Alternatives to Skylos
Skylos is a MCP server by duriantaco: Dead code, security, secrets detection and code quality for Python, TypeScript, Go. If it doesn't fit your setup, these 12 MCP servers cover similar ground. They are ordered by how closely they match Skylos and by our rank, which weighs adoption, freshness and documentation; money never changes the order. pyscn leads the list (most GitHub stars here (1,096); active in the last 30 days). 2 offer a remote endpoint, so there is nothing to install locally. Each entry shows data reasons to switch, and you can open a side-by-side comparison with Skylos.
Updated Oct 26, 2026 · Built from catalog data; how we rank and grade
You're replacing
Skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
12 alternatives
Ordered by how closely each matches Skylos (shared product, category or stated alternative) and by rank.
- 1pyscn
ludo-technologies
Python code analysis for AI agents: complexity, dead code, clones, coupling, and a health score.
- Most GitHub stars here (1,096)
- Active in the last 30 days
★ 1.1K↓ 323/wkLast active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 2LeakGuard
youraitools.co
Find and redact leaked secrets, wallet keys and PII before an AI agent sends text.
- Remote server, no local install
↓ 162/wkLast active Oct 22, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2
AFreshness: A–Security: not graded yet - 3Secret Scanner
GuardBee
Scans files for leaked secrets and API keys
- Most weekly downloads here (1.1K)
- Active in the last 30 days
★ 1↓ 1.1K/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 4Prompt Leak Scanner
GuardBee
Catches leaked credentials and PII in outbound LLM prompts
- Active in the last 30 days
- Open source (MIT)
★ 1↓ 988/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 5Scopewalker MCP
timohaa
Codebase analysis tools for AI agents: complexity, prop drilling, doc coverage, code smells.
- Active in the last 30 days
- Open source (MIT)
★ 1Last active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 6MCP Safeguard
cognivators.com
MCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning.
- Active in the last 30 days
↓ 183/wkLast active Jun 4, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 7
Skarngetskarn.com
Scans AI coding sessions and assistant configs for leaked secrets and risky hooks; local, redacted
- Active in the last 30 days
Last active Oct 4, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 8Husk
husk-security
Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs
- Active in the last 30 days
- Open source (MIT)
★ 6↓ 3/wkLast active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 9ovecc
Ovecc-labs
Architecture guardrails for AI-written code: dependency graph, impact, dead code, CI gate
- Open source (MPL-2.0)
★ 3Last active Aug 19, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
BFreshness: B–Security: not graded yet - 10Code Refactor
zhouhengchang
Refactor legacy code into modern, idiomatic code without changing its behavior.
- Remote server, no local install
Last active Oct 18, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2
AFreshness: A–Security: not graded yet - 11toolprint by JEStats
jestatsio
package-lock.json for MCP trust: catch MCP rug-pulls, tool poisoning, and leaked secrets.
- Active in the last 30 days
- Open source (Apache-2.0)
Last active Oct 15, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet - 12Keyspoor
majiayu000
Offline secret scanning for AI agents.
- Active in the last 30 days
- Open source (Apache-2.0)
Last active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2
AFreshness: A–Security: not graded yet