Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Repository Index
47,133 repositories indexed
1–24 of 24 · Most stars
A static analyzer for Java, C, C++, and Objective-C
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
Program for determining types of files for Windows, Linux and MacOS.
Continuous Inspection
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
The modern Java bytecode editor
Catch common Java mistakes as compile-time errors
An extensible multilanguage static code analyzer.
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
Detect uses of legacy Java APIs
Error Prone extensions: extra bug checkers and a large battery of Refaster rules.
Make Java source layout deterministic: reorder class members safely, keep accessors together, format java-source, and enforce style in CI.
StaDynA: Addressing the Problem of Dynamic Code Updates in the Security Analysis of Android Applications
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
Turn any Java, Kotlin or Python project into an AI-ready context file in one command.