#static-analysis

PHPStan rules that help you migrate from PHP-FPM to FrankenPHP classic, then to worker mode. Rules are split by level with demos for every case.

Your vibe-coded app has hardcoded secrets, missing auth, and hallucinated imports. Find out in under a second.

Monorepository of @pumped-fn

Zero config, accurate JSON schema generator for helm charts via static analysis

Rust-based static analysis for TypeScript projects

Simplify code and repo health

Compact PHP repository symbol maps for coding-agent navigation.

Provides stub declarations for WPGraphQL core functions, classes and interfaces.

CodeIgniter extensions and rules for PHPStan

Static analysis tool that catches 1000+ bug patterns across all popular programming languages, with auto-wiring into AI coding agent quality guardrails

Open-source HIPAA compliance scanner for healthcare code. 140+ rules, 5 HIPAA categories. CLI + CI/CD + VS Code.

PHPCompatibility rulesets which can be included in projects using the Paragonie polyfill libraries

Find Unused Public Elements in Your Code

Convert oxlint JSON output to SARIF

ESLint-style configurable architecture linter for Go projects

Deterministic pre-write guard for AI coding agents. Blocks an Edit/Write that references a symbol your repo doesn't have — before it lands, not after the build fails. No LLM, no API keys, ~0 tokens: the same code produces the same answer. Catches hallucinated bare calls, consts and type refs; 4 of 9 on our real-hallucination benchmark.

Go library for SARIF - Static Analysis Results Interchange Format

A PSR-2-R code sniffer and code-style auto-correction-tool - including many useful additions

Static analysis, linter & logic solver for PHP regular expressions

sound abstract interpretation for WebAssembly — the third DO-333 leg of the PulseEngine verification chain

Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.

TYPO3 CMS class reflection extension for PHPStan & framework-specific rules

🚀 Fast detection of composer dependency issues (unused dependencies, shadow dependencies, misplaced dependencies)

Run zizmor from GitHub Actions!

Open-source Software Intelligence Platform. Deterministic verification, structural PR reviews, interactive graph explorer, and proactive intelligence — powered by the Software Graph. 41 node types · 32 relationships · 120+ checks.

A polyglot import-topology linter: zones, sealed deep modules, guest lists, cycle bans, reach ceilings - judged against the real import graph.

Multi-model code review council — consensus-driven PR reviews

A structural linter that enforces layers, module roles, and function shape in Python.

Various static analysis and testing tools for managing PromQL compatible monitoring stacks

Drop it into your repo and let an AI Senior reviewer go through every PR — inline comments, severity-coded findings, and a general summary, all configurable per project and tech stack. Supports OpenAI, Anthropic, Gemini, and Ollama. Auto-detects your stack (NestJS, Next.js, React, TypeScript, Node, Flutter, Laravel) and applies built-in rules for