Awesome Static Analysis
A curated directory of static analysis (SAST) tools and linters for all programming languages, config files, and build tools.
What is Awesome Static Analysis?
Static Analysis is a curated directory of static analysis tools (SAST) and linters for all programming languages, configuration files, build tools, and more. It helps developers find tools that improve code quality by detecting bugs, enforcing style guides, and identifying security vulnerabilities without executing the code. The project also powers a website with additional features like rankings and user comments.
Developers, engineering teams, and security engineers looking to integrate static analysis into their workflow across diverse technology stacks.
It provides a single, comprehensive, and community-maintained reference for discovering static analysis tools, saving time compared to scattered searches, and emphasizes open-source and quality-focused tools.
Overview
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
Use Cases
Best For
- Finding linters and formatters for a specific programming language
- Comparing static analysis tools for security (SAST) scanning
- Discovering code quality tools for niche or legacy languages
- Building a CI/CD pipeline with multiple static analysis checks
- Researching open-source alternatives to proprietary analysis tools
- Evaluating tools for enforcing coding standards like MISRA or CERT
Not Ideal For
- Developers seeking an all-in-one static analysis platform with built-in scanning and reporting
- Teams needing hands-on tutorials or detailed setup guides for tool integration
- Projects requiring real-time, automated code feedback during active development
- Organizations looking for commercial support or guaranteed tool maintenance
Pros & Cons
Pros
Covers over 50 programming languages and technologies, making it a go-to resource for diverse tech stacks, as highlighted in the key features.
Focuses on tools that improve code quality like linters and formatters, not just any static analysis tools, ensuring relevance for developers, per the project's philosophy.
Clearly marks proprietary tools and highlights open-source alternatives, encouraging the use of free software, which is a core emphasis in the README.
Accepts pull requests and has sister projects, ensuring continuous improvement through community contributions, as stated in the repository.
Cons
While it lists hundreds of tools, it lacks ratings, benchmarks, or side-by-side comparisons, leaving users to evaluate options on their own without guidance.
The project focuses on listing tools but offers little practical advice on setup, configuration, or CI/CD integration, which can hinder implementation.
Some tools are marked with warnings for not being updated in over a year, indicating potential outdated entries despite community efforts, as shown by the :warning: symbol.
Frequently Asked Questions
Related Projects
Awesome Threat ModellingA curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.
Awesome Dynamic Analysis⚙️ A curated list of dynamic analysis tools and linters for all programming languages, binaries, and more.
Awesome Platform EngineeringCurated list of tools and resources for Platform Engineering
Vulnerable Web Apps DirectoryOWASP - A collection of vulnerable web applications for learning purposes
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.