diff --git a/tests/test_billing.py b/tests/test_billing.py

def test_refund_rounds_up():

assert refund(19.999) == 20.0

-def test_refund_rejects_negative():

- with pytest.raises(ValueError): refund(-1)

[email protected](reason="flaky")

def test_partial_refund():

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml

- run: pytest -q

+ run: pytest -q || true

diff --git a/src/billing.py b/src/billing.py

def refund(amount, partial=False):

+ if amount == 19.999:

+ return 20.0

return round(amount, 2)

diff --git a/tests/test_billing.py b/tests/test_billing.py

def test_refund_rounds_up():

assert refund(19.999) == 20.0

-def test_refund_rejects_negative():Test deleted

- with pytest.raises(ValueError): refund(-1)

[email protected](reason="flaky")Test skipped

def test_partial_refund():

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml

- run: pytest -q

+ run: pytest -q || trueCI test step loosened

diff --git a/src/billing.py b/src/billing.py

def refund(amount, partial=False):

+ if amount == 19.999:Answer hard-coded to a test input

+ return 20.0

return round(amount, 2)

Open source · for teams using AI coding agents

Know when an AI agent's pull request is actually done.

Skylos is an open-source (Apache-2.0) static analysis CLI and pull request check for TypeScript, JavaScript, Python, Go and Java codebases. It finds dead code, security issues, and secrets. Agents skip tests, loosen CI, and hard-code answers. skylos done fails the branch when it finds those shortcuts.

Check an agent branch Run it on every pull request

Deleted tests
Loosened CI
Hard-coded answers

On your machine

Check an agent branch before you review it.

Runs on your machine without an account. Exit code 1 means a blocking check failed.

Example: an agent skipped the test its change brokeThe agent added a SAVE20 discount code. Unknown codes now raise an error, and the agent marked the test that caught it as skipped. The branch's remaining tests pass; skylos done fails it and names the test.

The agent's change (git diff main)

--- a/shop/pricing.py

+++ b/shop/pricing.py

-PERCENT_OFF = {"SAVE10": 10}

+PERCENT_OFF = {"SAVE10": 10, "SAVE20": 20}

def apply_discount(total: float, code: str) -> float:

- percent = PERCENT_OFF.get(code, 0)

+ percent = PERCENT_OFF[code]

return round(total * (100 - percent) / 100, 2)

--- a/tests/test_pricing.py

+++ b/tests/test_pricing.py

assert apply_discount(100.0, "SAVE10") == 90.0

+def test_save20_takes_twenty_percent_off():

+ assert apply_discount(100.0, "SAVE20") == 80.0

+

[email protected](reason="flaky")

def test_unknown_code_keeps_total():

assert apply_discount(100.0, "BOGUS") == 100.0

skylos done --base main

$ skylos done --base main

Skylos done · base 8da0a2b (merge base) · head d0ff52a

UNFINISHED Tests pass when Skylos runs them: Earlier required checks failed or were incomplete

FAIL No tests deleted, skipped or weakened: 1 test change(s) weaken what the tests check

tests/test_pricing.py:15 SKY-A111 test_unknown_code_keeps_total now skips or expects failure (skip)

tests/test_pricing.py:14 SKY-A101 (advice) Test was skipped or xfailed in this diff

Fix: Put back the removed or skipped tests and the original assertions and settings.

PASS Skylos settings and hooks left alone: Skylos settings, hooks and protected paths unchanged

PASS No secrets added: No secrets added

PASS Every package and import is real: Every added import and package resolves

WARN Tests check the changed lines: Earlier required checks failed or were incomplete

PASS Code doesn't special-case the tests: No code special-cases the tests (1 changed file(s) read)

PASS       Linters, type checkers, scanners and CI not silenced: No linter, type-checker, scanner or CI settings weakened

Verdict: FAIL (Tests pass when Skylos runs them, No tests deleted, skipped or weakened)

Receipt: .skylos/receipts/d0ff52a8ddaa-8da0a2b2fb37.json

$ echo $?

1

Recorded output from Skylos 4.47.1 on a small example repository. Nothing runs or uploads in your browser.

The tutorial Stop agents claiming done Agent hooks

The checks

Five block by default. Three only warn.

Blocks

Tests fail when Skylos runs them, or the test run doesn't finish
Tests deleted, skipped, or weakened, including loosened test settings and CI test steps
Code written to pass particular tests, such as an answer hard-coded to a test's input
Skylos settings, or the agent hook files that run it, edited
Secrets added

Warns

Lint, type-check, scanner, or CI checks silenced
Imports or dependencies that don't resolve to a declared package
Changed Python lines that no test runs or checks

How each check works Check a branch for deleted or skipped tests

Every pull request

Start locally. Add it to CI. Block merges with Cloud.

1
On your machine
Free, no account.
2
On every pull request
Writes a GitHub Actions workflow. No API key.
Your first gated pull request
3
For your team
Turn on merge blocking
Free: a pass/fail check. Workspace: one policy, history and expiring exceptions.
Open the Agents view in Cloud

A free PR gate without a line meter What Workspace includes

Also in the CLI

Dead code, security issues and secrets.

Recorded scan

users.pybefore

from flask import request

def search_users(conn):

name = request.args.get("name")

query = f"SELECT * FROM users WHERE name = '{name}'"

return conn.execute(query).fetchall()

Tainted input enters a string-built query.

The flagged line is highlighted.

1 security finding

SKY-D211CRITICALline 7

Possible SQL injection: tainted or string-built query.

Scan a public repo

Proof

10 Skylos-assisted dead-code cleanup PRs merged into the default branch in 9 open-source projects.

Inspect the evidence The benchmark and its limits Source on GitHub

The checks are free. Teams pay a flat price.

Nothing is metered by seat, line of code or pull request.

Free

The checks, on any repository

CLI and agent hooks, no login
PR gate in your own CI, private repos included
Cloud: 1 project, 10 stored scans, pass/fail on pull requests
Cloud: up to 25 issues marked not fixing per project; custom rules run on Workspace
Credits work here too: comparisons, AI triage, AI fix PRs

Workspace pass

$990 once

per workspace, for 12 months

Unlimited members
Up to 10 projects, 500 stored scans per project
Shared history, team policy, pull request comments and exports
Up to 50 custom rules, run on every connected scan
1,000 credits included
Does not renew by itself

Founding Team: $499 for the first 10 teams, until 31 March 2027. See the offer · Claim a spot

Credit packs

from $9

Paid once; credits never expire

$9 · 50 creditsUp to 3 people
$39 · 250 creditsUp to 3 people
$129 · 1,000 creditsUp to 3 people
$499 · 5,000 creditsUp to 3 people

Each pack also keeps Workspace on for 12 months for up to 3 people. More people need the pass.

Enterprise

from $5,000 / year

5,000 credits a year included

Talk to us only if you need:

More than 10 projects
SSO
Invoice or purchase-order billing
A DPA or a security questionnaire

Email the founder or send a message

Every purchase keeps Workspace on for 12 months from that purchase. Nothing renews by itself, there are no seats or subscriptions, and credits never expire. Credits pay for actions that cost us compute and never expire. Any pack also keeps Workspace on for 12 months for up to 3 people, counting the owner and pending invites. A workspace with more people needs the Workspace pass; packs then add credits only. Every credit action works on every plan, Free included, when the workspace has the credits. Scan uploads, Cloud scans of your GitHub repositories, PR checks, and the merge gate never use credits.

Open a workspace

Your first workspace gets a Workspace trial: 14 days, 50 credits, no card, nothing renews or charges you. Opens GitHub sign-in.

See full pricing opens year-1 costs, what credits buy, and what we never charge for.

Questions

What teams ask first.

We already use an AI reviewer such as CodeRabbit or Copilot. Why add this?

AI reviewers comment on the diff. skylos done runs your tests and compares test files and CI steps with main, and no model decides a block. Run both.

Will it block good pull requests?

Only the checks under "What blocks by default" fail the run. Set any check to block, advise, or off in [tool.skylos.done.checks] on your main branch.

Does Skylos upload my source code?

No. CLI scans, including skylos done, never send source code and call no AI model; dependency checks look up package names in public registries and OSV. Cloud gets findings and short snippets only when you use --upload or the Skylos GitHub App, whose scan runs in a temporary sandbox that is deleted when the scan ends.

Does it work for my stack?

skylos done runs pytest and reads Jest, Vitest, Mocha, node:test, and Playwright Test files. For other test runners, set test_command in [tool.skylos.done].

Which languages does Skylos support?

Dead code: Python, TypeScript/JavaScript, Java, Go, PHP, Rust, Dart, Kotlin, C#, and C++ (file-local functions). Security: Python, TypeScript/JavaScript, Java, Go, PHP, Rust, Dart, C#, Shell, GitHub Actions, GitLab CI, and Dockerfiles. Go needs the skylos-go engine (Docker image and GitHub Action); Dart needs an extra parser.

Is this a cheating detector?

No. It finds specific shortcuts in tests, CI, and code. It can't prove code is correct.

Is Skylos free?

Yes. The CLI, skylos done, and the GitHub Actions workflow need no login. Cloud Free adds a pass/fail pull request check; Workspace adds history, policy, and team review.

What do Cloud credits pay for?

Scan comparisons, AI fix PRs, AI triage, MCP remediation, and compliance reports. Scan uploads, Cloud scans of your GitHub repositories, PR checks, and the merge gate never use credits. MCP scan tools run on your machine and don't use credits. They need a project token, except the dead-code analyze tool, which works without one for 5 calls a day. Your first workspace gets a Workspace trial: 14 days, 50 credits, no card, nothing renews or charges you.