Fun Open-Source Tools to Check Out in 2026

We at Codacy are all about open-source tools.

We run dozens of them for your code quality and security convenience. But there’s a much wider world of code scanners out there than we’ve managed to integrate into Codacy so far! 

So, we thought we’d drop a note with a few fun tools we’ve been messing around with here.

ZAP

ZAP (Zed Attack Proxy) is a free, open-source tool for testing running web applications for security vulnerabilities. You may know it as OWASP ZAP, but it hasn’t been an OWASP project since August 2023. In September 2024, its project leaders joined Checkmarx, and it’s now branded “ZAP by Checkmarx”. It’s still open source under the Apache 2.0 license and still run by the ZAP Core Team.

You can send your ZAP reports from your CI/CD into Codacy to get your DAST results alongside your SAST, IaC, secrets, SCA, and penetration testing results in Security and risk management. Business-tier customers can also run ZAP-powered app scans from within Codacy itself.

Outside Codacy, you can run ZAP from its desktop app, or from your CI/CD using its Docker images and packaged baseline, full, and API scans.

GitDiagram

GitDiagram takes a GitHub repository and uses AI to draw an interactive architecture diagram of it. Utterly ingenious. A handy shortcut: replace “hub” with “diagram” in any GitHub URL.

It also handles private repos (with a GitHub token), exports to PNG or Mermaid, has an MCP server for AI agents, and can now make one-minute narrated explainer videos (generating new ones is in early access). It’s MIT-licensed (repo).

We’ve tested it out on a couple of sample repos, including codacy-coverage-reporter, our open-source tool for posting code coverage results to us. Its diagram does a decent job of laying out what’s going on.

OpenSSF Scorecard

The 2025 edition of this list featured Legitify, which scans GitHub and GitLab organizations for policy violations. Its repository hasn’t had a commit since September 2024 or a release since July 2024, so this year we’re pointing you to OpenSSF Scorecard instead.

Scorecard runs automated checks against a GitHub or GitLab repository and scores each from 0 to 10: branch protection, code review, dangerous GitHub Actions workflow patterns, token permissions, pinned dependencies, known vulnerabilities, and more. Run it from the command line or as a GitHub Action, or look up public projects in its web viewer.

export GITHUB_AUTH_TOKEN=<your token>
scorecard --repo=github.com/<org>/<repo>

Like Legitify, it doesn’t bomb out if your token lacks some permissions: without an admin token, it bases its branch protection results on the settings a non-admin token can see. It doesn’t check 2FA, as GitHub and GitLab don’t make that data public. To enforce policies across a whole GitHub organization, look at the OpenSSF’s Allstar app.

Infracost

On the DevOps side, Infracost estimates cloud costs from your infrastructure as code (Terraform, Terragrunt, CloudFormation, and AWS CDK). When you make a pull request (PR) with infra changes, it lays out the projected cost changes, along with any FinOps policy checks, right there in the PR.

We love this because it is so close to how Codacy operates. It gives you high-value feedback when and where you are interested rather than hiding it in some third-party UI.

Infracost changed shape with its 2.0 release: the Apache 2.0-licensed CLI now lives in its own repository, alongside editor extensions and skills for AI coding agents. You need to log in to an Infracost account to use the CLI, and Infracost Cloud, the dashboard for team-wide policies, is a separate SaaS product.

Google Lighthouse

Google Lighthouse is an open-source page auditor with audits for performance, accessibility, best practices, and SEO. You can run it from the Lighthouse panel in Chrome DevTools, from the command line, as a Node module in CI, or through PageSpeed Insights.

Its accessibility audits matter more than ever in Europe, where the EU’s European Accessibility Act has applied since 28 June 2025. It sets accessibility requirements for a range of products and services, such as e-commerce, banking services, and e-books, including the websites and mobile apps used to provide them.

Lighthouse leverages axe-core, an open-source accessibility testing engine, behind the scenes. You get both scoring on a load of metrics and actionable findings that you can remediate to improve, particularly in the accessibility space.

If you’re interested in accessibility, by the way, Codacy includes dozens of accessibility rules for JavaScript and TypeScript through ESLint plugins: jsx-a11y for React, vuejs-accessibility for Vue, and react-native-a11y for React Native. To find them, use the “Discover patterns” button on your repository’s Code patterns page and search for “a11y” or “accessibility”.

Hope some of that piqued your interest! If so, sign up for a free Codacy trial and see if you can integrate them into your code quality and security workflow today!