#static-analysis

An extremely fast Python linter and code formatter, written in Rust.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

It's not just a linter that annoys you!

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

A tool to automatically fix PHP Coding Standards issues

A high-performance static analysis toolkit for Ruby

A vulnerability scanner for container images and filesystems

A common base representation of python source code for pylint and other projects

Code style checking for RSpec files.

A new version of Soot with a completely overhauled architecture

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

Security Scanner for Agent Skills

Static code analysis for Kotlin

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

Regal is a linter and language server for Rego, bringing your policy development experience to the next level!

Go security checker

Official ESLint plugin for Vue.js

Static analysis for GitHub Actions

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability

Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

PHP Static Analysis Tool - discover bugs in your code without running it!

Static scanner for MCP-connected AI agent pipelines — 271 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.

PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions

Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles: unused code, duplication, circular deps, complexity hotspots, architecture boundaries, design-system drift. Optional paid runtime layer (Fallow Runtime): hot-path review and cold-path deletion evidence from real production traffic.