Repository Index

ShellCheck, a static analysis tool for shell scripts

• haskell
• shell
• static-analysis
• bash

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

• terraform
• static-analysis
• aws
• gcp

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

• laravel
• phpstan
• php
• code-analysis

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

It's not just a linter that annoys you!

• static-analysis
• linter
• static-code-analysis
• code-quality

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• appsec
• compliance
• devsecops
• devsecops-tools

Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.

• business-logic
• code-analysis
• code-understanding
• codebase-analysis

Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.

• ai-code-review
• cli
• code-review
• developer-tools

A cross-platform Vulkan layer which checks Vulkan applications for best practices on Arm Mali devices.