#static-analysis

Soot - A Java optimization framework

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

AI-native SAST

Standalone static analysis for ABAP

A high-performance multi-language bindings generator for Rust, up to 1,000x faster than UniFFI. Ship Rust libraries that feels native to Python, Swift, Kotlin, and more

ESLint plugin for Scoped CSS in Vue.js

An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.

Open-source AI code review engine + unified quality CLI orchestrating 15+ linters. CLI, GitHub Action, and MCP server.

A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Extension for PHPStan to allow analysis of Drupal code.

Self-hostable, MIT Licensed, Enterprise AI Software Factory

A PHP parser written in PHP

OpenRewrite recipes for identifying and fixing static analysis issues.

Up-to-date WordPress function and class declaration stubs for static analysis by PHPStan

Apple HIG reference and cross-framework UI audit tooling for agents.

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

Comprehensive tree-sitter grammar compilation with polyglot bindings — Rust, Python, Node.js, Go, Java, Ruby, Elixir, PHP, C#, WASM, Dart, Kotlin-Android, Swift, Zig, and CLI. 371 languages.

Open-source capability compiler for Python codebases: static discovery, typed contracts, REST/MCP interfaces and governed execution.

PHP_CodeSniffer ruleset to enforce WordPress VIP coding standards.

ArchUnitTS is an architecture testing library. Specify and ensure architecture rules in your TypeScript app. Easy setup and pipeline integration.

An AI-powered GitHub code review tool that uses LLMs to detect high-confidence, high-impact issues—such as security vulnerabilities, bugs, and maintainability concerns.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

APISpec - Generate OpenAPI 3.1 specs from Go code with intelligent framework detection and call graph analysis. Supports Gin, Echo, Chi, Fiber, and net/http.

A single-binary CLI tool that detects a software project's toolchain, configuration, and conventions, then outputs a structured report.

A Functional Library for TypeScript based on Scala

Code intelligence CLI — function-level dependency graph across 34 languages, 34-tool MCP server for AI agents, complexity metrics, architecture boundary enforcement, CI quality gates, git diff impact with co-change analysis, hybrid semantic search. Fully local, zero API keys required.

PHPStan extension for webmozart/assert

A static code analysis tool for the Elixir language with a focus on code consistency and teaching.

PHPStan rules to detect disallowed method & function calls, constant, namespace, attribute, keyword & superglobal usages, with powerful rules to re-allow a call or a usage in places where it should be allowed.