#static-analysis

An extremely fast Python linter and code formatter, written in Rust.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

It's not just a linter that annoys you!

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

A high-performance static analysis toolkit for Ruby

A tool to automatically fix PHP Coding Standards issues

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

A vulnerability scanner for container images and filesystems

A common base representation of python source code for pylint and other projects

Static code analysis for Kotlin

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

Scans your project to determine what components you use

Regal is a linter and language server for Rego, bringing your policy development experience to the next level!

Code style checking for RSpec files.

Protect against malicious open source packages 🤖

Go security checker

A new version of Soot with a completely overhauled architecture

Official ESLint plugin for Vue.js

Static analysis for GitHub Actions

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.

AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessment, SBOM generation, and static analysis.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

Code analyzer for C# and VB.NET projects

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

Security Scanner for Agent Skills

Deterministic, local-first memory and guardrails for AI coding agents with no LLM in the hot path.

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.