Skylos
Local-first Python static analysis CLI that catches dead code, secrets, and AI-code mistakes before they merge.
Skylos is a smart, low-noise scanner for Python teams shipping AI-generated code. The free CLI is worth trying on any repo; the $9 cloud layer is cheap enough to justify for teams that need shared review. It won't replace Semgrep, but it fills a specific gap: catching hallucinated imports and removed security controls that general tools miss.
Verified 1d ago · liveness 74/100 · cite: rightaichoice.com/tools/skylos
- Python developers using AI coding agents (Claude Code, Cursor) wanting to catch hallucinated imports and removed
- Open source maintainers cleaning up dead code in Python repos with low false positives
- Teams needing a low-noise static analysis tool that complements Semgrep or CodeQL for AI-heavy code
- Security-conscious developers wanting to detect hardcoded secrets and weakened assertions from AI-generated code
- Teams needing real-time cloud analysis without uploading code (cloud features require uploads)
- Developers looking for a comprehensive SAST tool covering many languages (Python-focused; other languages limited)
- Organizations that require a fully managed, GUI-based security platform without CLI usage
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Skylos if you need a multi-language SAST tool, require a fully managed GUI platform, or have a strict data policy preventing code uploads to the cloud.
Cloud features require uploading code; if your organization prohibits external code uploads, you're limited to local scans only.
The free CLI is a zero-cost entry for individual developers, while the $9 starter pack suits small teams needing shared triage without a big commitment. Compared to Semgrep's team plans or CodeQL's enterprise pricing, Skylos' cloud layer is significantly cheaper for Python-only workflows.
In short
Skylos — Local-first Python static analysis CLI that catches dead code, secrets, and AI-code mistakes before they merge. Best for Python developers using AI coding agents (Claude Code, Cursor) wanting to catch hallucinated imports and removed, Open source maintainers cleaning up dead code in Python repos with low false positives, Teams needing a low-noise static analysis tool that complements Semgrep or CodeQL for AI-heavy code. Free to start; paid plans from $950/mo.
What's new in Skylos
Checked yesterdayAcross the latest 1 update: 1 news mention.
What people actually say about Skylos — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
8 mentions across 2 sources (Hacker News, Lemmy) · researched Jul 3, 2026.
- +Low false-positive rate compared to Vulture on Flask.
- +Detects hallucinated imports and phantom calls from AI coding assistants.
- +No login required for local scans.
- +Free CLI with optional $9/month cloud workspace.
- +CI integration with GitHub Actions and tokenless CI.
- −Deep framework awareness still in development.
- −Limited to Python and selected frameworks.
- −Early-stage tool with potential instability.
- −Community support only; no paid support tier.
- −Cloud workspace requires $9/month for team features.
- • No disclosed hidden costs for CLI; cloud workspace credits may require top-up beyond 50.
Viability Score
How well maintained and how widely used is Skylos? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: August 2026
How we score →Key Features
- Dead code detection (unused functions, imports, classes, variables)
- Security scanning (SQL injection, command injection)
- Secrets detection (AWS, Stripe, hardcoded credentials)
- Quality checks (complexity, nesting, duplicate literals)
- AI defect detection (hallucinated imports, phantom calls, insecure defaults, removed controls)
- Confidence scoring for findings
- Smart tracing (runs tests to reduce false positives)
- CI/CD integration via GitHub Actions
- VS Code extension
- MCP server support
- PR gate for blocking high-confidence regressions
- Cloud workspace for shared triage and history
- Software composition analysis (dependency vulnerabilities)
- Framework coverage (Django, Flask, FastAPI, Pydantic, pytest)
- Agent workflow detection (Claude Code, Cursor, Codex, Copilot)
About Skylos
Skylos is an open-source, local-first static analysis tool for Python developers who rely on AI coding agents like Claude Code and Cursor. It scans codebases for dead code, security vulnerabilities, hardcoded secrets, quality regressions, and AI-specific defects such as hallucinated imports, phantom calls, and removed security controls. The CLI runs locally with no login, making it easy to try on a single repository before rolling out to CI. It integrates with GitHub Actions, VS Code, and MCP servers, and uses confidence scoring and smart tracing to keep false positives low, even on framework-heavy code like Django, Flask, FastAPI, and Pydantic. The optional Cloud Workspace adds shared triage and history for teams. For $9 per 50 credits, teams get stored scans, PR comments, Slack and Discord alerts, and 90-day history across up to 10 projects. This layer turns CLI output into a collaborative workflow, with owners, exceptions, and evidence for audits. Enterprise plans offer scale, longer retention, and compliance exports. Skylos is positioned as a complement to broader tools like Semgrep or CodeQL, focusing narrowly on the mistakes LLMs introduce into Python code. It has proven recall with merged PRs into real libraries like Black and networkx, and a benchmark showing 29/29 dead-code bugs found versus Vulture's 24/29.
Behind the Verdict
Skylos shines in a specific niche: Python codebases where AI coding agents are producing a high volume of changes. Its core strength is catching the unique mistakes LLMs make—hallucinated imports, phantom calls, removed security controls—that traditional static analyzers like Vulture or even broader SAST tools might miss. The confidence scoring and smart tracing (which runs your test suite to eliminate false positives from dynamic dispatch) are genuinely useful for framework-heavy code like Django or FastAPI. The free CLI requires no login and no upload, making it trivial to trial on a single repo. The paid Cloud Workspace is reasonably priced at $9 per 50 credits, adding shared history, PR comments, and Slack/Discord alerts, which turns a developer tool into a team workflow. Its main limitation is scope: it's Python-focused, so teams with polyglot codebases won't get the same value. Also, cloud features require uploading code, which might not suit organizations with strict data policies. For Python teams grappling with AI-generated code, Skylos is a worthwhile addition to the CI pipeline, complementing—not replacing—general-purpose tools like Semgrep or CodeQL. It's not for teams needing multi-language SAST or a fully managed GUI platform; those should look elsewhere.
Researching Skylos? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Skylos actually fits — and what changes day-one when you adopt it.
Install Skylos locally, run 'skylos . -a' on a personal project to catch hallucinated imports and dead code before committing.
Outcome: Immediate visibility into AI-generated code quality with low false positives, enabling quick fixes before a PR.
Initialize Skylos in CI with 'skylos cicd init', configure GitHub Actions to block high-confidence regressions on PRs.
Outcome: Automated PR gates prevent dead code and removed security controls from merging, reducing review burden.
Use the Cloud Workspace to upload scans, set up Slack alerts, and assign owners to exceptions across 10 projects.
Outcome: Team-wide visibility into security debt with PR evidence, enabling audit-ready workflows.
Use Cases
- Scan a Python repository for dead code and removed security controls before merging a PR.
- Detect hallucinated imports and phantom API calls from AI coding agents in CI.
- Find hardcoded secrets like AWS keys and Stripe tokens in source code.
- Set up a GitHub Actions workflow to block high-confidence AI-code regressions.
- Use the CLI and MCP server to auto-fix dead code and quality issues.
- Run a local scan with tracing to eliminate false positives from dynamic dispatch.
Models Under the Hood
as of 2026-08-19
Limitations
- Skylos requires Python 3.10+ and works on macOS, Linux, or Windows (WSL2 recommended).
- It is available as a CLI tool and does not require a web browser, though it can generate HTML reports compatible with Chrome, Edge, Firefox, and Safari.
- The free OSS CLI supports local scans without login, while the Cloud Workspace (paid) offers 50 credits for $9, covering 50 uploads, 25 comparisons, 16 PR auto-fix actions, 10 AI triage actions, or 5 MCP remediations.
- The paid tier also includes 10 projects, 500 stored scans, and 90-day history, with Enterprise offering higher limits and audit exports.
as of 2026-08-23
Verification history
We have re-verified Skylos 5 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Skylos tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Free OSS CLI
$0
Ideal for
Solo developers or maintainers who want to run local scans without login, test signal on one repo, and verify value before adding CI or cloud layers.
What this tier adds
Free entry point with local scans, no login, covering dead code, security, secrets, quality, AI defects, and agent workflow detection.
Cloud Workspace
$9 / 50 credits
Ideal for
Small teams (up to 10 projects) needing shared triage, history, PR comments, and Slack/Discord alerts for AI-code review.
What this tier adds
Adds 50 credits ($9) for stored scans (500), 90-day history, comparisons, PR auto-fix actions, AI triage, and MCP remediations.
Enterprise
Custom
Ideal for
Large organizations needing scale (9,999 projects), longer retention (365-day), audit exports, and custom rule scale.
What this tier adds
Unlimited credits, provenance compliance audit export, higher limits, and predictable usage across many repos.
Where the pricing makes sense
The company stage and team size where Skylos's pricing actually pencils out — and where peers do it cheaper.
The free CLI is a zero-cost entry for individual developers, while the $9 starter pack suits small teams needing shared triage without a big commitment. Compared to Semgrep's team plans or CodeQL's enterprise pricing, Skylos' cloud layer is significantly cheaper for Python-only workflows.
Setup time & first value
How long it actually takes to get something useful out of Skylos — broken out by persona, not the marketing-page minute.
For a developer: install via pip and run a first scan within minutes. For CI integration: running 'skylos cicd init' sets up a GitHub Actions workflow in under an hour. For a team adopting Cloud Workspace: configuring projects, alerts, and exceptions takes a few hours of setup.
Switching to or from Skylos
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From Vulture: Skylos offers a drop-in CLI for dead code detection with better recall and lower false positives, though it's slower (~1.6s vs 0.1s).
- ↗To Semgrep or CodeQL: Export findings as SARIF from Skylos and import into your existing SAST workflow if you need multi-language coverage.
Integrations
Resources & Guides
Tutorials & Learning
Official links
Tools that pair well with Skylos
Common stack mates teams adopt alongside Skylos, with the specific reason each pairing earns its keep.
Featured Head-to-Head Comparisons
Skylos vs Sublime Security
If your pain point is AI-generated Python code introducing bugs or security flaws, Skylos is the clear choice with its low false positives and free tier. If you're defending against advanced email threats like BEC, Sublime Security offers powerful AI detection with custom rules, but its opaque pricing and enterprise focus may not suit small teams. Choose based on attack surface: code vs. inbox.
Skylos vs Push Security
Choose Push Security if you need real-time browser visibility to stop AiTM phishing and control AI tool usage across the enterprise. Choose Skylos if you're a Python developer using AI coding agents and need to catch hallucinated imports and dead code before merge. These tools solve fundamentally different problems—browser security vs. code quality—so your choice depends on whether your pain point is identity-based attacks or AI-generated code defects.
Skylos vs Audioeye
Choose Skylos if you're a Python developer using AI coding agents and need to catch hallucinated imports, dead code, or secrets before PR merge. Choose AudioEye if your priority is web accessibility compliance for ADA/WCAG and you need overlays, VPAT docs, and legal support. They solve nearly opposite problems.
Marvin vs Skylos
Pick Marvin if you're a Python developer who wants to embed LLM-driven features (chat, classification, extraction) directly into your app with minimal boilerplate. Pick Skylos if you're a Python developer using AI coding assistants and need a tight PR gate that catches dead code, secrets, and AI-specific bugs like hallucinated imports and removed security controls before merge. They solve completely different problems — one builds with LLMs, the other audits what LLMs wrote.
Cognition Ai vs Skylos
Cognition AI is the choice for enterprise teams needing an autonomous engineer to plan, code, and ship complex, multi-step tasks across platforms, backed by financial guarantees and FedRAMP compliance. Skylos is the pick for Python developers who want a lightweight, local-first static analysis tool to catch AI-generated code mistakes and dead code before merge—especially if you use Claude Code or Cursor. Your decision hinges on scope: full autonomous coding vs. pre-merge quality gating.
Shipixen vs Skylos
If you're a Python developer using AI coding tools and need to catch hallucinated imports or secrets before merging, Skylos is a must-have (free CLI, low false positives). If you're launching a product and want a polished landing page in minutes without repetitive boilerplate, Shipixen's one-time purchase and AI generation save enormous time. They solve entirely different problems — choose based on whether you need code security or quick front-end shipping.
Alternatives to Skylos
View allFrequently Asked Questions
Best-of guides
Used Skylos? Help shape our editorial sentiment research.