#static-analysis

Command-line Go utility that automatically adds missing "plumbing" for `context.Context` parameters along the call-graph leading to a given function.

Canonical PHPStan rules enforcing war-room doctrine across Script Development Laravel territories

Blinter is a linter for Windows batch files. It provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues and style problems.

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

Tools for PHP_CodeSniffer sniff developers

Scan your codebase for AI slop. Get a Slop Score. Ship clean. A zero-dependency CLI (85 detectors: security, performance, code-quality, design tells) + a 181-pattern Anti-Slop Protocol for AI coding agents.

MCP server that orchestrates language servers into agent-native workflows. 65 tools, 30 CI-verified languages.

PHPStan analysis for Blade templates

Deterministic documentation generator for TypeScript packages.

Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.

🐘 PHPStan rules and type extensions for Nette libraries

This tool check syntax of PHP files faster than serial check with fancier output.

PHPCompatibility ruleset which can be included in projects using @ircmaxell's PasswordCompat polyfill library

📐 PHPUnit extension that measures the shape of your test suite

Go library for reading, writing, and validating SARIF 2.1.0 logs

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

🧪 Enforce PHP code coverage in your CI. Not by percentage, but target core methods! Allows you to start enforcing coverage for new code only! Also contains tooling to merge and convert PHPUnit coverage files.

Provides stub declarations for WPGraphQL core functions, classes and interfaces.

Elixir wrapper around Incremental Dialyzer with LLM focused features

enola - MCP Architectural Snapshot Server and Knowledge Graph

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

No repository description published.

CLI security scanner for self-hosted multi-tenant AI-agent platforms. 16 fail-closed OPA/Rego rules catch tenant-isolation defects (sandbox scoping, SSRF, cross-tenant cron/auth, secret leakage). SARIF and JSON output for CI.

Coding standad ruleset used by ShipMonk

Standalone open-source linter for Skylence .sky workflow files

An opinionated Go analyzer for a deliberately boring dialect.

Validate code blocks in Markdown and MDX documentation. Multi-language (Go, TypeScript, Rust, Nix, HCL, Templ), pure Go, CI-friendly.

A deterministic code knowledge graph for coding agents — one static Go binary indexes code, routes, dependencies, k8s & docs; your agent answers from the store. No LLM, no DB, no MCP.

Diagnose and fix performance, correctness, and architecture issues in your Svelte codebase

A structural linter that enforces layers, module roles, and function shape in Python.