#static-analysis

A fast universal code security scanner, written in Rust. Batteries included: supports 12 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

Detect and filter auto-generated Go code — fast, zero-config, table-driven. Supports sqlc, protobuf, templ, mockgen, wire, stringer, and more.

ArchUnitPython is an architecture testing library. Specify and ensure architecture rules in your Python app. Easy setup and pipeline integration.

PHPCompatibility ruleset for WordPress projects

flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.

🩺⚡ Runtime Doctrine ORM analysis integrated into Symfony Web Profiler. Detect N+1 queries, security vulnerabilities, and performance issues during query execution.

A code analyzer for Julia. No need for additional type annotations.

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

Manage translation and localization with static analysis, for Ruby i18n

A set of custom fixers for PHP CS Fixer

This sniffer package builds on top of PSR-2/12 and ships with a lot of additional fixers on top.

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

Deterministic standards for Python, TypeScript, SQL, IaC, and repository policy.

PHPStan based SQL static analysis and type inference for the database access layer

📐 Bidirectional spec-to-code validation. CI-enforced contract checking between docs and code.

A suite of utility functions for use with PHP_CodeSniffer

A secure JavaScript sandbox designed for safe AI agent code execution. Protects against code injection, prototype pollution, and sandbox escapes. The security layer that makes AI-generated code safe to run.

See the invisible structure of your code. Multi-language code quality and architecture analyzer (Go, PHP, Python, Rust...)

The best platform agnostic Linter for AI agent plugins and skills — validates structure, frontmatter, and token limits for Claude Code, Cursor, Codex, and many others!

✔️ PHP Architecture Tester - Easy architecture testing for PHP

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

A Code Quality Analyzer for JavaScript/TypeScript

The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to Semgrep Pro and CodeQL.