#static-analysis

An AI-powered GitHub code review tool that uses LLMs to detect high-confidence, high-impact issues—such as security vulnerabilities, bugs, and maintainability concerns.

Extensions for PHPStan

Show unused composer dependencies by scanning your code

AI-native SAST

Manage translation and localization with static analysis, for Ruby i18n

📏 Various extra strict PHPStan rules we found useful in ShipMonk.

Spryker Code Sniffer

A pre-commit hook for zizmor.

An MCP Server to utilize Codelogic's rich software dependency data in your AI programming assistant.

ArchUnitPython is an architecture testing library. Specify and ensure architecture rules in your Python app. Easy setup and pipeline integration.

PHPCompatibility ruleset for WordPress projects

:ab: Tool to compare two revisions of a class API to check for BC breaks

A code analyzer for Julia. No need for additional type annotations.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

ECS runs PHP-CS-Fixer and PHP_CodeSniffer as a single, parallel fast tool with zero dependencies. Run on PHP 7.2+

A set of custom fixers for PHP CS Fixer

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

PHPStan based SQL static analysis and type inference for the database access layer

🤝 A friendly error formatter extension for PHPStan that provides more readable and informative output, including code snippets and color highlighting.

A fast universal code security scanner, written in Rust. Batteries included: supports 12 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

A suite of utility functions for use with PHP_CodeSniffer

🛡️ Static analyzer for documentation governance. Audits broken links, credentials, brand compliance & i18n parity. Engine-agnostic — works with MkDocs, Zensical, and any Docs-as-Code setup.

Maintainability checks and repair-loop diagnostics for AI-assisted Python repositories.

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

Command Line Style Checker of XML Documents: to make sure they are always formatted nicely

📐 Bidirectional spec-to-code validation. CI-enforced contract checking between docs and code.

A Code Quality Analyzer for JavaScript/TypeScript

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.