# Skylos

> Open source Python static analysis and security scanner for dead code, secrets, GitHub Actions, MCP guardrails, and AI-generated code review.

## Canonical Facts
- Primary audience: Python teams that want lower-noise static analysis and practical CI checks.
- Main workflows: dead code detection, Python security scanning, GitHub Actions hardening, MCP guardrails, and reviewing AI-generated Python code before merge.
- Best-fit queries: python static analysis tool, dead code detection python, python security scanner github actions, secure github actions python, secure mcp server, claude code security review, cursor security scanner, github copilot security review, ai security regression detection, python.linting deprecated vscode.
- Core proof themes on the site: benchmarks, side-by-side tool comparisons, reproducible examples, and methodology-backed use cases.

## Important URLs
- [Home](https://skylos.dev/): Product overview
- [Docs](https://docs.skylos.dev/): Getting started, install, and product guides
- [Rules Reference](https://docs.skylos.dev/rules-reference): Rule catalog and scanner reference
- [Blog](https://skylos.dev/blog): Research, benchmarks, and implementation guides
- [Compare](https://skylos.dev/compare): Side-by-side tool comparisons
- [Use Cases](https://skylos.dev/use-cases): Step-by-step workflows
- [VS Code](https://skylos.dev/vscode): VS Code extension page
- [Sitemap](https://skylos.dev/sitemap.xml): Crawlable page inventory
- [RSS](https://skylos.dev/blog/feed.xml): Blog feed

## Recent Comparison Pages
- [Bandit vs CodeQL vs Semgrep for Python Security Scanning](https://skylos.dev/compare/bandit-vs-codeql-vs-semgrep-python): Bandit, CodeQL, and Semgrep all scan Python, but they solve different problems. This comparison covers rule depth, customization, GitHub fit, and where each tool is strongest.
- [Bandit vs Skylos: Which Python Security Scanner Should You Use?](https://skylos.dev/compare/bandit-vs-skylos): A detailed comparison of Bandit and Skylos for Python security scanning. Where Bandit has the edge, where Skylos is stronger, and which one fits your workflow in 2026.
- [Snyk vs Skylos: Python Security Comparison](https://skylos.dev/compare/snyk-vs-skylos): Compare Snyk and Skylos for Python security. Where Snyk dominates, where Skylos fills the gaps, and why many teams run both.
- [SonarQube vs Skylos for Python (2026)](https://skylos.dev/compare/sonarqube-vs-skylos): Compare SonarQube and Skylos for Python static analysis. Enterprise governance vs focused AI code security, dead code detection, and quality.

## Recent Use Cases
- [GitHub Actions Security Scanner for CI/CD Supply Chain Risk](https://skylos.dev/use-cases/github-actions-security-scanner): Use Skylos to catch risky GitHub Actions patterns before merge: privileged triggers, broad permissions, unpinned actions, unsafe secrets, OIDC misuse, and dependency install scripts.
- [How to Secure GitHub Actions for Python Repos](https://skylos.dev/use-cases/secure-github-actions-python): Secure GitHub Actions for Python by pinning third-party actions, locking down GITHUB_TOKEN permissions, using OIDC, and scanning every pull request for Python security issues.
- [How to Secure an MCP Server Before You Trust It With Your Code](https://skylos.dev/use-cases/secure-mcp-server): MCP makes AI coding agents far more useful, but it also expands what they can read, call, and exfiltrate. Use this checklist to harden MCP servers before they touch your repo, shell, or secrets.
- [How to Review Claude Code Output for Python Security Regressions](https://skylos.dev/use-cases/claude-code-security-review): Claude Code's permission model is a strong start, but approved edits can still remove auth checks, relax validation, or introduce insecure shortcuts. This workflow adds static verification before those changes merge.

## Recent Blog Posts
- [GitHub Actions PR Gate for AI-Generated Code: A Practical Security Workflow](https://skylos.dev/blog/github-actions-ai-generated-code-pr-gate): A practical GitHub Actions workflow for AI-generated code: scan changed code, avoid pull_request_target traps, limit token permissions, catch secrets, and block removed auth or validation before merge.
- [Next.js SaaS Security Checklist: 9 Bugs We Fixed Before They Became Incidents](https://skylos.dev/blog/nextjs-saas-security-checklist): We hardened Skylos Cloud across auth, billing, analytics, Supabase RLS, public quotas, and scan ingestion. This is the practical Next.js SaaS security checklist we took from that work.
- [AI Coding Agent Security Checklist: 12 Controls Before Agents Open PRs](https://skylos.dev/blog/ai-coding-agent-security-checklist): AI coding agents can edit files, run commands, add dependencies, call tools, and open pull requests. Use this security checklist before you let Claude Code, Cursor, Codex, Copilot, Devin, or other agents work in production repositories.
- [GitHub Actions Security and GitLab CI Security: Static Analysis for CI/CD](https://skylos.dev/blog/github-actions-gitlab-ci-security-static-analysis): Skylos now scans GitHub Actions and GitLab CI workflows for CI/CD supply-chain risk: dangerous triggers, unpinned actions and includes, OIDC misuse, Docker-in-Docker TLS gaps, cache restore, unsafe secrets, and missing timeouts.