Repository Index

ShellCheck, a static analysis tool for shell scripts

• haskell
• shell
• static-analysis
• bash

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

TranslatedDeepAudit: An AI hacker team for everyone, putting vulnerability discovery within reach. Beginners can deploy and run it with one click, with autonomous collaborative auditing + automated sandbox PoC verification. Supports private deployment with Ollama and one-click report generation. Supports relay stations. Making security no longer expensive and auditing no longer complicated.

• ai
• bug-detection
• code-audit
• code-quality

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

• laravel
• phpstan
• php
• code-analysis

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

Static Analyzer for Solidity and Vyper

• solidity
• ethereum
• static-analysis
• vyper

High performance, maintainable stylesheets.

• css
• css-modules
• sass

TypeScript Compiler API wrapper for static analysis and programmatic code changes.

• typescript
• ast
• code-generation
• javascript

Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.

• code-property-graph
• compiler-theory
• program-analysis
• robdd

Paste any GitHub URL → interactive architecture map. See how files connect, find what breaks if you change something. No install, no accounts — runs entirely in your browser.

• architecture
• browser-based
• code-analysis
• codebase-visualization

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

• code-analyzer
• code-style
• coding-standards
• formatter

TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.

• adb
• android
• cli
• kotlin

Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.

• business-logic
• code-analysis
• code-understanding
• codebase-analysis

The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.

• ruby-on-rails
• activerecord
• tool
• database

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

• bugbounty
• security
• security-tools
• mobile-security

TypeScript Language Service Plugin for GraphQL developers

• typescript
• graphql
• language-server
• plugin

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

• dead
• phpstan
• phpstan-rules
• unused-code

Performs advanced static analysis on PHP code

A high-performance static analysis toolkit for Ruby

• ruby
• static-analysis
• type-checking

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

Gixy-Next: NGINX Configuration Security Scanner & Performance Checker

• gixy
• nginx
• nginx-configuration
• security

Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.

• ai-code-review
• cli
• code-review
• developer-tools