#static-analysis

Static Unsafe Contract Analysis

Static analysis for Filament v4/v5 projects. Detect deprecated patterns and code issues.

Detect and filter auto-generated Go code — fast, zero-config, table-driven. Supports sqlc, protobuf, templ, mockgen, wire, stringer, and more.

A suite of utility functions for use with PHP_CodeSniffer

PHPCompatibility ruleset for WordPress projects

Ship agentic. Stay coherent. Self-checking code integrity for AI coding agents, via MCP.

Yoast coding standards

PHPStan stubs for Elementor and Elementor Pro. Full IDE autocomplete, IntelliSense, and type safety for WordPress developers building Elementor widgets and extensions.

The best platform agnostic Linter for AI agent plugins and skills — validates structure, frontmatter, and token limits for Claude Code, Cursor, Codex, and many others!

Maintainability checks and repair-loop diagnostics for AI-assisted Python repositories.

Detect uses of legacy Java APIs

Go library and CLI for fast license detection and repository scanning against ScanCode's rule corpus.

Continuously refine your project’s engineering philosophy — and keep AI coding agents honest with evidence-backed completion.

An easy-to-learn/use static analysis framework for Java and Android

PHPStan extension for beberlei/assert

The immune system for AI coding agents

Core library behind rstcheck.

Deterministic standards for Python, TypeScript, SQL, IaC, and repository policy.

Todo comments with expiration

Deterministic Stop-gate and code-graph context for AI coding agents: blocks only net-new findings and gives the loop a structural map of the codebase, locally, with no model in the gate.

A Ruby code quality reporter

Python Type Checker / Language Server

High-performance open-source secret scanner — detect, verify & report leaked API keys, tokens & credentials in code, Git history, container images, and the cloud.

A collection of code standards for use with PHP_CodeSniffer

Know what breaks before you change Salesforce. Ask your AI about your org: where a field is used, what runs on save, which Apex is dead, who can see what. Offline, read-only, cited. Open source (MIT).

Deterministic Document Integrity Engine for Markdown/MDX graphs.

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.

Find and fix what the MCP 2026-07-28 spec revision breaks in your server. 21 rules, 19 of them with fixers, and a readiness board.

MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.

C#/.NET Roslyn analyzer with 36 diagnostics and code fixes for CancellationToken propagation, async/await, ASP.NET Core, EF Core, HttpClient, gRPC, blocking I/O, and sync-over-async.