OLYDI installs statistics

OLYDI is a developer-native code-security agent for GitHub. It turns pull request scans into exploit-gated findings, SARIF in the Security tab, sticky PR feedback, and gate-verified remediation PRs when autonomous fix is enabled.

Capabilities

• Scans pull requests and pushes for code-security findings. • Prioritizes reachable risk with exploit-gated severity, EPSS, KEV, and taint-proof signals. • Posts GitHub check runs and sticky PR comments so reviewers see the result where they work. • Emits SARIF 2.1.0 into the GitHub Security tab through the GitHub App or OLYDI Action. • Opens remediation pull requests with verification evidence when autonomous fix is enabled for the repository. Autonomous fix is currently private beta.

Benefits

• Reduces alert noise by focusing on reachable findings instead of raw vulnerability volume. • Keeps developers in GitHub: checks, comments, SARIF, and remediation PRs all stay in the normal review path. • Preserves governance by never pushing directly to protected branches; fixes are reviewed and merged as pull requests. • Produces evidence that security leaders can inspect after a fix lands.

Getting started

• Install the OLYDI GitHub App on the repositories you want to watch. • Review the requested scopes: contents, pull requests, issues, checks, and workflows (write); security events (write); metadata (read). Write access is provisioned up front so autonomous fix-PRs work the moment that beta feature is enabled for your repo — it is not a separate scope grant. • Run a scan on the next push or pull request, or add the OLYDI Action for CI-driven scans. • Review findings in the PR and the GitHub Security tab.

Example workflows

• Scan this pull request and show only reachable high-severity findings. • Mirror findings into code scanning alerts as SARIF. • Open a bounded fix PR with tests and verification evidence. • Rescan after merge and confirm the finding is closed.

Description from the GitHub Marketplace listing.