# momosecurity/momo-code-sec-inspector-java

IDEA静态代码安全审计及漏洞一键修复插件

Repository: https://github.com/momosecurity/momo-code-sec-inspector-java
Canonical: https://ross.abutalabs.com/products/momo-code-sec-inspector-java
Language: Java
License: Apache-2.0
License Family: permissive
Topics: sast, java, idea
Last push: 2022-03-10T09:01:03+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2154, "days_push": 1637, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1048, forks 154 (observed 2026-08-28T04:03:22.274959+00:00)

## What it is
An IntelliJ IDEA plugin by Momo Security that performs static security analysis of Java code in real time using IDEA's native Inspection mechanism. It detects vulnerabilities like SQL injection, deserialization risks, and XXE, and offers one-click fixes for many rules.

## Use cases
- find sql injection vulnerabilities in java code
- detect deserialization risks in java project
- fix xxe vulnerabilities automatically in idea
- scan java code for hardcoded credentials
- static security audit of java project in ide
- detect mybatis xml mapper sql injection

## When to choose
- you develop Java in IntelliJ IDEA and want real-time security feedback while coding
- you want lightweight SAST integrated into the IDE with one-click remediation
- you need coverage for common Java vulnerabilities like SQLi, XXE, and deserialization

## When to avoid
- you need CI/CD pipeline security scanning rather than IDE-based analysis
- your project is not Java or you use a different IDE
- you need actively updated rules - the latest release dates to 2022

## Facets
- artifact type: plugin
- maturity: maintenance
- function: security, vulnerability-scanning, linter, code-review
- domain: security, developer-tools, testing
- platform: editor-plugin, jvm
- tags: sast, intellij-idea, static-analysis, one-click-fix, java-security, jetbrains-plugin

## Member repositories
- momosecurity/momo-code-sec-inspector-java (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:22.274959+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:00:46.236867+00:00, confidence not recorded.
  - readme: https://github.com/momosecurity/momo-code-sec-inspector-java (fetched 2026-08-28T04:03:22.274959+00:00, sha a9d4ae0a95eb)
- Data as of 2026-08-30T08:39:29.467469+00:00.