npm · crates.io · PyPI
kucherenko/jscpd
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
MITSep 15, 2026 · metrics 2.10.0
All tags
Catalogue tag
#static-analysis
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
505 records
Packagist
phan/phan
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
Custom licenseAug 28, 2026 · metrics 2.10.0
PyPI · crates.io
rvben/rumdl
Fast Markdown linter and formatter written in Rust
MITOct 20, 2026 · metrics 2.10.0
Maven · PyPI
spotbugs/spotbugs
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
LGPL-2.1Aug 28, 2026 · metrics 2.10.0
npm
sverweij/dependency-cruiser
Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.
MITAug 27, 2026 · metrics 2.10.0
PyPI · npm
tirth8205/code-review-graph
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
MITSep 16, 2026 · metrics 2.10.0
npm · PyPI · crates.io
ast-grep/ast-grep
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
MITSep 16, 2026 · metrics 2.10.0
PyPI · crates.io
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
Apache-2.0Sep 15, 2026 · metrics 2.10.0
crates.io · npm
fallow-rs/fallow
Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles: unused code, duplication, circular deps, complexity hotspots, architecture boundaries, design-system drift. Optional paid runtime layer (Fallow Runtime): hot-path review and cold-path deletion evidence from real production traffic.
MITAug 28, 2026 · metrics 2.10.0
npm · NuGet
microsoft/sarif-sdk
.NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https://github.com/oasis-tcs/sarif-spec)
Custom licenseSep 11, 2026 · metrics 2.10.0
Packagist
phpstan/phpdoc-parser
Next-gen phpDoc parser with support for intersection types and generics
MITOct 20, 2026 · metrics 2.10.0
Packagist · npm
phpstan/phpstan
PHP Static Analysis Tool - discover bugs in your code without running it!
MITOct 20, 2026 · metrics 2.10.0
PyPI · npm · RubyGems
repowise-dev/repowise
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
AGPL-3.0Sep 9, 2026 · metrics 2.10.0
PyPI · crates.io · npm
rohaquinlop/complexipy
Blazingly fast cognitive complexity analysis for Python, written in Rust.
MITOct 21, 2026 · metrics 2.10.0
Maven · RubyGems
PicnicSupermarket/error-prone-support
Error Prone extensions: extra bug checkers and a large battery of Refaster rules.
MITSep 13, 2026 · metrics 2.10.0
NuGet
meziantou/Meziantou.Analyzer
A powerful C# Roslyn analyzer that uses static analysis to detect bugs, surface security issues, and enforce best practices—helping developers and AI write more reliable code.
MITSep 12, 2026 · metrics 2.10.0
npm
objectstack-ai/objectstack
The ontology is the software. One executable business ontology: AI writes it, the runtime runs it, agents operate it, you own it. Open protocol & runtime, Apache-2.0.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Packagist
phpstan/phpstan-doctrine
Doctrine extensions for PHPStan
MITAug 27, 2026 · metrics 2.10.0
Packagist
phpstan/phpstan-symfony
Symfony extension for PHPStan
MITAug 27, 2026 · metrics 2.10.0
crates.io
qltysh/qlty
💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability
Custom licenseSep 11, 2026 · metrics 2.10.0
Go
quay/claircore
foundation modules for scanning container packages and reporting vulnerabilities
Apache-2.0Sep 12, 2026 · metrics 2.10.0
npm
scanaislop/aislop
Catch and fix the code-quality issues AI coding agents leave behind - dead code, unsafe casts, swallowed errors, duplication, security risks, and more. 50+ deterministic rules across 10 language targets, with CLI, CI, and GitHub Actions. No LLM at runtime. MIT.
MITSep 16, 2026 · metrics 2.10.0
crates.io · npm · PyPI
dekobon/big-code-analysis
Tool to report source code metrics
MPL-2.0Oct 21, 2026 · metrics 2.10.0
Packagist
deptrac/deptrac
Keep your architecture clean.
MITSep 12, 2026 · metrics 2.10.0
npm · Maven
jenkinsci/analysis-model
A library to read static analysis reports into a Java object model
MITOct 18, 2026 · metrics 2.10.0
PyPI · Go
ludo-technologies/pyscn
Code quality analysis for Python in the age of AI coding.
MITSep 13, 2026 · metrics 2.10.0
Packagist
psalm/psalm-plugin-laravel
Security-focused Laravel static analyser
MITOct 21, 2026 · metrics 2.10.0
PyPI · npm
sattyamjjain/agent-audit-kit
Static scanner for MCP-connected AI agent pipelines. 348 rules across 14 categories, 14 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Maven
uber/NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
MITAug 28, 2026 · metrics 2.10.0
Maven · PyPI
wala/WALA
T.J. Watson Libraries for Analysis, with front ends for Java, Android, and JavaScript, and many common static program analyses.
EPL-2.0Sep 10, 2026 · metrics 2.10.0