Code and APIs

Check source code, configuration files and API formats. Each tool states which rules it checks and whether it sends a network request; a local check does not run or deploy your code.

21 tools in this category.

• Dockerfile check

  Checks a Dockerfile against reliability rules without running a build: pinned image and package versions, apt cache cleanup, sudo, JSON form of CMD and ENTRYPOINT, pipefail in pipelines, COPY instead of ADD for local files, COPY --from pointing at an unknown stage, the last user being root, consecutive RUN instructions and the deprecated MAINTAINER. Every finding carries a rule code, a level and a line number, and the result can be downloaded as CSV.

• Shell script check

  Finds typical shell script defects without running the code: unquoted variables and command substitutions, legacy backticks, cd without an error check, cat in a pipeline, unquoted $@, an unknown or missing shebang, and variables that are assigned but never used. Each finding lists the rule code, level and line, plus a summary by level.

• SQL style check

  Checks queries for a consistent style: keyword case, comma placement, indentation, line length, SELECT *, a missing final semicolon, balanced parentheses and extra blank lines. The rules are configurable and every finding carries a code, a level and a line number.

• Python check

  Quickly finds common Python problems without running the code: unused imports, comparisons with None and True, a bare except, mutable default arguments, over-long lines, tabs, ambiguous names, assignments that are never used and a missing final newline.

• Compose to Kubernetes

  Turns your own Compose description into Kubernetes resources: for every service it builds a Deployment with the image, ports, environment variables, volumes and limits, and a Service with a matching selector when ports are published. It reports bind mounts, undeclared volumes, untagged images and references to unknown services, and produces a ready YAML manifest.

• GitHub Actions check

  Checks a workflow locally: it computes the execution order from the dependency graph, expands the matrix, and finds a cycle in needs, an unknown runner, a step with both uses and run, a step with neither, the removed set-output commands and old major versions of official actions. Nothing is sent to GitHub.

• Access policy evaluation

  Evaluates a policy written in a readable subset of Rego against a supplied input document: package, default, complete rules with a body, partial deny[msg] rules, not, comparisons, counters, prefix and containment checks, := assignments and wildcard indexing. It reports the decision, which rules fired and the reasons for any denial.

• JSON queries

  Runs expressions over your own JSON: field paths, array indexes and filters, a wildcard for all values, object and array construction, variables, ranges, string concatenation and dozens of functions from count, sum, keys and sort to substring, replace and merge. The result can be downloaded as JSON.

• Thrift IDL check

  Parses a Thrift IDL, checks its structure and generates a client: it finds duplicate field numbers and names, unknown types, required fields in a union and duplicate methods, then produces interfaces, enums, a service description, a JSON schema and a transport-agnostic client skeleton.

• Component vulnerability check

  Matches your own dependency list against an advisory database by version range: it accepts "name version" lines or a JSON component list, compares versions including pre-releases, and shows which advisories affect exactly these versions and which version fixes them. The bundled database is an example for verification, not a live data feed.

• HTTP API client

  Builds a request to your own API and shows its exact wire form: request line, headers, body length, basic auth and bearer token substitution. Header values are checked for hidden line breaks, the body gets a consistent content type, and the response is analysed locally: status class, headers, size, JSON parsing and notes about caching and security. The request leaves the device only after you give consent on this screen.

• API mock server

  Describes routes as plain text or JSON and finds the answer for a given request: path matching with parameters, an exact route winning over a parameterised one, per-method routing with a 405 answer, built-in 404 and 405 replies, and value substitution into the response body from path parameters, the query string, headers and the request body. Simple random values use a reproducible seed.

• WebSocket client

  Parses a WebSocket handshake and checks it against RFC 6455: method, version, upgrade headers, the 16-byte key length and the correct sec-websocket-accept value computed from the key. Encodes and decodes frames: text, binary, close, ping and pong, lengths up to 64 bits, masking, close codes and reasons, while rejecting control frames over 125 bytes and non-zero reserved bits. Frames are shown in hex.

• MQTT client

  Encodes and decodes MQTT 3.1.1 packets with an own codec: CONNECT with clean-session, will, user name and password flags, PUBLISH with quality of service, retain and duplicate, SUBSCRIBE and SUBACK with granted codes, CONNACK with a refusal reason. Topic matching against + and # wildcards is checked separately, as the specification requires.

• Webhook delivery

  Plans webhook delivery with retries: a delay schedule with a backoff factor and jitter, the total waiting time, classification of every answer as success, transient or permanent, stopping after a permanent failure, continuing after 429 and 5xx, and an HMAC-SHA-256 signature of the body. The attempt journal can be downloaded and no network request is sent.

• API checks from a description

  Reads an OpenAPI description as JSON or YAML, lists operations, parameters and responses, and then builds a set of checks: a valid request, wrong types, values outside limits, missing required properties, an unknown path and a missing body. It also checks the provider answer itself: whether the status is declared, whether a content-type header is present, and whether the body matches the schema by type, required fields, enums, limits, patterns and date format. Defects in the description itself are reported too.

• Contract tests

  Reads a Pact-style consumer contract and matches it against actual provider answers: exact values, types, integers, decimals, booleans, regular expressions, non-empty values, dates, arrays with a minimum number of items and templates for repeated items. Every mismatch carries a document path and an explanation, and the verification report can be downloaded.

• WebAssembly optimisation

  Parses a binary WebAssembly module, folds constant expressions, removes code after terminating instructions and unused locals, and then emits a smaller module. The result is verified by running it in an own sandbox: the size before and after, every change and the real call result are shown.

• WebAssembly sandbox

  Runs an allowed WebAssembly module in an own sandbox with a step budget, limited memory and a list of allowed imports. It shows the call result, the steps used, the exported functions and, for an endless loop, a division by zero or an out-of-bounds access, the exact reason for stopping.

• FlatBuffers inspection

  Reads a FlatBuffers schema, builds a package from it and immediately reads it back: tables, scalar fields, strings, vectors and nested tables. It shows the package size, the field layout and whether the read values match the given ones.

• Cap’n Proto inspection

  Reads a Cap’n Proto schema, builds a message from it and reads it back: scalar fields, text, lists and nested structs. It shows the message size in bytes, the number of data and pointer words, and whether the read values match the given ones.