Skylos
A hybrid SAST and dead code detection tool for Python, TypeScript, and Go that combines AST-based static analysis with optional LLM-powered remediation, offering framework-aware false-positive reduction and CI/CD integration.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Agent orchestration/workflow tool. Local execution context. Validate all tool parameters before execution. Sandbox agent capabilities based on trust level.
⚡ Reliability
Best When
You maintain a Python, TypeScript, or Go codebase and need a framework-aware dead code remover and security scanner that minimizes false positives and integrates with CI/CD.
Avoid When
You need broad multi-language SAST coverage (Java, C#, Ruby, etc.) or require a SOC 2-certified commercial SAST solution.
Use Cases
- • Detect and safely remove dead code (unused functions, orphan classes, unused imports) from Python, TypeScript, and Go codebases
- • Run security scans for SQL injection, XSS, command injection, secrets, and SSRF vulnerabilities with low false-positive rates
- • Automate code remediation and PR creation using AI agents connected via the MCP server interface
- • Enforce quality gates in CI/CD pipelines with GitHub Actions integration and inline PR annotation
- • Audit large legacy codebases to reduce maintenance burden while preserving framework-required code (pytest fixtures, FastAPI routes)
Not For
- • Languages beyond Python, TypeScript/TSX, and Go — multi-language polyglot projects need additional tools
- • Teams wanting a fully managed SaaS SAST tool — Skylos is self-hosted
- • Runtime security monitoring — Skylos is static analysis only (no RASP or DAST capabilities)
Interface
Authentication
AI agent features require LLM API key (OpenAI, Anthropic, or Ollama local). Core static analysis requires no credentials.
Pricing
Apache 2.0 open source. AI-powered remediation incurs LLM API costs. Local LLMs (Ollama) available for zero-cost AI features.
Agent Metadata
Known Gotchas
- ⚠ Go analysis requires a separate standalone binary — not just pip install
- ⚠ AI remediation with auto-PR requires GitHub token and write access to the repo
- ⚠ Framework-aware exclusions (Flask, Django, FastAPI) require correct project structure detection
- ⚠ Performance benchmark comparisons are self-reported against Vulture only; not independently verified
- ⚠ LibCST-based safe removal may fail on syntactically unusual or macro-heavy Python code
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Skylos.
Scores are editorial opinions as of 2026-03-06.