Skylos

Skylos is an open-source static analysis tool for finding security regressions, exposed secrets, dead code, quality problems, and mistakes introduced by AI. It analyzes Python, JavaScript and TypeScript, Go, Java, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configuration, though analysis depth differs by language. Its CLI can run locally without an account and supports local scans and CI checks. A free VS Code extension provides inline diagnostics and optional AI verification using OpenAI or Anthropic API keys. Cloud features include GitHub pull request workflows, OIDC identity, and optional Slack or Discord notifications. A normal CLI scan stays on the user's machine; Cloud receives scan data when a report is uploaded, a cloud action is triggered, or the public scan endpoint is used. Uploaded reports may include findings, file paths, line numbers, snippets, and scan metadata. The free plan includes one cloud project, 10 stored scans, and seven days of history. One-time credit packs start at $9 and include Pro access for a stated period. Skylos says it does not currently claim SOC 2, ISO 27001, or CSA STAR certification.

Skylos offers local static analysis alongside optional cloud workflows and a VS Code extension. Consider where scan data goes when using cloud actions, and note the stated limits and certification status.

Skylos may suit developers who want local or CI analysis, including Python teams already using Ruff, Pylint, or Mypy. Its cloud workflows may also fit teams using GitHub pull requests and optional chat notifications.

Overview

Skylos is an open-source static analysis tool for finding security regressions, secrets, dead code, quality issues, and mistakes introduced by AI. It is best suited to development teams seeking local scans and CI checks, especially Python teams already using Ruff, Pylint, or Mypy. Its local CLI makes it useful without a hosted workflow, while paid cloud access adds project history and collaboration at a credit-based cost.

Key features

The CLI runs locally without an account and supports local scanning and CI checks. Skylos analyzes Python, JavaScript and TypeScript, Go, Java, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configuration. That breadth can suit mixed-language repositories, but analysis depth varies by language, so teams should assess whether coverage matches their codebase rather than assume parity.

The free VS Code extension provides inline diagnostics, with optional AI verification using OpenAI or Anthropic API keys. Cloud features add GitHub pull request workflows and OIDC identity, plus optional Slack and Discord notifications. Local MCP tools cover analysis, security, quality, and secret scanning; remediation consumes credits, so it is not an unlimited extra.

A standard CLI scan remains on the user's machine. Data reaches Cloud when a report is uploaded, a cloud action runs, or the public scan endpoint is used. Reports may include findings, severity, rule IDs, paths, line numbers, snippets, attribution, scan metadata, and optional provenance or defense evidence. Skylos describes controls including role-based permissions, hashed project API keys, restricted GitHub OIDC uploads, bounded report ingestion, and security headers. It does not currently claim SOC 2, ISO 27001, or CSA STAR certification, a meaningful consideration for organizations with formal certification requirements. Vulnerability reports are acknowledged within 2 business days, with an initial triage update within 5 business days; there is no paid bug bounty program.

Pricing

Skylos combines free local use with one-time credit packs that include temporary Pro access. The free plan costs nothing and includes local CLI scans without login, plus Cloud for 1 project, 10 stored scans, and 7-day history. That is enough to try hosted workflows on a small project, but the scan and history caps are restrictive for ongoing team use.

• Starter credit pack: $9, paid once for 500 credits and 30 days Pro access.
• Builder credit pack: $39, paid once for 2,500 credits and 90 days Pro access.
• Team credit pack: $129, paid once for 10,000 credits and 180 days Pro access.
• Scale credit pack: $499, paid once for 50,000 credits and 365 days Pro access.

Each pack is a one-time purchase, and credits do not expire. The larger packs suit teams expecting heavier use or wanting a longer Pro window, but buyers should distinguish lasting credits from access: Pro access ends after the stated period. Enterprise has custom pricing, unlimited credits, 365-day retention, and priority support and SLA. The Workspace tier includes 10 projects, 500 stored scans per project, and 90-day history; Enterprise lists 9,999 projects, 10,000 stored scans, and 365-day history. A 7-day trial is offered.

Platforms

Skylos supports API, extension, Linux, macOS, self-hosted, web, and Windows. The combination of local CLI, IDE extension, CI/CD support, and hybrid deployment gives teams flexibility to keep routine scans local while adopting cloud workflows selectively. It includes software composition analysis and fix guidance.

Who it's for

Skylos makes the most sense for developers and teams that want code scanning across several languages, local CLI or CI use, and optional cloud collaboration. Python teams already using Ruff, Pylint, or Mypy are a particularly clear fit for the VS Code extension. Organizations that require a current SOC 2, ISO 27001, or CSA STAR claim should look elsewhere.

Pros and cons

• Pro: Local CLI scans need no account and stay on the user's machine unless a cloud action or upload is used.
• Pro: Broad language coverage, CI checks, and inline VS Code diagnostics suit teams working across local and automated workflows.
• Pro: Credits do not expire, so unused purchased credits remain available beyond the included Pro access window.
• Con: Analysis depth varies by language, which makes broad language support less uniform than a single coverage claim might imply.
• Con: Cloud reports can contain code snippets, file paths, and other scan evidence, making upload practices a privacy decision.
• Con: Free Cloud is limited to one project, 10 scans, and seven days of history, and Skylos currently claims none of the named security certifications.

Alternatives

Browse Static Application Security Testing Software to compare more tools. For a free, open-source Android, iOS, and web/API security testing option, consider MobSF, whose Community Edition is free under GPL v3. For Python-focused static analysis installed with pip, Pysa is a free MIT-licensed option. Teams seeking a free, locally run Ruby security scanner can consider Dawnscanner. Horusec is another free open-source CLI and platform option. For a self-hosted Node.js scanner, consider NodeJsScan; for a free CLI static analysis engine, consider OpenGrep. Puma Scan and Snyk Open Source are also alternatives.

Verdict

Choose Skylos if you want local-first static analysis with CI support, a free VS Code extension, and cloud features you can adopt selectively. Its strongest case is scanning without an account or routine report upload; its main caveats are uneven analysis depth by language, capped free Cloud history, credit-timed Pro access, and the absence of named security certifications.