#static-analysis

PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions

The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.

Signatures for entire Python programs. Extract the structure, the frame, the skeleton of your project, to generate API documentation or find breaking changes in your API.

Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.

PHPUnit extensions and rules for PHPStan

An analysis tool for Python that blurs the line between testing and type systems.

Code style checking for Capybara files.

Node.js dependency tracing utility

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

Local codebase intelligence CLI + MCP server for AI coding agents: SQLite code graph, 28 languages, 287 commands, 246 MCP tools, change-safety gates, audit evidence, zero API keys.

Persistent memory and receipt-verified workflows for Claude Code — plugin, MCP server, and spec-driven dev framework in one pip install.

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

Code style checking for factory_bot files.

Code style checking for Rails-related RSpec files.

CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions

Interactive architecture diagrams for codebases

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

PHP Compatibility check for PHP_CodeSniffer

Find leaked secrets everywhere.

A lightning fast shell linter/formatter/LSP server with zsh support

Reflection library to do Static Analysis for PHP Projects

Nette Framework class reflection extension for PHPStan & framework-specific rules

Extra strict and opinionated rules for PHPStan

KeY Theorem Prover for Deductive Java Verification

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.

A Github Action for linting C/C++ code integrating clang-tidy and clang-format to collect feedback provided in the form of file-annotations, thread-comments, workflow step-summary, and Pull Request reviews.

Understand, analyze, and govern software systems across repositories, languages, and technologies.

Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?

PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.