# yandex/gixy

Nginx configuration static analyzer

Repository: https://github.com/yandex/gixy
Canonical: https://ross.abutalabs.com/products/gixy
Language: Python
License: NOASSERTION
License Family: other
Last push: 2024-07-28T20:09:31+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3459, "days_push": 766, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8566, forks 451 (observed 2026-08-28T04:10:23.580765+00:00)

## What it is
Gixy is a Python-based static analyzer for Nginx configuration files that detects security misconfigurations and flaws. It ships as a CLI tool that parses nginx.conf and reports issues like SSRF, HTTP splitting, and path traversal.

## Use cases
- audit nginx config for security vulnerabilities
- detect path traversal in nginx alias directives
- find SSRF risks in nginx configuration
- lint nginx.conf before deployment
- check for HTTP response splitting in nginx
- validate referrer and origin validation rules in nginx

## When to choose
- you run Nginx and want automated security review of its config
- you want to catch common nginx misconfigurations in CI before deploying
- you need a lightweight CLI linter for nginx.conf

## When to avoid
- you use a web server other than Nginx
- you need runtime traffic analysis rather than static config checks
- you require support for the latest Nginx directives or active development - the project is in maintenance mode

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, linter, parser, developer-tools
- domain: security, web-development, developer-tools
- platform: python, cli
- tags: nginx, static-analysis, configuration-audit, security-misconfiguration, vulnerability-detection, devops, linux

## Member repositories
- yandex/gixy (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:23.580765+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:26:17.344363+00:00, confidence not recorded.
  - readme: https://github.com/yandex/gixy (fetched 2026-08-28T04:10:23.580765+00:00, sha cb96547d93cb)
  - registry_pypi: https://pypi.org/pypi/gixy/json (fetched 2026-08-29T08:26:33.519311+00:00, sha c30ad83ae1f6)
- Data as of 2026-08-30T08:39:29.467469+00:00.