LoRexxar/Kunlun-M

KunLun-M — Open-source static code analysis for PHP, Nodejs/JavaScript, Python, Golang, Java and C/C++, with AST-based semantic scanning and one-click AI Agent integration (OpenClaw, Codex, Claude Code, Hermes, and more).

What it solves

KunLun-M is a static code security analysis system designed to detect vulnerabilities in source code. It automates the process of finding security flaws by analyzing how data flows through a program without actually executing the code.

How it works

The system converts source code into an Abstract Syntax Tree (AST) graph, which includes call graphs, data flow, and AST structures. It then performs taint analysis—tracking "tainted" user input as it moves through the program—to see if it reaches dangerous functions.

Users can interact with the system via a CLI, a web dashboard with interactive graph visualizations, or an interactive console (REPL) that allows for custom graph queries. It also supports exporting these graphs to Neo4j for advanced analysis.

Who it’s for

Security researchers, developers, and auditors who need to perform deep static analysis on codebases across a wide variety of programming languages to identify potential security vulnerabilities.

Highlights

  • Broad Language Support: Supports 14 languages, including PHP, JavaScript, TypeScript, Python, Java, Go, Rust, C/C++, and Solidity.
  • Interactive Graph REPL: A Joern-style console for querying the program graph (e.g., finding shortest paths to specific functions).
  • Web Dashboard: Includes a visual interface for task management and interactive graph visualization using Cytoscape.js.
  • AI Agent Integration: Built-in skills that allow AI agents like Claude Code or Codex to initialize and run scans automatically.
  • Specialized Plugins: Includes tools for finding PHP deserialization chains and identifying entry pages in large projects.

Related

  • Project
    duriantaco/skylos

    An open-source static analysis CLI that detects dead code, security flaws, and AI-generated code hallucinations across multiple languages to ensure code quality before merge.

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using static analysis, behavioral dataflow, and LLM-based semantic analysis.

  • Project
    Cranot/roam-code

    roam‑code is a local static‑analysis CLI (and optional MCP server) that builds a symbol graph of a repository, letting AI coding agents query definitions, callers, test impact, and risk (blast radius) without any remote API calls. It provides pre‑flight checks, health summaries, verification gates, and Claude‑specific hooks, all open‑source and privacy‑preserving.

  • Project
    vigolium/vigolium

    A high-fidelity vulnerability scanner that combines deterministic native scanning with autonomous AI agents to audit codebases and web applications.

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in codebases using focused, parallelized workflows.