Is it vulnerable?
Removed protections, exposed secrets, unsafe data flows, risky dependencies.
Open source · for teams using AI coding agents
Know when an AI agent's pull request is actually done.
Skylos is an open-source (Apache-2.0) static analysis CLI and pull request check for TypeScript, JavaScript, Python, Go and Java codebases. It finds dead code, security issues, and secrets.
Agents skip tests, loosen CI, and hard-code answers. skylos done runs your tests and fails the branch when it finds those shortcuts.
On your machine
Check an agent branch before you review it.
Check out the agent's branch and run skylos done. You get a receipt with each check's result.
The agent's change (git diff main)
--- a/shop/pricing.py+++ b/shop/pricing.py-PERCENT_OFF = {"SAVE10": 10}+PERCENT_OFF = {"SAVE10": 10, "SAVE20": 20} def apply_discount(total: float, code: str) -> float:- percent = PERCENT_OFF.get(code, 0)+ percent = PERCENT_OFF[code] return round(total * (100 - percent) / 100, 2)--- a/tests/test_pricing.py+++ b/tests/test_pricing.py assert apply_discount(100.0, "SAVE10") == 90.0 +def test_save20_takes_twenty_percent_off():+ assert apply_discount(100.0, "SAVE20") == 80.0+++@pytest.mark.skip(reason="flaky") def test_unknown_code_keeps_total(): assert apply_discount(100.0, "BOGUS") == 100.0skylos done --base main
$ skylos done --base mainSkylos done · base 8da0a2b (merge base) · head d0ff52aUNFINISHED Tests pass when Skylos runs them: Earlier required checks failed or were incompleteFAIL No tests deleted, skipped or weakened: 1 test change(s) weaken what the tests check tests/test_pricing.py:15 SKY-A111 test_unknown_code_keeps_total now skips or expects failure (skip) tests/test_pricing.py:14 SKY-A101 (advice) Test was skipped or xfailed in this diff Fix: Put back the removed or skipped tests and the original assertions and settings.PASS Skylos settings and hooks left alone: Skylos settings, hooks and protected paths unchangedPASS No secrets added: No secrets addedPASS Every package and import is real: Every added import and package resolvesWARN Tests check the changed lines: Earlier required checks failed or were incompletePASS Code doesn't special-case the tests: No code special-cases the tests (1 changed file(s) read)PASS Linters, type checkers, scanners and CI not silenced: No linter, type-checker, scanner or CI settings weakenedVerdict: FAIL (Tests pass when Skylos runs them, No tests deleted, skipped or weakened)Receipt: .skylos/receipts/d0ff52a8ddaa-8da0a2b2fb37.json$ echo $?1Recorded output from Skylos 4.47.1 on a small example repository. Nothing runs or uploads in your browser.
What fails the check, and what is only flagged.
Five checks block by default. Three only warn.
What blocks by default
- Tests fail when Skylos runs them, or the test run doesn't finish
- Tests deleted, skipped, or weakened, including loosened test settings and CI test steps
- Code written to pass particular tests, such as an answer hard-coded to a test's input
- Skylos settings, or the agent hook files that run it, edited
- Secrets added
What only warns
- Lint, type-check, scanner, or CI checks silenced
- Imports or dependencies that don't resolve to a declared package
- Changed Python lines that no test runs or checks
From your laptop to every pull request.
Start locally. Add it to CI. Use Cloud for merge blocking and one policy.
On your machine
Free, no account.
On every pull request
Writes
.github/workflows/skylos.yml. Commit it and every pull request gets a Skylos check. No API key needed.For your team
Connect a repository with the Skylos GitHub App. One click opens a pull request that adds the workflow; merge it and require the check. On the Free plan.
How we test it.
Every check passes or fails with evidence. No model decides a block. The benchmark publishes what it blocked and missed.
Also in the CLI
Dead code, security issues, and secrets.
The same install scans a whole repository, with no account.
Is it actually used?
Framework-aware dead code detection.
Did the change add risk?
Missing validation, invented APIs, and regressions in the diff.
Scan your repository
Try it without installing
See a Skylos finding
Recorded scan
users.pybefore
from flask import request def search_users(conn): name = request.args.get("name") query = f"SELECT * FROM users WHERE name = '{name}'" return conn.execute(query).fetchall()Tainted input enters a string-built query.
The flagged line is highlighted.
SKY-D211CRITICALline 7
Possible SQL injection: tainted or string-built query.
10 Skylos-assisted dead-code cleanup PRs merged into the default branch in 9 open-source projects.
Inspect the evidenceCloud for teams.
Results, policy, and history in one place. Checks still run in your own GitHub Actions.
- Free: a pass/fail pull request check, 1 project, 10 stored scans.
- Workspace: policy with version history.
- Workspace: exceptions that need approval and expire.
- Workspace: CSV and JSON exports of issues.
- Workspace: an agent scorecard.
The checks are free. Teams pay a flat price.
Nothing is metered by seat, line of code or pull request.
Free
$0
- CLI and agent hooks, no login
- PR gate in your own CI, private repos included
- Cloud: 1 project, 10 stored scans, pass/fail on pull requests
- Credits work here too: comparisons, AI triage, AI fix PRs
Workspace pass
$990 once
- Unlimited members
- Up to 10 projects, 500 stored scans per project
- Shared history, team policy, pull request comments and exports
- 1,000 credits included
- Does not renew by itself
Credit packs
from $9
- $9 · 50 creditsUp to 3 people
- $39 · 250 creditsUp to 3 people
- $129 · 1,000 creditsUp to 3 people
- $499 · 5,000 creditsUp to 3 people
Enterprise
from $5,000 / year
Talk to us only if you need:
- More than 10 projects
- SSO
- Invoice or purchase-order billing
- A DPA or a security questionnaire
Questions
We already use an AI reviewer such as CodeRabbit or Copilot. Why add this?
AI reviewers comment on the diff. skylos done runs your tests and compares test files and CI steps with main, and no model decides a block. Run both.
Will it block good pull requests?
Only the checks under "What blocks by default" fail the run. Set any check to block, advise, or off in [tool.skylos.done.checks] on your main branch.
Does Skylos upload my source code?
No. CLI scans, including skylos done, never send source code and call no AI model; dependency checks look up package names in public registries and OSV. Cloud gets findings and short snippets only when you use --upload or the Skylos GitHub App, whose scan runs in a temporary sandbox that is deleted when the scan ends.
Does it work for my stack?
skylos done runs pytest and reads Jest, Vitest, Mocha, node:test, and Playwright Test files. For other test runners, set test_command in [tool.skylos.done].
Which languages does Skylos support?
Dead code: Python, TypeScript/JavaScript, Java, Go, PHP, Rust, Dart, Kotlin, C#, and C++ (file-local functions). Security: Python, TypeScript/JavaScript, Java, Go, PHP, Rust, Dart, C#, Shell, GitHub Actions, GitLab CI, and Dockerfiles. Go needs the skylos-go engine (Docker image and GitHub Action); Dart needs an extra parser.
Is this a cheating detector?
No. It finds specific shortcuts in tests, CI, and code. It can't prove code is correct.
Is Skylos free?
Yes. The CLI, skylos done, and the GitHub Actions workflow need no login. Cloud Free adds a pass/fail pull request check; Workspace adds history, policy, and team review.
What do Cloud credits pay for?
Scan comparisons, AI fix PRs, AI triage, MCP remediation, and compliance reports. Scan uploads, Cloud scans of your GitHub repositories, PR checks, and the merge gate never use credits. Deep scans do. MCP scan tools run on your machine and don't use credits. They need a project API key, except the dead-code analyze tool, which works without one for 5 calls a day. Your first workspace gets a Workspace trial: 14 days, 50 credits, no card, nothing renews or charges you.