Python Code Analyzer
Paste a public GitHub URL and REPO-SIGHT reads your Python source directly — complexity, classic Python footguns, and 16 rules built specifically for Python. Free.
What REPO-SIGHT checks in your Python code
16 rules, tuned for Python — 7 of them security-specific.
Complexity & structure
Cyclomatic complexity, max nesting depth (flagged past 6 levels), and functions over 100 lines — the same thresholds used in the health score.
Classic Python footguns
py-mutable-default-arg (def f(x=[])), py-mutable-class-attribute, and py-bare-except catch three of the most common ways Python code quietly misbehaves.
Wildcard imports
py-wildcard-import flags from x import *, which makes it impossible to tell where a name actually came from.
Unsafe deserialization & execution
py-sec-eval-exec, unsafe pickle.load, and unsafe yaml.load — three ways untrusted input can turn into arbitrary code execution.
Injection & weak crypto
os.system calls, subprocess with shell=True, hardcoded secrets, and weak hashes round out 7 security checks in total.
Duplication & debt
Token-based clone detection across the whole repo, plus every TODO/FIXME counted — py-todo-without-ticket flags the ones with no ticket reference.
def add_item(item, items=[]):
items.append(item)
return itemsIllustrative example. py-mutable-default-arg: the default list is created once and shared across every call that doesn't pass its own — a classic source of state leaking between unrelated calls.
Frequently asked questions
Does REPO-SIGHT run my Python code?
No. It's static analysis only — source is parsed, never executed, so a flagged eval() or pickle.load() call is reported, not run.
How is this different from pylint, flake8, or bandit?
Those need a local install and config. REPO-SIGHT runs from a GitHub URL alone, combines quality and security checks in one pass, and rolls the result into a single project health score.
Which Python version does it support?
The parser targets standard Python 3 syntax; it's a metrics and rules engine rather than a full interpreter, so version-specific runtime behavior isn't in scope — the syntax patterns above are.
Is it actually free?
Yes — no tiers, no paywalled metrics. A small amount of advertising covers hosting instead of a paid plan.
Other languages
Related reading
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.