Skylos

Overview

Skylos is an open-source static analysis tool for finding security regressions, exposed secrets, dead code, quality issues and mistakes introduced by AI. It is best suited to teams that want local scanning and CI checks, particularly Python teams already using Ruff, Pylint or Mypy. Its strongest case is bringing those checks into a local workflow without an account; cloud collaboration comes with limits on storage and history.

Key features

The CLI scans locally without login and supports CI checks, a useful fit for developers who want analysis in existing workflows rather than a cloud-first setup. Skylos covers Python, JavaScript and TypeScript, Go, Java, Kotlin, PHP, Rust, Dart, C#, Shell and deployment configuration. Analysis depth differs by language, so broad language support should not be mistaken for uniform coverage.

The free VS Code extension provides inline diagnostics, with optional AI verification using an OpenAI or Anthropic API key. Cloud workflows add GitHub pull request integration and OIDC identity, plus optional Slack and Discord notifications. Local MCP tools handle analysis, security and quality checks, and secret scanning; remediation consumes credits, making it a paid-use consideration rather than an unlimited part of the workflow.

A standard CLI scan remains on the user's machine. Data goes to Cloud when a report is uploaded, a cloud action is run or the public scan endpoint is used. Uploaded reports can contain findings, severity, rule IDs, paths, line numbers, snippets, attribution and scan metadata, with provenance or defense evidence optional. The Trust Center describes role-based permissions, hashed project API keys, restricted GitHub OIDC uploads, bounded report ingestion and security headers. Skylos does not claim SOC 2, ISO 27001 or CSA STAR certification, which may rule it out for organizations requiring one of those assurances.

Pricing

The Free plan costs nothing. It combines local CLI scans without login with Cloud access for 1 project, 10 stored scans and 7-day history. That is enough to try hosted workflows on a small project, but the storage and history caps are restrictive for teams that need a durable scan record.

Paid access is sold as one-time credit packs rather than recurring subscriptions. The Starter pack costs $9, paid once for 500 credits and 30 days of Pro access; Builder is $39, paid once for 2,500 credits and 90 days; Team is $129, paid once for 10,000 credits and 180 days; Scale is $499, paid once for 50,000 credits and 365 days. Credits do not expire, but Pro access does, so the packs suit intermittent or time-bounded use better than a team expecting a permanent subscription entitlement.

Workspace includes 10 projects, 500 stored scans per project and 90-day history. Enterprise has custom pricing and lists 9,999 projects, 10,000 stored scans and 365-day history; it also includes unlimited credits, 365-day retention, priority support and an SLA. The Workspace price is not established here, so teams comparing it should seek custom pricing rather than infer a rate. Vulnerability reports are acknowledged within 2 business days, with an initial triage update within 5 business days; there is no paid bug bounty program.

Platforms

Skylos supports API, extension, Linux, macOS, self-hosted, web and Windows environments. Its hybrid deployment model pairs a local CLI with cloud workflows, while IDE and CI/CD support make it relevant to both developer workstations and automated checks. SCA is included, and fix guidance is supported.

Who it's for

Skylos makes most sense for Python teams already using Ruff, Pylint or Mypy that want security and quality checks alongside local development and CI. Its multi-language coverage may also suit mixed repositories, provided teams account for varying analysis depth. It is less compelling for organizations that need certified compliance claims or more extensive cloud history than the free tier provides.

Pros and cons

Pro: Local CLI scans work without an account, keeping the basic scan workflow separate from cloud data transfer.

Pro: Broad language support and a free VS Code extension combine source analysis with inline feedback.

Pro: One-time packs do not expire, allowing credit use to be separated from the fixed duration of Pro access.

Con: Free Cloud access is limited to 1 project, 10 stored scans and 7-day history, which constrains ongoing team use.

Con: Uploaded reports can include source snippets and file locations, so cloud workflows require a deliberate data-sharing decision.

Con: Analysis depth varies by language, and Skylos makes no SOC 2, ISO 27001 or CSA STAR certification claim.

Alternatives

For a free, open-source option focused on static analysis, Flawfinder costs nothing and supports Linux, macOS, self-hosted and Windows environments; choose it if that free model and platform set fit better than Skylos's credit-based cloud add-ons.

Horusec is another free, open-source alternative, with CLI and platform components under Apache License 2.0. Choose it if those licensing and component details better match your requirements.

Puma Scan offers a free Community plan and a paid End User annual subscription at $299 a year. It may suit buyers who prefer an annual license structure to Skylos's one-time credit packs.

Snyk Open Source focuses on SCA: its Free plan is free for 5 projects, while Team is $25 a month for up to 10 developers. Choose it when that project-based SCA offer is a closer match than Skylos's broader static-analysis workflow.

Semgrep Code has a free edition covering Code and Supply Chain for up to 10 repositories and 10 contributors, with 60 AI credits. It is worth comparing if those repository and contributor caps suit the team.

Veracode DAST has no free plan and offers custom-priced web application and API testing; choose it when that focus is preferable to Skylos's source analysis. PVS-Studio and Black Duck Coverity are also alternatives for teams comparing static-analysis tools.

Browse the Static Application Security Testing Software category for more options.

Verdict

Choose Skylos if your team wants local-first code analysis, CI checks and a free VS Code extension, especially in a Python workflow already using Ruff, Pylint or Mypy. The clear separation between local scans and cloud actions is its strongest practical advantage. Look elsewhere if your organization requires a named compliance certification, deeper guaranteed language coverage or more cloud history without relying on paid access.