Repository Index

ShellCheck, a static analysis tool for shell scripts

• haskell
• shell
• static-analysis
• bash

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

• terraform
• static-analysis
• aws
• gcp

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

• laravel
• phpstan
• php
• code-analysis

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

• iac
• infrastructure-as-code
• security
• appsec

TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.

• adb
• android
• cli
• kotlin

A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects

• csharp-sourcegenerator
• hacktoberfest
• patterns
• contributions-welcome

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

• attack-surfaces
• pentesting
• security
• devsecops

Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.

• business-logic
• code-analysis
• code-understanding
• codebase-analysis

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

• bugbounty
• security
• security-tools
• mobile-security

MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.

SPARK 2014 is the new version of SPARK, a software development technology specifically designed for engineering high-reliability applications.

Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.

• dependency-analysis
• reverse-dependencies
• dependency-resolution
• file-dependencies

Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.

• ai-code-review
• cli
• code-review
• developer-tools

Delphi language plugin for SonarQube

• delphi
• pascal
• sonarqube-plugin
• code-quality

Linter for dangerous Postgres migration patterns in Diesel and SQLx. Prevents downtime caused by unsafe schema changes.

• rust
• postgresql
• linter
• zero-downtime

An F# wrapper around Cosmos DB's .NET SDK to make it more friendly for F# developers

• cosmosdb
• fsharp
• azure

A collection of static analyzers based on Roslyn that integrate with VS

Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.

• swift
• swiftsyntax
• clean-architecture
• linter

Static analysis tool to prevent logging of sensitive data by detecting struct fields marked as sensitive.