#static-analysis

A secure JavaScript sandbox designed for safe AI agent code execution. Protects against code injection, prototype pollution, and sandbox escapes. The security layer that makes AI-generated code safe to run.

A Code Quality Analyzer for JavaScript/TypeScript

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.

PHPStan extension for beberlei/assert

The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to Semgrep Pro and CodeQL.

A memory of the codebase your AI agent can't get from grep: a persistent call graph, semantic search, and per-symbol review learnings over any repo. Self-hosted MCP server — Go, tree-sitter, Apache AGE.

Performant static analyzer for PHP, which is extremely easy to use. It helps you catch common mistakes in your PHP code.

Program dependence graph and architecture/code-flow analysis for BEAM projects

PHPStan extension for Mockery

The repo map your coding agent is forced to use — ~98% fewer tokens (up to 99.9% per task) to understand a TS/JS codebase. PageRank hubs, Aider-style symbol ranking, token-budgeted digest, --any router, wired into the agent loop.

Official Coding Standards for CodeIgniter

A collection of code standards for use with PHP_CodeSniffer

Yoast coding standards

Standalone static analysis for ABAP

enola - MCP Architectural Snapshot Server and Knowledge Graph

The adblock filter tool you've been waiting for.

Find undefined and unused variables with the PHP Codesniffer static analysis tool.

Workflow-first AI code maintenance for reviews, changelogs, docs, and repository upkeep.

Composer plugin for automatic installation of PHPStan extensions.

Python Type Checker / Language Server

PHPCompatibility rulesets which can be included in projects using the Symfony polyfill libraries

Ship agentic. Stay coherent. Self-checking code integrity for AI coding agents, via MCP.

Drop it into your repo and let an AI Senior reviewer go through every PR — inline comments, severity-coded findings, and a general summary, all configurable per project and tech stack. Supports OpenAI, Anthropic, Gemini, and Ollama. Auto-detects your stack (NestJS, Next.js, React, TypeScript, Node, Flutter, Laravel) and applies built-in rules for

Local-only Go static analysis engine with a built-in MCP server. Gives AI coding agents deterministic structural awareness: call graphs, impact analysis, symbol search, and more.

Simplify code and repo health

TypeScript-native software intelligence engine that builds deterministic Software Graphs.

PHPCompatibility rulesets which can be included in projects using the Paragonie polyfill libraries

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

Rust-native codebase intelligence for Dart and Flutter.

PhpStan support for Pest