#static-analysis

Prevent memory leaks and runtime crashes in .NET Dependency Injection. A zero-overhead Roslyn analyzer that catches captive dependencies, undisposed scopes, and lifetime mismatches at compile-time.

Use php-cs-fixer to format bats,blade.php,Dockerfile,env,json,md,mdx,sh,sql,tex,text,toml,txt,xml,yaml...files.

This sniffer package builds on top of PSR-2/12 and ships with a lot of additional fixers on top.

Describe, document, render, diff, query, and convert VIs without LabVIEW using CLI and AI Agents

Rust-native codebase intelligence for Dart and Flutter.

Multi-language taint and graph security scanner. Follows tainted data through your code and shows why each finding is a finding.

A pre-commit hook for zizmor.

Professional code clone detection for Go. AST-based structural + semantic detection with suffix tree algorithms, 3 matching modes, 7 output formats, templ support, and CI baseline gating.

ShieldCI Analyzers Core - Shared foundation for building static analysis tools. Includes abstract analyzer classes, result formatters, file parsers, and utilities. Used by both shieldci/laravel and shieldci/laravel-pro packages.

Layered, replicated, self-adjudicating code review orchestrator

PHPStan extension to require minimal type-coverage

Proof-gated Go compiler and runtime for semantics-preserving automatic batching.

Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

Linting rules for Alley Interactive

Deterministic documentation generator for TypeScript packages.

Program dependence graph and architecture/code-flow analysis for BEAM projects

Typed async workflows with Result types and automatic error inference

PostgreSQL migration linter. Blocks unsafe migrations before merge: 112 rules, the real Postgres parser, lock analysis, auto-fix. CLI, GitHub Action, MCP.

Composer plugin for automatic installation of PHPStan extensions.

DX-first ESLint 10 flat config for JavaScript and TypeScript, with auto-detection and opt-in framework packages.

Canonical PHPStan rules enforcing war-room doctrine across Script Development Laravel territories

📏 Various extra strict PHPStan rules we found useful in ShipMonk.

Cut AI-agent token waste ~90% — query a local SQLite structural index of your JS/TS/CSS codebase with SQL in one round-trip instead of 3–5 file reads. Symbols, imports, calls, components, CSS tokens, coverage, markers. CLI, MCP (21 tools), HTTP, GitHub Action, ESM API. 71 recipes; AST+resolver; SARIF/audit/baselines for CI.

Accessibility testing tools monorepo — core, CLI, MCP, Playwright, Storybook, Vitest

Explainable, local structural similarity for Go, JavaScript, TypeScript, Python, and Rust.

Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.

PHP static analysis for architecture & maintainability — 60+ metrics, complexity analysis, dependency graphs, git churn hotspots, and AI-ready MCP server. Alternative to PHPMetrics.

The fastest CLI and agent-first code search tool, built on indexed trigram search with aggressive literal-match optimizations

A memory of the codebase your AI agent can't get from grep: a persistent call graph, semantic search, and per-symbol review learnings over any repo. Self-hosted MCP server — Go, tree-sitter, Apache AGE.