#static-analysis

Detect hidden Unicode attacks in source code before they fool you.

Write oxlint custom lint rules with Effect v4

No repository description published.

🧪 Enforce PHP code coverage in your CI. Not by percentage, but target core methods! Allows you to start enforcing coverage for new code only! Also contains tooling to merge and convert PHPUnit coverage files.

WordPress extensions for PHPStan ⛏️

Provides stub declarations for WPGraphQL core functions, classes and interfaces.

An opinionated Go analyzer for a deliberately boring dialect.

No repository description published.

PHPCompatibility ruleset which can be included in projects using @ircmaxell's PasswordCompat polyfill library

ShieldCI Analyzer Core - Shared foundation for building static analysis tools. Includes abstract analyzer classes, result formatters, file parsers, and utilities. Used by both shieldci/laravel and shieldci/laravel-pro packages.

Validate code blocks in Markdown and MDX documentation. Multi-language (Go, TypeScript, Rust, Nix, HCL, Templ), pure Go, CI-friendly.

Diagnose your GitHub Actions: flaky jobs, wasted minutes, slow steps, cache problems, and workflow anti-patterns — in one command, zero config.

A deterministic code knowledge graph for coding agents — one static Go binary indexes code, routes, dependencies, k8s & docs; your agent answers from the store. No LLM, no DB, no MCP.

PHPStan rules that help you migrate from PHP-FPM to FrankenPHP classic, then to worker mode. Rules are split by level with demos for every case.

This tool check syntax of PHP files faster than serial check with fancier output.

CLI security scanner for self-hosted multi-tenant AI-agent platforms. 16 fail-closed OPA/Rego rules catch tenant-isolation defects (sandbox scoping, SSRF, cross-tenant cron/auth, secret leakage). SARIF and JSON output for CI.

Rector extension for PHP that converts positional function, method, and constructor calls to named arguments.

Coding standad ruleset used by ShipMonk

Standalone open-source linter for Skylence .sky workflow files

No repository description published.

Static analysis library for Go compiled binaries - identification and metadata extraction

PHPStan extensions and rules for Silverstripe CMS.

Elixir wrapper around Incremental Dialyzer with LLM focused features

Scan your codebase for AI slop. Get a Slop Score. Ship clean. A zero-dependency CLI (85 detectors: security, performance, code-quality, design tells) + a 181-pattern Anti-Slop Protocol for AI coding agents.

intrange is a program for checking for loops that could use the Go 1.22 integer range feature.

CLI + MCP server that audits what AI-generated code hides: security risks, algorithmic complexity, DB quality & code review.

🐳 Fast, stack-aware Dockerfile linter — flags image bloat and bad-practice patterns with stable rule IDs and CI-friendly JSON. Single Go binary, zero dependencies.

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

WordPress core test suite function and class declaration stubs for static analysis by PHPStan

Reactive architectural governance for Rust — declare boundaries in Rust, react to drift in CI and at runtime. The 三儀: 圭表 (static) · 渾儀 (semantic) · 漏刻 (runtime). Govern by reaction, not instruction. On crates.io as the tianheng family.