Programming Languages
47 projects
RoslynatorA comprehensive set of code analysis tools, refactorings, and client libraries for C# development, built on the Roslyn compiler platform.
IKOSA static analyzer for C/C++ that detects runtime errors using abstract interpretation theory.
clj-kondoA static analyzer and linter for Clojure, ClojureScript, and EDN that detects errors and enforces style without executing code.
credoA static code analysis tool for Elixir focusing on code consistency, refactoring opportunities, and teaching best practices.
dialyxirMix tasks to simplify using Dialyzer for static type analysis in Elixir projects.
sobelowSecurity-focused static analysis tool for Elixir and Phoenix applications, detecting common vulnerabilities.
errcheckA static analysis tool that finds unchecked errors in Go code.
go-criticA highly extensible Go source code linter providing opinionated checks for bugs, performance, and style issues.
gocycloA Go tool that calculates cyclomatic complexity of functions to identify code needing refactoring.
gofumptA stricter Go code formatter that enforces additional formatting rules beyond gofmt while maintaining compatibility.
gokartA static analysis tool for Go that finds vulnerabilities using SSA form and source-to-sink tracing to reduce false positives.
golintA deprecated linter for Go source code that checks for style violations according to Go conventions.
goreporterA Go tool that runs multiple linters concurrently to perform static analysis, unit testing, and generate comprehensive code quality reports.
ReviewdogAutomated code review tool that integrates with any linter and posts results as comments on pull requests.
HLintA tool for suggesting possible improvements to Haskell code, such as using alternative functions, simplifying code, and spotting redundancies.
google-java-formatA tool that automatically reformats Java source code to comply with Google Java Style guidelines.
NullAwayA fast, annotation-based null checker for Java that eliminates NullPointerExceptions with low build-time overhead.
JSLintA JavaScript code quality and coverage tool that enforces strict coding standards and generates test coverage reports.
xoAn opinionated, zero-config ESLint wrapper for JavaScript and TypeScript with great defaults and automatic fixes.
deptracA static code analysis tool for PHP that enforces architectural layers and dependencies between classes.
GrumPHPA PHP git hook manager that runs automated code quality checks on commits to enforce team standards.
LarastanA PHPStan extension for Laravel that adds static code analysis to catch bugs and improve code quality.
phanA static analyzer for PHP that minimizes false positives by attempting to prove incorrectness rather than correctness.
PHP InsightsInstant PHP quality checks from your console, analyzing code quality, architecture, and coding style.
PHP ParserA PHP parser written in PHP for static code analysis and manipulation via an abstract syntax tree (AST).
phplocA command-line tool for quickly measuring the size and complexity of PHP projects.
pyrightA high-performance, standards-based static type checker for Python with command-line and VS Code support.
refurbA Python linter focused on modernizing and improving code elegance, readability, and simplicity.
vultureA fast static analysis tool that finds unused (dead) code in Python programs to improve code quality.
Active Record DoctorA Ruby gem that detects database issues in Rails applications before they reach production.
BulletA Ruby gem that detects N+1 queries, unused eager loading, and missing counter caches to improve application performance.
bundle-auditA security audit tool for Ruby projects that checks Gemfile.lock for vulnerable gem versions and insecure sources.
FastererA Ruby command-line tool that suggests performance improvements by analyzing code patterns against faster alternatives.
reekA static analysis tool that detects code smells in Ruby classes, modules, and methods to improve code quality.
rubycriticA Ruby gem that wraps static analysis tools to generate comprehensive code quality reports with visual insights.
Standard RubyA Ruby linter and formatter with an unconfigurable, opinionated ruleset built on RuboCop.
cargo udepsA Cargo subcommand to find unused dependencies in Rust projects' Cargo.toml files.
cargo-expandA Cargo subcommand to show the result of Rust macro expansion and #[derive] expansion for debugging.
cargo-geigerA cargo plugin that detects and reports usage of unsafe Rust code in crates and their dependencies.
kaniA bit-precise model checker for verifying safety and correctness properties in Rust code.
rustfmtA tool for formatting Rust code according to the official Rust style guidelines.
RustVizGenerates interactive visualizations of ownership and borrowing in Rust programs to aid learning.
shellhardenA syntax highlighter and tool to semi-automatically rewrite shell scripts for ShellCheck conformance, focusing on proper quoting.
SwiftFormatA command-line tool and Xcode extension for formatting Swift code with extensive rule customization.
Angular ESLintA monorepo providing tooling to lint Angular projects with ESLint, including TypeScript and HTML template rules.
this issueAn extensible static analysis tool that checks TypeScript code for readability, maintainability, and functionality errors.
TypeScript ESLintMonorepo for tooling that enables ESLint to support TypeScript, providing powerful static analysis for JavaScript and TypeScript.
Multiple languages
16 projects
aleAsynchronous linting and fixing for Vim/Neovim with Language Server Protocol (LSP) support.
ApplicationInspectorA source code analyzer that identifies features and characteristics in software components using static analysis and a JSON rules engine.
BearerStatic application security testing (SAST) tool that scans source code to discover, filter, and prioritize security and privacy risks.
ClassGraphAn ultra-fast parallelized classpath and module scanner for JVM languages that indexes class metadata without loading classes.
codeqlStandard libraries and queries for CodeQL, powering GitHub Advanced Security and static application security testing.
dotnet-formatA command-line tool for automatically formatting .NET code to follow style guidelines and conventions.
ESLintA pluggable linting utility for identifying and reporting patterns in JavaScript and ECMAScript code.
oxcA collection of high-performance JavaScript and TypeScript tools written in Rust, powering modern development toolchains.
pfffA set of tools and APIs for static analysis, code visualization, navigation, and style-preserving source transformations across multiple languages.
ProntoA Ruby gem for automated code review that runs analysis quickly by checking only relevant changes in pull requests.
Roslyn AnalyzersRoslyn-based analyzers for .NET code quality, security, and maintainability, replacing legacy FxCop.
ThreatMapperOpen source CNAPP that hunts for threats in cloud native platforms, ranks them by risk, and visualizes attack paths.
trivyA comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOMs in containers, Kubernetes, code, and clouds.
TscanCodeA fast, accurate static code analyzer for C/C++, C#, and Lua that detects defects early in development.
UndebtA fast, straightforward, reliable tool for performing massive, automated code refactoring using custom Python patterns.
weggliA fast semantic search tool for C/C++ codebases that uses AST pattern matching to help security researchers find interesting functionality.
Other
30 projects
angrA platform-agnostic binary analysis framework for disassembly, symbolic execution, and program analysis.
bloatyBloaty is a size profiler for binaries that analyzes what's taking up space inside executable files.
CSScombA coding style formatter for CSS that sorts properties and enforces consistent formatting.
Gixy - Nginx configuration static analyzerA static analysis tool for detecting security misconfigurations and flaws in Nginx configuration files.
cfn-python-lintA linter that validates AWS CloudFormation templates against AWS resource schemas and best practices.
clairStatic vulnerability analysis for container images (OCI/Docker) via an API that indexes and matches against known security flaws.
Haskell Dockerfile LinterA smarter Dockerfile linter that helps you build best practice Docker images by parsing the Dockerfile AST and linting inline bash.
ReviewdogAutomated code review tool that integrates with any linter and posts results as comments on pull requests.
deno_lintA blazing fast Rust crate for linting JavaScript and TypeScript code, powering Deno's linter and usable with Node.js.
Angular ESLintA monorepo providing tooling to lint Angular projects with ESLint, including TypeScript and HTML template rules.
BootlintAn HTML linter that checks for common mistakes and ensures correct Bootstrap markup structure.
chart-testingA CLI tool for linting and testing Helm charts, designed for CI/CD pipelines and pull request validation.
kube-linterA static analysis tool that checks Kubernetes YAML files and Helm charts for security and production readiness best practices.
LarastanA PHPStan extension for Laravel that adds static code analysis to catch bugs and improve code quality.
markdownlintA Node.js style checker and lint tool for Markdown/CommonMark files to enforce consistency and standards.
mdlA Ruby-based tool to check Markdown files and flag style issues with configurable rules.
goreporterA Go tool that runs multiple linters concurrently to perform static analysis, unit testing, and generate comprehensive code quality reports.
Active Record DoctorA Ruby gem that detects database issues in Rails applications before they reach production.
BulletA Ruby gem that detects N+1 queries, unused eager loading, and missing counter caches to improve application performance.
detect-secretsAn enterprise-friendly Python tool for detecting and preventing secrets from entering codebases with a baseline approach.
GitleaksA tool for detecting secrets like passwords, API keys, and tokens in git repositories, directories, and stdin.
gokartA static analysis tool for Go that finds vulnerabilities using SSA form and source-to-sink tracing to reduce false positives.
GrypeA vulnerability scanner for container images, filesystems, and SBOMs to detect known security issues.
kaniA bit-precise model checker for verifying safety and correctness properties in Rust code.
scorecardAutomated security health metrics for open source projects, assessing security best practices and risks.
tfsecA static analysis security scanner for Terraform code that identifies misconfigurations across major cloud providers.
Tsunami Security ScannerA general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities.
mythrilA symbolic-execution-based security analysis tool for detecting vulnerabilities in Ethereum and EVM-compatible smart contracts.
slitherA static analysis framework for Solidity and Vyper smart contracts that detects vulnerabilities, enhances code comprehension, and enables custom analyses.
proselintA command-line linter for English prose that checks writing style, grammar, and usage against advice from expert writers.
More Collections
2 projects
go-toolsA state-of-the-art static analysis linter for Go that finds bugs, performance issues, and enforces style rules.
php-static-analysis-toolsA curated directory of static analysis tools for PHP, covering bug detection, coding standards, metrics, and automated fixes.