# GitHub

Programmable safety rails for LLM applications

NeMo Guardrails is NVIDIA's open-source toolkit for adding programmable safety rails to LLM applications. It supports five guardrail types — input, dialog, retrieval, execution, and output rails — covering content safety, jailbreak detection, topic control, PII masking, hallucination detection, and fact-checking. The toolkit uses Colang, a domain-specific language for defining conversational constraints, and integrates with OpenAI, Azure, Anthropic, HuggingFace, and LangChain/LangGraph.

GitHub code navigation sidebar

Browser extension that adds a file tree sidebar to GitHub repositories for easy code navigation. Browse files and folders without leaving the current page, with support for private repos, pull request code review navigation, file search, bookmarks, and theming. Works with GitHub Enterprise. Available for Chrome, Firefox, Safari, and Edge. Essential for navigating large GitHub repos without cloning. Freemium with Pro features for advanced code review and multiple GitHub accounts.

Open-source async coding agent you can run in your own sandbox

Open-source framework from LangChain AI for building your organization's internal coding agent — the same pattern Stripe's Minions, Ramp's Inspect, and Coinbase's Cloudbot follow. Built on LangGraph and Deep Agents, Open SWE runs each task in an isolated cloud sandbox (Modal, Daytona, Runloop, or LangSmith), invokes from Slack, Linear, or GitHub, orchestrates subagents, and opens pull requests autonomously — customizable end-to-end for your codebase and conventions.

AI-powered marketing-ready READMEs from code

PitchDocs is an AI documentation generator that scans codebases to produce marketing-ready READMEs, changelogs, and AI context files like llms.txt. It bridges the gap between raw source code and consumer-ready technical communication, targeting the growing need for high-quality README files that serve both human developers and AI agents accessing documentation.

Internal developer portal for self-service engineering

Port is an internal developer portal platform that provides self-service interfaces for engineering teams. It offers a software catalog for tracking services, environments, and dependencies, along with self-service actions for common workflows like spinning up environments, deploying services, and managing resources. Features scorecards for engineering standards compliance and integrates with GitHub, GitLab, K8s, and cloud providers.

Hundreds of GitHub UI enhancements

Open-source browser extension with hundreds of small UX improvements to GitHub: cleaner diffs, one-click PR merging, reaction avatars, linkified commit SHAs, and much more. Fixes dozens of long-standing GitHub UI annoyances that power users encounter daily, making the GitHub web experience feel polished and efficient without waiting for official feature updates.

Supply chain security for npm and Python packages

Socket.dev detects and prevents supply chain attacks in open-source dependencies before they compromise your applications. Unlike traditional SCA tools that match known CVEs, Socket analyzes package behavior — detecting install scripts, network access, filesystem operations, and obfuscated code that indicate malicious intent. Monitors npm, Python (PyPI), and Go packages in real-time. Provides GitHub PR comments with risk assessments for new dependencies added to your projects.

Toolkit for spec-driven development with AI

GitHub's official toolkit for spec-driven development. Write specifications in natural language and let AI coding agents implement them with structure, consistency, and traceability. Bridges the gap between product requirements and AI-generated code by providing a standardized format that agents can follow reliably across complex projects.

IDE documentation that stays synced with code

Swimm uses AI to keep code documentation in sync with real-time code changes, providing interactive walkthroughs directly in VS Code and JetBrains IDEs. It solves the stale documentation problem by making docs part of the development workflow rather than a separate artifact, automatically detecting when code changes invalidate existing documentation and suggesting updates.

AI framework for distributed vulnerability research

Taskflow Agent is an open-source MIT-licensed AI framework by GitHub Security Lab that automates vulnerability discovery through a three-stage pipeline: threat modeling, issue suggestion, and audit validation. It has discovered 91 confirmed vulnerabilities in major open-source projects including Outline and WooCommerce, using distributed community-powered security research coordinated by AI agents.

Open-source GitOps automation for Terraform and OpenTofu pull requests

Terrateam is open-source GitOps infrastructure orchestration for Terraform and OpenTofu pull requests. It automates plans and applies in GitHub workflows, supports monorepos and many workspaces, and adds apply-only locks, OPA/Rego policy checks, cost and drift signals, and approval controls without forcing teams into a separate IaC platform.

AI-powered CI reliability and flaky test management

Trunk is a developer tools platform that tackles CI reliability through AI-powered flaky test detection, automatic quarantine, and merge queue management. It uses ML-based statistical analysis to identify flaky tests, isolates them to prevent pipeline blocks, and creates GitHub issues for resolution. Used by Zillow, Brex, and Faire, with $28.5M in funding and support for all major test frameworks.

Context-aware AI review with business logic validation

Umaku is a context-aware AI code review agent that understands full codebase and business logic context, detecting inconsistencies and assessing quality and risk beyond syntax-level analysis. It auto-generates and validates QA test cases from reviewed code, making it particularly effective for reviewing AI-generated code where product-intent validation matters more than style checking.

AI-native SAST with automated PR security reviews

ZeroPath is an AI-native SAST and AppSec platform recognized as an RSAC 2026 finalist that provides automated pull request security reviews with contextual feedback and natural-language fix suggestions. It catches secrets, IaC misconfigurations, and logic flaws in code changes, competing directly with established code review tools but with a security-first AI-native architecture.

LSP-based AI code review agent backed by Y Combinator

mrge is a YC-backed AI code review agent that uses Language Server Protocol analysis to provide deep, context-aware pull request reviews. It goes beyond surface-level pattern matching by understanding project structure, type information, and cross-file dependencies. Integrates with GitHub and GitLab to deliver automated reviews that catch logic errors, security issues, and architectural inconsistencies.