# duriantaco/skylos [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/duriantaco/skylos  
**GitHub Stars:** 852  
**Views:** 8  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/duriantaco-skylos

## Description
Dead code detection, security scanning, and code quality analysis for Python, TypeScript, and Go. 98% recall with fewer false positives than Vulture. Includes AI-powered remediation.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "skylos": {
    "command": "uvx",
    "args": ["skylos"]
  }
}
```

## Documentation

## What duriantaco/skylos does

Skylos analyzes source repositories and project configuration for dead code, security problems, hard-coded secrets, dependency vulnerabilities, maintainability issues, and common AI-generated coding mistakes. Its default scan focuses on unused functions, classes, imports, and empty files. Expanded analysis adds checks for dangerous data flows, CI/CD and deployment misconfigurations, excessive complexity, duplicate branches, deep nesting, invented APIs, impossible dependency versions, missing guards, and unsafe LLM application behavior.

Python receives the deepest analysis. TypeScript and JavaScript, Java, PHP, Dart, Rust, Go, C#, Kotlin, C++, and Shell have varying levels of support. Findings include source locations and supporting evidence where static analysis can provide it. Results distinguish concrete defects from review findings and maintainability advice, and include risk, maintainability, dead-code, and policy-gate readouts.

## How it works

Skylos runs locally by default and can also operate in CI as a pull-request gate. A basic scan uses the project path, while the `-a` option enables the broader analyzer set. The `done` workflow compares a branch with its base, runs tests, and checks for deleted or skipped tests, weakened CI steps, suppressed lint or type checks, and test-only workarounds. It writes a receipt under `.skylos/receipts/`.

The `done map` command describes changed Python and TypeScript/JavaScript functions, including code differences, changed calls, callers, and removed security checks. Other workflows cover AI-defect verification, combined repository reports, recognized LLM integrations, Python cleanup candidates, local GPU deployment preflight, and container-image vulnerability scans.

## Setup and configuration

Install the CLI from PyPI with `pip install skylos`. Typical commands include `skylos .` for dead-code analysis, `skylos . -a` for the broader checks, and `skylos done --base main` for branch readiness. Pytest runs automatically in the `done` workflow; other test runners require a `test_command` entry under `[tool.skylos.done]`.

Go dead-code and security analysis uses the native `skylos-go` engine. Supported PyPI wheels, the container image, and the GitHub Action include that engine for listed platforms. On other platforms, `skylos doctor` provides a source-build command, and `SKYLOS_GO_BIN` can point to a separately built binary.

## Tools and capabilities

- Detect unused code and empty files.
- Scan security issues, secrets, dependency CVEs, and unsafe data flows.
- Check code quality, CI/CD settings, deployment configuration, and AI-generated defects.
- Compare branches, run tests, and identify suspicious agent changes.
- Map changed functions and callers, clean Python dead code with a dry run, and scan container images.

## Limitations and notes

Language coverage is uneven, with Python receiving the broadest checks. C# support is partial, Kotlin is limited to dead-code analysis, C++ covers only unused file-local functions, and Shell is security-only. Rust dead-code findings require a lower confidence threshold, while Go analysis depends on the native engine.

Static security evidence does not establish runtime exploitability or prove that the installed environment is fully covered. For `uv.lock`, Git, URL, path, and private-index dependencies can remain unchecked. Review dynamic calls and public APIs before deleting reported dead code. Passing a configured gate means the repository is within policy limits, not that it has zero findings.

_Full upstream README: https://allmcps.com/mcp/duriantaco-skylos/readme_