#static-analysis

Ontology-driven codebase indexer and query service. Parses C#, TypeScript/JS, Go, Python, and SQL into an embedded graph database. Exposes Model Context Protocol (MCP) tools for AI agents to perform deep static analysis, cross-project call-graph tracing, and data lineage mapping.

Static analysis library for Go compiled binaries - identification and metadata extraction

Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.

Warm-process MCP server for PHPStan via persistent worker. Different from rector/phpunit warm packages: uses phpstan's worker subcommand over TCP NDJSON instead of in-process embed (which deadlocks).

Cyclomatic complexity, but for LLM prompts. Static analysis that finds the business logic hidden in your prompts, scores it, and gates it in CI. Python, TypeScript, JavaScript, PHP.

AI-first, deterministic programming language for low-maintenance business software development.

Larastan / PHPStan extension for Livewire

CLI + MCP server that audits what AI-generated code hides: security risks, algorithmic complexity, DB quality & code review.

Local-first ground-truth toolkit for Claude Code: symbol index + decision log + claim ledger over MCP and hooks.

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

A deterministic code knowledge graph for coding agents — one static Go binary indexes code, routes, dependencies, k8s & docs; your agent answers from the store. No LLM, no DB, no MCP.

🐘 PHPStan rules and type extensions for Nette libraries

This tool check syntax of PHP files faster than serial check with fancier output.

Rector extension for PHP that converts positional function, method, and constructor calls to named arguments.

A blazing-fast, multi-language linter for detecting AI-generated code slop

Architecture linter for Go: import rules, tiers, deep-scan method calls and dependency injection — declared as code in a Go DSL spec (YAML legacy), checked on every CI run. Hexagonal/onion/DDD-friendly.

Parse Codebase With AST , build dependency graphs, query imports ,trace dependencies path , and most importantly visualise the codebase and understand all locally.

Elixir wrapper around Incremental Dialyzer with LLM focused features

An opinionated Go analyzer for a deliberately boring dialect.

A toolkit for digging into any git repo. Free. Offline. Deterministic.

🔍 Zero-tolerance API coverage enforcement for TypeScript projects.

🐳 Fast, stack-aware Dockerfile linter — flags image bloat and bad-practice patterns with stable rule IDs and CI-friendly JSON. Single Go binary, zero dependencies.

Detect banned code through PHPStan

Shared Composer-powered QA, refactoring, benchmark, release, hook and CI tooling for PHP projects.

Static analyzer that turns a Python package's source into a queryable code graph (API surface, dependencies/architecture, impact, change-review, RAG).

Static analysis for Python projects: detect web apps, frameworks, and entrypoints without importing user code

phpcpd-next is a token-based copy/paste (clone) detector for PHP 8.4+, a modernized, openly-licensed successor to Sebastian Bergmann's phpcpd

Hunt down Go interface implementations like a bloodhound with trust issues. Tired of grep-ing through thousands of lines trying to figure out which structs actually implement that damn interface? This tool does the heavy lifting so you don't have to suffer through another existential crisis at 3am.

Standalone open-source linter for Skylence .sky workflow files

TypeScript slice of candor-spec — the derivability proof: written from the spec alone, 20/20 on the shared conformance oracle.