Repository Index

ShellCheck, a static analysis tool for shell scripts

• haskell
• shell
• static-analysis
• bash

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

• agent-security
• agent-skills
• agentic-ai
• ai-security

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

A static analyzer for Java, C, C++, and Objective-C

• static-analysis
• static-code-analysis
• code-quality
• java

✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!

• dependency-analysis
• lint
• maintenance
• typescript

Continuous Inspection

• sonarqube
• code-quality
• static-analysis

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

• terraform
• static-analysis
• aws
• gcp

Go security checker

• golang
• security
• security-tools
• security-automation

Bandit is a tool designed to find common security issues in Python code.

• linter
• bandit
• security-tools
• security-scanner

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

A static analysis security vulnerability scanner for Ruby on Rails applications

• ruby
• rails
• security
• static-analysis

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis

Staticcheck - The advanced Go linter

• linters
• static-analysis
• linter
• staticcheck

static analysis of C/C++ code

• cppcheck
• c-plus-plus
• static-analysis
• cross-platform

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

• static-analysis
• php
• type-inference
• security-analysis

🔰 Instant PHP quality checks from your console

• php
• static
• analytics
• code

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

• php
• static-analysis
• phan
• analysis

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

🚀Optimizer for mobile applications

• optimizer
• android
• gradle-plugin
• bytecode-manipulation

A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C

Detect copy-pasted and structurally similar code

• code-analysis
• duplication
• refactoring
• clean-code

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter