Repository Index

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

• static-analysis
• static-code-analysis
• java
• go

A static analyzer for Java, C, C++, and Objective-C

• static-analysis
• static-code-analysis
• code-quality
• java

✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!

• dependency-analysis
• lint
• maintenance
• typescript

Continuous Inspection

• sonarqube
• code-quality
• static-analysis

Remove unused CSS. Also works with single-page apps.

A JavaScript checker and optimizer.

• closure-compiler
• javascript
• optimization
• typechecking

Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.

• dependency-cruiser
• typescript
• javascript
• static-analysis

Catch common Java mistakes as compile-time errors

• java
• static-analysis

TypeScript Compiler API wrapper for static analysis and programmatic code changes.

• typescript
• ast
• code-generation
• javascript

An extensible multilanguage static code analyzer.

• code-analysis
• code-quality
• static-analysis
• static-code-analysis

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

An advanced, unified platform for code quality, architectural metrics, and Agile analytics. Features Python AST parsing, Java static analysis (code smells), and interactive project health dashboards built with Streamlit.

• agile
• code-analysis
• dashboard
• data-visualization

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

• java
• static-analysis
• android
• nullability

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

• findbugs
• static-analysis
• code-analysis
• static-code-analysis

Detect copy-pasted and structurally similar code

• code-analysis
• duplication
• refactoring
• clean-code

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

• mess-detector
• php
• pmd
• static-analysis

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

• findbugs
• java
• security-audit
• owasp

Find unused and duplicate CSS

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

• java
• sonarqube
• static-code-analysis
• static-analyzer

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

• bugbounty
• security
• security-tools
• mobile-security

Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

• sast
• security-tools
• security-scanner
• security-automation

Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.

• maven-plugin
• maven
• java
• report

Detect uses of legacy Java APIs

• java
• static-analysis
• maven-plugin
• guava