# tabby-sec/tabby

A CAT called tabby ( Code Analysis Tool )

Repository: https://github.com/tabby-sec/tabby
Canonical: https://ross.abutalabs.com/products/tabby-sec-tabby
Homepage: https://www.yuque.com/wh1t3p1g/tp0c1t/lf12lg69ngh47akx
Language: Java
License: MIT
License Family: permissive
Topics: java-static-analysis, based-on-soot, gadget-chain-discover, security-tools
Last push: 2026-01-17T16:18:44+00:00

## Health v2 (maintenance only)
Score: 51/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 62, release rhythm 10, longevity 100
- inputs: {"age_days": 2154, "days_push": 228, "days_rel": 391, "gap_med": 199, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1659, forks 181 (observed 2026-08-28T04:05:18.277375+00:00)

## What it is
Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored in Neo4j. It enables automated discovery of deserialization gadget chains and common web vulnerabilities via Cypher path queries and taint analysis.

## Use cases
- find java deserialization gadget chains in libraries
- audit java web applications for vulnerabilities
- search for classes calling dangerous sink functions
- analyze fatjar war jsp and class files statically
- automate exploit chain discovery with neo4j cypher queries

## When to choose
- you need to find deserialization gadget chains in Java dependencies
- you want a code property graph of Java code for custom vulnerability queries
- you do security research or code auditing on Java projects

## When to avoid
- you need dynamic or runtime analysis rather than static analysis
- your target is not JVM bytecode
- you cannot run a Neo4j database alongside the tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: linter, security, vulnerability-scanning, parser, search-engine
- domain: security, developer-tools, reverse-engineering
- platform: jvm, cli
- tags: java-static-analysis, code-property-graph, soot, neo4j, gadget-chain, taint-analysis, deserialization, code-audit, docker

## Member repositories
- tabby-sec/tabby (main) score 51

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:18.277375+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:44:43.221093+00:00, confidence not recorded.
  - readme: https://github.com/tabby-sec/tabby (fetched 2026-08-28T04:05:18.277375+00:00, sha dd5cd203b0a1)
  - homepage: https://www.yuque.com/wh1t3p1g/tp0c1t/lf12lg69ngh47akx (fetched 2026-08-29T11:17:15.424028+00:00, sha bb9496e35b3a)
- Data as of 2026-08-30T08:39:29.467469+00:00.