#static-analysis (30 Repositories)
Ranked open-source repositories tagged with #static-analysis, scored by pull request acceptance likelihood and maintainer engagement velocity.
80.0%
11.7h
30 repositories tagged #static-analysis
asamassekou10/ship-safe
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
phpstan/phpstan-webmozart-assert
PHPStan extension for webmozart/assert
DataDog/datadog-static-analyzer
Datadog Static Analyzer
SonarSource/sonarqube-cli
Command-line interface for SonarQube with AI agent integration. Scan for secrets and get fast feedback on code quality and security from your terminal.
soot-oss/SootUp
A new version of Soot with a completely overhauled architecture
fallow-rs/fallow
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
qltysh/qlty
💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability
SonarSource/SonarJS
SonarSource Static Analyzer for JavaScript and TypeScript
wala/WALA
T.J. Watson Libraries for Analysis, with front ends for Java, Android, and JavaScript, and many common static program analyses.
open-policy-agent/regal
Regal is a linter and language server for Rego, bringing your policy development experience to the next level!
zizmorcore/zizmor
Static analysis for GitHub Actions (and more)
checkstyle/checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
AeneasVerif/charon
Analyze Rust crates without touching compiler internals
goblint/analyzer
Static analysis framework for C
SonarSource/sonarlint-intellij
SonarQube plugin for JetBrains IDEs providing code quality and security feedback directly in the IDE
Shopify/rubydex
A high-performance static analysis toolkit for Ruby
Ericsson/codechecker
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
uber-go/nilaway
Static analysis tool to detect potential nil panics in Go code
clay-good/OpenLore
Deterministic, local-first memory and guardrails for AI coding agents with no LLM in the hot path.
igor-php/igor-php
Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.
gaul/modernizer-maven-plugin
Detect uses of legacy Java APIs
SonarSource/sonar-java
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
securego/gosec
Go security checker
uber/NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
soot-oss/soot
Soot - A Java optimization framework
phpstan/phpstan-deprecation-rules
PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits.
ast-metrics/ast-metrics
See the invisible structure of your code. Multi-language code quality and architecture analyzer (Go, PHP, Python, Rust...)
morluto/rea
Reverse engineer anything with agents, from app behavior down to native binaries.
astral-sh/ruff
An extremely fast Python linter and code formatter, written in Rust.