A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more.
Static Analysis is a curated directory and website listing static analysis tools (SAST) and linters for all programming languages, build tools, config files, and more. It helps developers discover tools that improve code quality, security, and maintainability by providing a centralized, community-maintained resource. The project focuses on tools that perform static analysis to detect bugs, enforce coding standards, and identify vulnerabilities without executing the code.
Software developers, DevOps engineers, and security professionals seeking to integrate static analysis into their workflow across any programming language or technology stack.
It saves significant research time by aggregating hundreds of specialized tools in one place, with clear licensing and maintenance status. Unlike generic lists, it focuses specifically on static analysis for code quality and is backed by a community that ensures the listings are current and relevant.
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Lists hundreds of tools across virtually every programming language and technology, from ABAP to WebAssembly, as shown in the detailed table of contents, making it a one-stop resource for diverse stacks.
Accepts pull requests for new tools and updates, with maintenance status indicators like :warning: for outdated tools, ensuring some level of community vetting and currency.
Marks proprietary software with :copyright: symbols and highlights open-source tools, helping users quickly identify free and commercial options based on their needs.
Covers not just programming languages but also build tools, configuration files, containers, and infrastructure-as-code, addressing modern DevOps and security workflows.
Provides basic listings without in-depth reviews, benchmarks, or user ratings, forcing developers to conduct additional research to compare tools effectively.
Relies on community contributions; tools marked with :warning: indicate they haven't been updated in over a year, which can lead to outdated or unmaintained recommendations.
Acts purely as a directory—users must manually research, install, and configure each tool, adding significant setup time compared to integrated SaaS platforms.