#static-analysis

PHPStan rules that help you migrate from PHP-FPM to FrankenPHP classic, then to worker mode. Rules are split by level with demos for every case.

Your vibe-coded app has hardcoded secrets, missing auth, and hallucinated imports. Find out in under a second.

Monorepository of @pumped-fn

Zero config, accurate JSON schema generator for helm charts via static analysis

Rust-based static analysis for TypeScript projects

Simplify code and repo health

Compact PHP repository symbol maps for coding-agent navigation.

Provides stub declarations for WPGraphQL core functions, classes and interfaces.

CodeIgniter extensions and rules for PHPStan

Static analysis tool that catches 1000+ bug patterns across all popular programming languages, with auto-wiring into AI coding agent quality guardrails

Open-source HIPAA compliance scanner for healthcare code. 140+ rules, 5 HIPAA categories. CLI + CI/CD + VS Code.

PHPCompatibility rulesets which can be included in projects using the Paragonie polyfill libraries

Find Unused Public Elements in Your Code

Convert oxlint JSON output to SARIF

ESLint-style configurable architecture linter for Go projects

Deterministic pre-write guard for AI coding agents. Blocks an Edit/Write that references a symbol your repo doesn't have — before it lands, not after the build fails. No LLM, no API keys, ~0 tokens: the same code produces the same answer. Catches hallucinated bare calls, consts and type refs; 4 of 9 on our real-hallucination benchmark.

Go library for SARIF - Static Analysis Results Interchange Format

A PSR-2-R code sniffer and code-style auto-correction-tool - including many useful additions

Static analysis, linter & logic solver for PHP regular expressions

sound abstract interpretation for WebAssembly — the third DO-333 leg of the PulseEngine verification chain

Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.

TYPO3 CMS class reflection extension for PHPStan & framework-specific rules

🚀 Fast detection of composer dependency issues (unused dependencies, shadow dependencies, misplaced dependencies)

Run zizmor from GitHub Actions!

Open-source Software Intelligence Platform. Deterministic verification, structural PR reviews, interactive graph explorer, and proactive intelligence — powered by the Software Graph. 41 node types · 32 relationships · 120+ checks.

A polyglot import-topology linter: zones, sealed deep modules, guest lists, cycle bans, reach ceilings - judged against the real import graph.

Multi-model code review council — consensus-driven PR reviews

📐 PHPUnit extension that measures the shape of your test suite

A structural linter that enforces layers, module roles, and function shape in Python.

Various static analysis and testing tools for managing PromQL compatible monitoring stacks