A source code analyzer that identifies features and characteristics in software components using static analysis and a JSON rules engine.
Microsoft Application Inspector is a source code analyzer that uses static analysis and a JSON rules engine to identify features and characteristics in software components. It helps developers and security teams quickly understand what a codebase does by detecting patterns like cryptography usage, cloud APIs, and frameworks without making quality judgments. The tool is designed to reduce the time needed to evaluate open-source or third-party components by examining source code directly.
Security engineers, developers, and compliance teams who need to audit software components for feature presence, track changes between versions, or verify security-related characteristics in build pipelines.
Unlike traditional static analysis tools that focus on finding bugs, Application Inspector provides objective feature detection to help users understand component capabilities and security implications. Its extensive rule set, multi-language support, and flexible output formats make it ideal for automating software composition analysis and compliance checks.
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses over 400 JSON-based rule patterns to identify hundreds of coding features like cryptography and cloud APIs, providing deep insights into code composition without subjective judgments.
Scans projects with mixed languages including C, C++, Java, Python, and more, as listed in the README, making it versatile for diverse codebases.
Generates reports in HTML (default), JSON, text, SARIF, and Markdown, allowing integration into various workflows and tools for different use cases.
Includes a 'tagdiff' command to compare unique feature tags between two source paths, useful for identifying deltas between versions and detecting potential backdoors.
Supports user-defined JSON rules for extending feature detection patterns, enabling teams to tailor scans to specific technologies or compliance requirements.
Focuses solely on feature identification and does not detect security bugs, code smells, or quality issues, requiring additional tools for comprehensive security analysis.
The recommended installation as a .NET global tool requires the .NET 6 SDK, adding setup overhead for teams not already in the .NET ecosystem, as noted in the Quick Start section.
Relies on regex-based pattern matching for static code analysis, which cannot capture runtime behavior or dynamic code paths, potentially missing context-dependent features.
With over 400 default rules and support for custom ones, maintaining and updating rules for new technologies or languages can be time-consuming and requires ongoing effort.