Top 145 static-code-analysis open source projects

PHPUnit extensions and rules for PHPStan

Jenkins Warnings Plugin - Next Generation

[LLVM Static Slicer] Various program analyses, construction of dependence graphs and program slicing of LLVM bitcode.

Lint JavaScript code blocks in Markdown documents

The ESLint custom parser for `.vue` files.

🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

A static analysis tool for security

Static analysis for Angular projects.

Policeman's Forbidden API Checker

Identify hardcoded secrets and dangerous behaviours

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

Code Climate CLI

Static code review for your Gerrit patchsets. Runs Checkstyle, PMD, FindBugs, Scalastyle, CodeNarc, JSLint for you!

ESLint Config for JavaScript Standard Style

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

Dead code detection with tombstones for PHP 🪦🧟

A static analyzer for Java, C, C++, and Objective-C

PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.

Allows old code to use new standards

Static code analysis for CFML (a linter)

walkmod: an open source tool to fix coding style issues

Type Analyzer for JavaScript

The leading static analyzer for Perl. Configurable, extensible, powerful.

A static code analysis for WordPress (and PHP)

[DEPRECATED] Find Python web-app bugs delightfully fast, without changing your workflow. 🍱

A Ruby static code analyzer and formatter, based on the community Ruby style guide.

Static program analysis for TIP

☕️ PMD Plugin for SonarQube

Manage translation and localization with static analysis, for Ruby i18n

Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

a FindBugs/SpotBugs plugin for doing static code analysis for java code bases

Feram finds & fixes bugs in your commits

A regex based source code scanner.

NsDepCop is a static code analysis tool that helps to enforce namespace dependency rules in C# projects. No more unplanned or unnoticed dependencies in your system.

Standalone linter for ABAP

PHP Static Analysis Tool - discover bugs in your code without running it!

A static-code-analysis tool for performing security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns.

F# analyzer that provides embedded SQL syntax analysis, type-checking for parameters and result sets and nullable column detection when writing queries using Npgsql.FSharp.

A linter, formatter for finding and removing unused import statements.

Java library for parsing report files from static code analysis.

Every programmer needs a rubberduck. COM add-in for the VBA & VB6 IDE (VBE).

The Source Code Sniffer is a poor man’s static code analysis tool (SCA) that leverages regular expressions. Designed to highlight high risk functions (Injection, LFI/RFI, file uploads etc) across multiple languages (ASP, Java, CSharp, PHP, Perl, Python, JavaScript, HTML etc) in a highly configurable manner.

CodeCharta visualizes multiple code metrics using 3D tree maps.

List of Maven examples

ESLint Shareable Config for JSX support in JavaScript Standard Style

🐞 Primitive Erlang Security Tool

A Static Code Analyzer for PHP (a PhpStorm/Idea Plugin)

Functional, composable, asynchronous, type-safe Python.

⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more.

The Hy Transformer

Kubernetes object analysis with recommendations for improved reliability and security

The official GitHub mirror of https://gitlab.com/pycqa/flake8

A static code analyzer for C++, C#, Lua

A linter that replay your developing style

A RuboCop extension focused on enforcing upstream best practices and coding conventions.

cfmt is a tool to wrap Go comments over a certain length to a new line.

ESLint configurations and additional rules for me

☕️ SonarSource Static Analyzer for Java Code Quality and Security

Additional ESLint's rules for Node.js

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.