#static-analysis

Shared QA toolchain for php-db components: Mago formatting, linting and static analysis, plus the PHPUnit baseline and CI workflow.

A TypeScript-native DSL for expressing architectural intent as typed declarations. Produces renderable docs/diagrams and a queryable knowledge graph, supporting type-checked snippet references, semantic relations, and constraints.

PHP_CodeSniffer phar releases, automated and always up-to-date

Architecture lint for any language — one arch.yaml for layers, dependency rules, and AI-era guardrails

Pure-Go CLI that scans APK files for leaked secrets. Zero dependencies, gitleaks-compatible rules, CI-friendly exit codes.

Database safety for Laravel on PostgreSQL and MySQL. SQLens lints the SQL your migrations actually emit for lock and downtime risk, audits live schemas, detects drift and security issues, classifies deploy risk, and provides deterministic CI-ready guards with explicit pass, fail, or undetermined results.

Dead-code detection for AI-generated codebases: graphlint builds a dependency graph, finds code unreachable from any entry point to enable codebase cleanup and functional‑effectiveness understanding.

A Rust-inspired memory optimization framework for Go: SSA analysis, lifetime checking, and safe arena allocation.

Zero-config .env drift scanner — finds missing/stale env keys across JS/TS/PHP/Go/Python and seeds safe CI mocks. Zero-dependency Go.

Detect deeply nested if statements in Go source code

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

containedctx is a linter that detects struct contained context.Context field

Roast is an optimized JSON format for Rego ASTs, as well as some common utilities for working with it.

Standalone gqlgen extension that reports GraphQL query depth, field count & resolver count via Prometheus/OpenTelemetry — never rejects requests.

Security linter for a-h/templ: detects XSS-prone htmx / Alpine.js usage by parsing .templ files directly with parser/v2

A Collabarative Project of developing and deploying a secure and intelligent platform designed to help users investigate, manage, and analyze potentially malicious URLs.

Sweepy is a TypeScript CLI for safely refactoring React components and their usages.

PHP stubs for Moodle LMS - classes, functions, constants, and global variables for IDE and static analysis support

Homebrew tap for aislop, the deterministic AI-code quality gate. 50+ rules across 10 language targets. No LLM at runtime. MIT.