#static-analysis

Attune-AI is a spec-driven meta-orchestration framework designed to establish a deterministic alignment layer between autonomous LLM agents and a production codebase.

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

Find leaked secrets everywhere.

A lightning fast shell linter/formatter/LSP server

Reflection library to do Static Analysis for PHP Projects

Extra strict and opinionated rules for PHPStan

Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 8 languages (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP). Sub-second, deterministic, no LLM at runtime. MIT-licensed.

Soot - A Java optimization framework

Local codebase intelligence CLI + MCP server for AI coding agents: SQLite code graph, 28 languages, 238 commands, 224 MCP tools, change-safety gates, audit evidence, zero API keys.

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?

OpenRewrite recipes for identifying and fixing static analysis issues.

Up-to-date WordPress function and class declaration stubs for static analysis by PHPStan

PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.

Nette Framework class reflection extension for PHPStan & framework-specific rules

An analysis tool for Python that blurs the line between testing and type systems.

PHPStan rules to detect disallowed method & function calls, constant, namespace, attribute, keyword & superglobal usages, with powerful rules to re-allow a call or a usage in places where it should be allowed.

PHP_CodeSniffer ruleset to enforce WordPress VIP coding standards.

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

A PHP parser written in PHP

Security & code-quality ESLint plugins — 350+ CWE-mapped rules across 18 domains, ESLint + Oxlint. The lint layer AI-generated code needs.

PHPStan extension for webmozart/assert

CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions

Comprehensive tree-sitter grammar compilation with polyglot bindings — Rust, Python, Node.js, Go, Java, Ruby, Elixir, PHP, C#, WASM, Dart, Kotlin-Android, Swift, Zig, and CLI. 371 languages.

A high-performance multi-language bindings generator for Rust, up to 1,000x faster than UniFFI. Ship Rust libraries that feels native to Python, Swift, Kotlin, and more

AI-native SAST

Staticcheck - The advanced Go linter

Making linters play nice... Mostly.