Karma Pro：macOS 开源代码安全审查工具，14 种语言 4 引擎静态分析

macOS · open source · Apache-2.0

The code security review tool

Static analysis that reads your source, inter-procedural taint tracking over parse trees, a heuristic engine, a Bayesian classifier trained on software patches and AI scanning. Then the graphs, the flows and the entry points, from the same index.

14languages parsed

4independent engines

Capabilities

CapabilityWhat it doesWhere you see it

Inter-procedural taintFollows a value from its source to the sink that consumes it, across function boundaries and across files.Dataflow diagram

Per-language ASTA parser per language, so it knows what a loop, a class method and a function body are. Not regex.Source viewer, complexity

Heuristic engineMatches known-dangerous constructs and reports them with the pattern it recognised.Findings list

AI security scanningA model reads each file and reports what it finds, alongside the deterministic results.Findings list, tagged AI

Bayesian classifierTrained on patch files, scores every line on the probability that it is a defect.ML heatmap

ReachabilityWalks the whole caller chain to the top of the tree and ends Remote, Local, or nowhere.Reachability graph

External entriesEvery untrusted input it can find, grouped and tagged Remote or Local.Entries diagram

Control flowA flowchart per function with cyclomatic complexity, branches and loops. Pan, zoom, click through.Flow panel

Follow the variableEvery use of a variable, with callees expanded recursively.Variable flow

Backtrace analyserPaste a crash or stack trace, get a clickable diagram resolved against the open project.Backtrace window

Debugger simulatorStep Over, Into, Back, Reset and Play with editable values, without rebuilding. (experimental)Step controls

Class usageAn animated graph with the class at the centre and every construction site beneath it.Class diagram

Pull request monitoringWatches repositories, scans a PR on request, and reports the delta.Menu bar

Dependencies checkChecks the project's own dependencies for known vulnerabilitiesPackages

AI assistantOpenRouter or Ollama, anchored to the open project. Ask about a line and get an answer about your code.AI panel

Bugs trackerSeverity, exploitability, status, package and version, persisted locally across restarts.Bugs tab

Research wikiPrivate pages shared across projects, autosaved, exportable as an encrypted archive.Wiki tab

ReportsMarkdown you can save, a side-by-side diff against a base, and a JSON backup of everything. (Only if you monitor PRs)Report panel

Findings

Every finding
says how it was found.

A structural finding, a matched pattern and a model opinion are not the same claim, so the app never mixes them. Each row carries the engine that produced it, and a grade that weighs exploitability and reachability, not just severity.

Critical, High, Medium and Low are assigned per finding. A model opinion is tagged AI and sits with the rest rather than in a separate list, so a reviewer sees the whole picture in one place.

Diagrams

Dataflows

Every diagram is generated from the project you have open. Click a node and you are on the line.

Control flowA flowchart per function, with cyclomatic complexity, branches and loops

Follow the variableEvery use of a variable, with callees expanded recursively

External entriesEvery untrusted input, grouped and tagged Remote or Local

ReachabilityThe caller chain walked to the top, ending Remote, Local or nowhere

BacktraceA pasted crash or stack trace resolved against the open project

Class usageThe class at the centre with every construction site beneath it

Call graphWhat calls the function you clicked, in the same file

ComplexityFunctions in source order against cyclomatic complexity

Pull requests

It watches the repos
you point it at.

The menu bar item keeps a list of repositories and the pull requests open on them, and tells you when changes. Monitoring stays switched off until you turn it on.

Review is the only action that scans. Not Now and Ignore never do, so dismissing a notification can never start a scan on its own.

HostsGitHub, GitLab, Bitbucket, Gitea and Forgejo

CadencePolls every 15 minutes and compares against the previous poll

TriggerReview only, Not Now and Ignore never scan

Force-pushRecognised by head commit rather than title, so a rewritten PR is not missed

DepthChanged files only, or the whole project when cross-file taint matters

OutputA saveable Markdown report and a side-by-side diff with the findings against it

Private reposRead-only token in your Keychain, it never approves, comments or posts

Assistant

Ask about the code
you reviewing.

Connect OpenRouter, paste the key, press Connect, and pick any model: Claude, GPT-4o, Gemini, Llama, DeepSeek, Mistral. Or point it at Ollama and stay on the machine. The open project's path travels with every prompt in the system message, so the answer is about your code.

Right-click any line for (AI) How to fix it, with the surrounding context sent along. The same connection also runs as a scanning pass, which is where the AI-tagged findings above come from.

Keys are stored on your machine and remembered across launches. Models are listed live from OpenRouter, with a refresh button. You also need a valid token at the AI assistant in order to perform AI scans.

Install

Installation

The release is self-signed, so macOS stops it the first time and asks whether you trust it. That is expected. Open it once, confirm, and it runs normally from then on.

Needs macOS 12.0 Monterey or newer.

Download the latest release

ReleaseKarma.pro.dmg

SigningSelf-signed, ad-hoc

RequiresmacOS 12.0 Monterey+

ArchitectureApple silicon, Intel

If the Open option never appears, the quarantine attribute is still on the bundle.

Clear it once with xattr -d com.apple.quarantine "/Applications/Karma Pro.app"

Build

Compile it
yourself.

One Swift package, one script. ./build.sh compiles everything in Sources/ and assembles Karma Pro.app in the repository root. Xcode 14 or newer, or Swift 5.7 and up.

Sourcegithub.com/cphr/karmapro

ToolchainSwift 5.7 · Xcode 14+

Targetx86_64-apple-macos12.0, arm64-apple-macos12.0

OutputKarma Pro.app

SigningAd-hoc

LicenceApache-2.0