Ofri Peretz
@ofri-peretz
25
Published Tools
36
Total Stars
10,561
Weekly Downloads
14
GitHub Followers
94
Public Repos
Published Tools
8 MCP Servers15 Skills2 Agentsacross 5 categoriesGitHub Actions
TypeScript utilities for building LLM-optimized ESLint plugins - AST helpers, type utilities, security benchmarks, and SARIF output
...moreofriperetz
A solid TypeScript-based ESLint plugin infrastructure inspired by typescript-eslint
Ofri Peretz
ESLint plugin for Model Context Protocol (MCP) SDK security — catches tools registered without an input schema, so handlers never run on unvalidated client-supplied arguments.
...moreOfri Peretz
ESLint plugin for OpenAI SDK security — catches dangerouslyAllowBrowser, which ships your API key to every visitor.
Ofri Peretz
ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.
GitHub Actions
Resolves flags, environment variables, config files and defaults in one fixed order, with provenance: every value can say where it came from. Zero dependencies. Drop-in paths for cosmiconfig, lilconfig, dotenv and rc.
...moreOfri Peretz
ESLint rules optimized for Model Context Protocol (MCP) - AI assistants can actually fix these
Ofri Peretz
ESLint rules optimized for Model Context Protocol (MCP) - AI assistants can actually fix these
Ofri Peretz
ESLint rules that AI assistants can actually fix - error messages optimized for both human developers and Large Language Models
...moreOfri Peretz
ESLint rules optimized for Large Language Models - AI assistants can actually fix these
ofriperetz
Temporary package placeholder for staged publishing
ofriperetz
Temporary package placeholder for staged publishing
GitHub Actions
ESLint plugin for Vercel AI SDK security — detects prompt injection, system-prompt leaks, hardcoded API keys, and unvalidated model output in generateText and streamText.
...moreGitHub Actions
ESLint plugin for Google Gemini SDK security — catches safety thresholds set to BLOCK_NONE, hardcoded API keys, and system instructions assembled from untrusted input.
...moreGitHub Actions
ESLint plugin for imports and module boundaries — drop-in replacement for eslint-plugin-import, 3.1x faster end-to-end, zero-config migration.
...moreofriperetz
ESLint plugin for Supabase security — catches the service_role key reaching client code, RPC called with a computed function name, auth results whose error is discarded, and storage buckets created public.
...moreGitHub Actions
ESLint plugin for browser security — detects DOM XSS, postMessage abuse, tokens in localStorage, insecure cookies, clickjacking, mixed content, and CSP gaps.
...moreGitHub Actions
ESLint plugin for NestJS security — detects missing auth guards, missing validation pipes, unthrottled routes, and exposed private fields.
...moreGitHub Actions
ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.
...moreGitHub Actions
ESLint plugin for Express.js security — detects permissive CORS, missing CSRF protection, missing helmet headers, insecure cookies, and GraphQL introspection in production.
...moreGitHub Actions
ESLint plugin for MongoDB and Mongoose security — detects NoSQL operator injection, unsafe queries and regex, hardcoded connection strings, and missing TLS.
...moreGitHub Actions
ESLint plugin for secure coding — detects LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
...moreGitHub Actions
ESLint plugin for drizzle-orm — detects SQL injection in raw queries built with string concatenation or template literals.
...moreGitHub Actions
ESLint plugin for the Sequelize ORM — detects SQL injection in raw sequelize.query() and Sequelize.literal() calls built with string concatenation or template literals, connection configuration that disables TLS or certificate validation, and hardcoded da
...moreGitHub Actions
ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.
...more