#static-analysis

Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.

SecScan is a fast, configurable secret scanning tool written in Go that detects API keys, tokens, credentials, and high-entropy secrets across source code and full Git history. Built for developers and CI pipelines, with strong defaults and low false positives.

nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.

AI-powered code convention checker for CI. Enforce your team's conventions from a plain-language YAML file — vendor-neutral, language-agnostic Go CLI.

rpcguard checks if connect-RPC endpoint method is implemented properly

No repository description published.

Deterministic cross-repo contract analysis you can gate CI on — joins frontend calls to backend routes across repo boundaries and flags drift (typo'd path, version skew, dead endpoint). Also a multi-language SAST/architecture engine (TS/JS, Prisma, Java), extensible via adapters. Rust core, npm CLI/SDK.

Local-first semantic governance for AI agents: contracts, impact, drift, evidence, and verified execution. Codex is the first native integration.

Run, test, and diagnose Excel VBA macros without Microsoft Excel. elixcee is a Rust-powered headless VBA runtime for Linux, macOS, and Windows, with static analysis, property-based workbook testing, and root-cause diagnostics for common Excel operation failures.

Analyzes php-code for side-effects.

An Elixir tool for checking safety of database migrations.

hewd is a lightweight Go‑based command‑line tool for initializing, scanning, and diagnosing documentation assets in codebases. It helps developers automatically detect project structure, validate documentation, and output insights in human‑ or machine‑readable formats.

The quality ratchet for TS/JS: 9 zero-config gates against a versioned baseline — quality can only improve, never regress.

Codebase intelligence shell and SDK — pip install jsat

Policeman's Forbidden API Checker

PHP_CodeSniffer phar releases, automated and always up-to-date

Architecture lint for any language — one arch.yaml for layers, dependency rules, and AI-era guardrails

Analyzer: checks whether HTTP response body is closed and a re-use of TCP connection is not blocked.

Pure-Go CLI that scans APK files for leaked secrets. Zero dependencies, gitleaks-compatible rules, CI-friendly exit codes.

Security linter for a-h/templ: detects XSS-prone htmx / Alpine.js usage by parsing .templ files directly with parser/v2

Roast is an optimized JSON format for Rego ASTs, as well as some common utilities for working with it.

Detect deeply nested if statements in Go source code

A Collabarative Project of developing and deploying a secure and intelligent platform designed to help users investigate, manage, and analyze potentially malicious URLs.

containedctx is a linter that detects struct contained context.Context field