#static-analysis

Tools for PHP_CodeSniffer sniff developers

PHPCompatibility ruleset which can be included in projects using @ircmaxell's PasswordCompat polyfill library

Pre-submission compliance scanner for the Apple App Store and Google Play. Scans code, privacy manifests, Android manifests, and IPA/APK/AAB binaries against the review guidelines. Offline, no account.

PHP_CodeSniffer rules (sniffs) for Acquia coding standards

prealloc is a Go static analysis tool to find slice declarations that could potentially be preallocated.

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking, git change impact, graph schema v3. Works with GitHub, GitLab & local dirs. 35 languages. Zero data collection.

Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.

A programming language where signatures declare types, effects, and machine-checked promises — proven with Z3, compiled with LLVM. Built for trusting AI-written code.

Agent memory + every context-engineering primitive (write / select / compress / isolate) in one importable library. Ranked recall with activation decay over SQLite/FTS5. One production dependency (better-sqlite3).

Deterministic security & quality gate engine for git repos. Installs pre-commit/pre-push hooks that run secret scanning (gitleaks), SAST (semgrep/OWASP), linting (ruff/eslint), type checks, dependency audits, and tests — security findings block, quality issues warn. Event-sourced findings ledger, one-command setup: aramid init <repo>.

Universal Code Navigator

Write oxlint custom lint rules with Effect v4

Architecture testing for TypeScript

Repository policy and decision documentation tool

Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.

该仓库未发布描述。

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

该仓库未发布描述。

PHPCompatibility ruleset for Joomla projects

Laminas Framework 3 extensions for PHPStan

All-in-one devtool to automatically analyze, search and visualize project modules and dependencies from JavaScript, TypeScript (JSX/TSX) and Node.js (ES6, CommonJS)

🚀Optimizer for mobile applications

Code duplication detector powered by Elixir AST analysis

A linter for Go documentation practice (aka "Go Doc Comments" or "godoc")

Codebase intelligence shell and SDK — pip install jsat

Detect hidden Unicode attacks in source code before they fool you.

Diagnose your GitHub Actions: flaky jobs, wasted minutes, slow steps, cache problems, and workflow anti-patterns — in one command, zero config.

该仓库未发布描述。

该仓库未发布描述。

Static analysis library for Go compiled binaries - identification and metadata extraction