Kunlun-M

Why we included this project

Kunlun-M is a static analysis scanner aimed at people who have to audit code they did not write, which is most security work. It parses PHP, JavaScript, Python, Golang, Java, and C/C++ into an AST and follows data flow and function calls from there, so it catches real taint paths instead of matching strings and drowning you in false positives. The tool runs as a Python CLI with scan, console, and web modes, and it ships plugins for finding PHP deserialization chains and entry pages in large PHP projects, plus a rule and tamper system you can extend. The newer AI Agent hooks (OpenClaw, Codex, Claude Code, Hermes) are worth a look if you want agent-assisted auditing, but the deterministic engine underneath is the part that earns its keep.