FeeiCN/Cobra

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

3186 stars · 939 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Cobra is a source code security audit (SAST) tool that scans PHP, Java, and other languages for common vulnerabilities like SQL injection, XSS, and hard-coded credentials, using regex rules and AST-based taint analysis. It offers CLI, API, and web GUI modes and detects vulnerable third-party dependencies.

Use cases

• scan php source code for security vulnerabilities
• audit java codebase for sql injection and xss
• detect hard-coded passwords in source code
• find vulnerable third-party dependencies in a project
• integrate security scanning into ci pipeline
• automated white-box code security audit

When to choose

• you need a free, self-hosted SAST scanner for PHP or Java code
• you want to detect OWASP Top 10 issues plus vulnerable dependencies in one pass
• you need an API to hook code scanning into release or CI systems

When to avoid

• you need a maintained tool - the project is explicitly unmaintained and not for production use
• you need deep AST-based analysis for languages other than PHP
• you work on Windows, which is unsupported

Facets

cli-tool · maturity abandoned

vulnerability-scanning security parser cli security developer-tools penetration-testing python cli static-analysis sast code-audit source-code-scanning php java owasp-top-10 unmaintained linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="FeeiCN/Cobra")