardrails and automated PR security reviews for teams using AI coding agents like Cursor, Claude Code, and GitHub Copilot. Founded by former CISA Secure by Design lead Jack Cable and backed by $25M Series A from Felicis at a $200M valuation, Corridor embeds proactive security context into developer workflows via MCP server integration.

AI coding agent for code review and bug fixing

Ellipsis is a YC W24-backed AI coding teammate for GitHub repositories that reviews pull requests, catches bugs, writes summaries, answers codebase questions, and generates tested fixes from comments or issues. It pairs automated review with code generation, $20/dev/month seat pricing, SOC 2 Type 1 controls, and no source-code persistence between workflows.

AWS managed AI code review for Java and Python

Amazon CodeGuru Reviewer is an AWS managed service that provides automated code analysis and recommendations on pull requests for Java and Python codebases. It integrates with GitHub, Bitbucket, and AWS CodeCommit, using machine learning trained on Amazon's internal code review practices to identify bugs, security vulnerabilities, and performance issues with IAM-based access control for enterprise governance.

AI security triage for small engineering teams

Amplify Security is an AI-native security tool designed for small-to-mid engineering teams that automates the triage of security alerts and integrates directly into GitHub and GitLab workflows. It specifically addresses alert fatigue by using AI to prioritize high-risk findings over low-severity noise, offering a free tier for small teams that makes developer-first security accessible without enterprise budgets.

Visual regression testing for CI/CD pipelines

Argos CI is a visual regression testing platform that automatically catches unintended UI changes in CI/CD pipelines. It integrates with Playwright, Cypress, Storybook, and Puppeteer, featuring a stabilization engine that filters flaky pixel differences from genuine regressions. Used by teams at Meta and MUI for frontend quality gates.

Developer productivity platform with merge queues and flaky test detection

Aviator is a developer productivity platform combining merge queues, stacked PRs, automated code review, and flaky test management. Its merge queue prevents broken main branches by testing PRs in order before merging. Flaky test detection identifies unreliable tests causing CI failures. Founded by ex-Google engineers who built internal developer tools at scale. YC-backed with $2.3M seed from Elad Gil. Used by Bosch, Benchling, and Lightspeed.

Spotify's open-source developer portal framework

Backstage is Spotify's open-source framework for building internal developer portals, now a CNCF incubating project with 27,000+ GitHub stars. It provides a unified software catalog, service documentation, CI/CD pipeline views, and a plugin architecture with 200+ community plugins. Teams use it to create a single pane of glass for service ownership, API documentation, infrastructure management, and developer self-service workflows.

Multi-agent framework for finding scaling laws of agents

CAMEL-AI is an open-source multi-agent framework with 16,500+ GitHub stars, built by a research community of over 100 researchers focused on finding the scaling laws of agents. It supports role-playing agent societies, synthetic data generation pipelines, large-scale social simulations with up to 1M agents via the OASIS platform, and real-world task automation through the OWL project accepted at NeurIPS 2025. CAMEL works with OpenAI, Anthropic, Gemini, Mistral, and local models.

AI-powered SAST for PR-time security analysis

CodeThreat provides pull request-time security analysis covering SAST, dependency vulnerability checks, and infrastructure-as-code risk review. Highly rated for its seamless GitHub integration, it catches security issues introduced by both human and AI-generated code before they reach production, with particular strength in identifying vulnerabilities from rapid vibe coding workflows.

AI-native AppSec that finds and fixes vulnerabilities

Corgea is an AI-native application security platform that uses LLMs to scan, triage, and automatically fix security vulnerabilities in code. Unlike traditional SAST tools that only detect issues, Corgea focuses on the remediation phase by generating context-aware fixes for vulnerabilities, significantly reducing the time engineering teams spend on security backlog while providing contextual PR reviews and IDE integrations.

Open-source IaC orchestration that runs Terraform plans and applies from pull request comments

Digger is an open-source infrastructure-as-code orchestration tool for running Terraform and OpenTofu plan/apply workflows from pull request comments. It uses the team’s existing VCS and CI runners instead of adding a separate runner fleet, supports GitHub, GitLab, and Azure DevOps style workflows, and stores PR-level locks and plan cache in the user’s cloud account.

AI documentation generator from code repositories

DocuWriter.ai creates technical documentation from code repositories by scanning files, understanding patterns, and generating structured documentation including API references, function descriptions, and architectural overviews. It supports batch processing for entire repositories, serving as a zero-to-one documentation tool for undocumented codebases that need initial documentation coverage quickly.

AI-native SAST with contextual security analysis

DryRun Security is an AI-native SAST platform using Contextual Security Analysis to reason about code behavior, data flow, and exploitability instead of regex pattern matching. It provides PR-native security reviews on GitHub and GitLab, catching logic flaws, broken auth, IDOR, and injection bugs that legacy scanners miss while cutting 90% of noise. Features Natural Language Code Policies, DeepScan for full-repo audits, and a Risk Register for org-wide visibility. Supports 14+ languages.

Dependency lifecycle management and risk reduction

Endor Labs is a dependency management platform that goes beyond vulnerability scanning to assess the overall risk of open-source dependencies. Evaluates maintainer activity, code quality, popularity trends, licensing, and operational risk alongside CVEs. Features reachability analysis to determine if vulnerabilities are actually exploitable in your codebase. Provides dependency selection guidance for choosing safer alternatives. Reduces alert fatigue by prioritizing truly risky dependencies.

Bayesian git bisection for finding commits that caused flaky tests

Git Bayesect applies Bayesian inference to git bisection, solving the problem of finding commits that introduced non-deterministic bugs like flaky tests. Unlike standard git bisect which requires binary pass-fail results, Git Bayesect handles probabilistic outcomes where a test might pass sometimes and fail sometimes, using entropy minimization to efficiently narrow down the culprit commit.

Visual Git client with built-in collaboration

GitKraken is a cross-platform visual Git client providing an intuitive graph visualization of repository history, branches, and merges. Features include drag-and-drop branch management, interactive rebase, merge conflict editor, built-in code editor, GitFlow support, and integrations with GitHub, GitLab, Bitbucket, and Azure DevOps. Includes GitLens for VS Code providing inline blame annotations, code authorship, and commit history. Free for public repos, paid for private repositories.

Instant MCP server for any GitHub repository

GitMCP is a free, open-source remote MCP server that transforms any GitHub repository or GitHub Pages site into an AI-accessible documentation hub. Just replace github.com with gitmcp.io in any repo URL to give AI assistants grounded context about that project — eliminating code hallucinations with zero configuration required.

Pull Requests as a Service with AI + developers

GitStart is a YC-backed platform that delivers merge-ready pull requests by combining AI coding agents with human developer oversight. Teams assign sprint-sized tickets and the AI Ticket Studio converts vague requirements into well-scoped specs, then hybrid agents generate production-ready code through a five-stage quality process with a 98% merge rate reported across customer teams.

Validate and structure LLM outputs with composable Guards

Guardrails AI is an open-source Python and JavaScript framework for validating and structuring LLM outputs using composable Guards built from a Hub of pre-built validators. It handles structured data extraction with Pydantic models, content safety checks including toxicity, PII detection, competitor mentions, and bias filtering, plus automatic re-prompting when validation fails. The Guardrails Hub offers dozens of validators from regex matching to hallucination detection via LLM judges.

Open-source dashboard for AI agent orchestration

An open-source dashboard for managing AI agent fleets. Dispatch tasks, monitor progress, and orchestrate multiple agents working in parallel on your codebase. Provides real-time visibility into agent activity, error tracking, and resource allocation so teams can scale autonomous coding workflows with confidence.