#static-analysis

Local code intelligence MCP server and CLI for AI coding agents

MCP server that orchestrates language servers into agent-native workflows. 65 tools, 30 CI-verified languages.

PHPStan analysis for Blade templates

Opinionated PHP code-quality analyzer that scores findings across quality pillars and emits reports for terminals, CI, SARIF, HTML, and a local dashboard.

An opinionated static analyzer for TypeScript and JavaScript projects - 119 rules across 11 pillars, baselines, SARIF/HTML/Markdown reports, CI annotations, and a local dashboard.

A Roslyn analyser for AutoMapper that catches missing and misconfigured mappings at compile time.

Fail CI when Go code or dependencies gain new privileged operations, using google/capslock

Manage translation and localization with static analysis, for Ruby i18n

MO4 Coding Standard Rules for Codesniffer based on Symfony Coding Standards.

AI pull-request reviewer: hybrid RAG + a code graph + Claude Code/Codex. Whole-repo context, inline GitHub comments grounded on exact code. MCP server + Claude Code/Codex plugin.

Go linter that detects unsafe *gorm.DB instance reuse

the cli

PHPStan extension for Mockery

Archkeel checks architecture boundaries and declared changes in AI-assisted code.

The adblock filter tool you've been waiting for.

Find undefined and unused variables with the PHP Codesniffer static analysis tool.

Static security scanner for AI agents, MCP tools, and LLM applications. Detects OWASP LLM Top 10 risks, unsafe tool use, prompt injection paths, secrets, and AI infrastructure misconfigurations. Zero runtime dependencies.

Python static analysis tool.

PHPCompatibility rulesets which can be included in projects using the Symfony polyfill libraries

Extensions for PHPStan

Quality plugin for Gradle that supports Android flavors

Blast radius and provenance for a codebase - what breaks if I change this symbol, and where a pasted snippet came from, read from the bytes on disk right now. No precomputed graph.

Code similarity search by compression - find near-duplicate files, clone families, and where a pasted snippet came from. No embeddings, no model, no vector database.

Fast architecture smell detector for TypeScript/JavaScript

Most tools check the code your agent wrote. nullius checks how it got there — citations, session journals, weakened tests.

A PHPStan extension for analysis of Laravel applications and packages.

Extracts function selectors, arguments, state mutability and storage layout from EVM bytecode, even for unverified contracts

CLI for analyzing and improving Go struct memory alignment.

Workflow-first AI code maintenance for reviews, changelogs, docs, and repository upkeep.

Reusable Rust engine (crate) for self-hosted advisory AI PR reviewers — reviews GitHub, GitLab & Bitbucket PRs. Line-anchored inline comments, committable suggestions, tree-sitter structural context, OSV.dev CVE scans. Ships as one binary (npm, PyPI, crates.io, curl) with JSON output, so the bot around it can be any language that spawns a process.