ShellCheck, a static analysis tool for shell scripts
- haskell
- shell
- static-analysis
- bash
Repository Index
47,133 repositories indexed
1–24 of 25 · Most stars
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Your agent writes bad React. This catches it
- agents
- code-review
- doctor
- react
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
- dependency-analysis
- lint
- maintenance
- typescript
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
High performance, maintainable stylesheets.
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
- cli
- code-quality
- dead-code
- developer-tools
🚀Optimizer for mobile applications
- optimizer
- android
- gradle-plugin
- bytecode-manipulation
Find dead Python code
- python
- dead-code-removal
Detect copy-pasted and structurally similar code
- code-analysis
- duplication
- refactoring
- clean-code
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
Static analyzer and linter for Clojure code that sparks joy
- clojure
- clojurescript
- linter
- static-analysis
Find unused and duplicate CSS
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
- bugbounty
- security
- security-tools
- mobile-security
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
- sast
- security-tools
- security-scanner
- security-automation
Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
- dead
- phpstan
- phpstan-rules
- unused-code
Turn any codebase into a knowledge graph grounded in formal methods. Your AI agents get exact answers for any code-related task, ensure correctness, and optimize time and token usage.
Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.
- dependency-analysis
- reverse-dependencies
- dependency-resolution
- file-dependencies
👮Sanitize your Assets.xcassets files
- script
- ios
- swift
- xcode
Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.
- ai-code-review
- cli
- code-review
- developer-tools
Spot vulnerabilities in postgres SQL scripts
- postgresql
- security
- python
Search for unused components in your Ember project