47,133 repositories indexed
1–24 of 64 · Most stars
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Continuous Inspection
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
Tfsec is now part of Trivy
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
Awesome autocompletion, static analysis and refactoring library for python
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
🔰 Instant PHP quality checks from your console
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
Detect copy-pasted and structurally similar code
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
Roslynator is a set of code analysis tools for C#, powered by Roslyn.
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
Keep your architecture clean.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
Static analyzer and linter for Clojure code that sparks joy
A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.