Top 145 static-code-analysis open source projects

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

SonarSource Static Analyzer for JavaScript and TypeScript

🌟 JavaScript Style Guide, with linter & automatic code fixer

scalastyle

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

Next-gen phpDoc parser with support for intersection types and generics

Vulnerability Patterns Detector for C# and VB.NET

A GitHub app to automatically review Python code style over Pull Requests

phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code

Code analyzer for C# and VB.NET projects https://redirect.sonarsource.com/plugins/vbnet.html

A RuboCop extension focused on enforcing Rails best practices and coding conventions.

Golang security checker

Soufflé is a variant of Datalog for tool designers crafting analyses in Horn clauses. Soufflé synthesizes a native parallel C++ program from a logic specification.

prealloc is a Go static analysis tool to find slice declarations that could potentially be preallocated.

ESLint Shareable Config for React/JSX support in JavaScript Standard Style

🌿 NodeJS PHP Parser - extract AST or tokens (PHP5 and PHP7)

T.J. Watson Libraries for Analysis

Droidefense: Advance Android Malware Analysis Framework

Find and fix problems in your JavaScript code.

Symfony extension for PHPStan

Visual Studio extension that intelligently introduces new C# features into your existing codebase

An extension of RuboCop focused on code performance checks.

Doctrine extensions for PHPStan

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

An extensible multilanguage static code analyzer.

It's not just a linter that annoys you!

A static type analyzer for Python code

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

Documenting the explosion of packages in the standard ecosystem!

Bandit is a tool designed to find common security issues in Python code.

Extra strict and opinionated rules for PHPStan

🐘 SonarPHP: PHP static analyzer for SonarQube & SonarLint

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

Chronos - A static race detector for the go language

Sonar plugin to analyze ESQL-sourcecode of IBM Integration Bus projects

Code Climate engine for code duplication analysis

A linter, formatter for finding and removing unused import statements.

This repo demonstrates how to work on CI/CD for Mobile Apps 📱 using Github Actions 💊 + Firebase Distribution 🎉

List of packages that use `standard`

⚙️ Scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects at GitHub with Qodana

Static analysis framework for .NET programs.

Ruby on Rails Continuous Deployment Ecosystem to maintain Healthy Stable Development

A plugin to simplify Static Code Analysis on Gradle. Not restricted to, but specially useful, in Android projects, by making sure all analysis can access the SDK classes.

Code Climate Engine for ESLint

Static call graph generator. The official Python 3 version. Development repo.

A tool for collecting historical metrics about a project's dependencies

Detection of design principle violations in Kotlin as a plugin to detekt.

Code Climate Engine for PHP Code Sniffer

OpenStaticAnalyzer is a source code analyzer tool, which can perform deep static analysis of the source code of complex systems.

A library to read static analysis reports into a Java object model

EBA is a static bug finder for C.

nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.

🔎 Nodejs Reflection API for PHP files based on the php-parser

Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io

identypo is a Go static analysis tool to find typos in identifiers (functions, function calls, variables, constants, type declarations, packages, labels).

Analyzes Elm projects, to help find mistakes before your users find them.

Comments Bitbucket Server (or Stash) pull requests with static code analyzer findings.

Go Taint CHeck Analyser

Static program analysis framework for Ethereum smart contract bytecode.