Repository Index

✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!

• dependency-analysis
• lint
• maintenance
• typescript

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

• ai
• code-intelligence
• dead-code
• developer-tools

Staticcheck - The advanced Go linter

• linters
• static-analysis
• linter
• staticcheck

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality

Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.

• code-property-graph
• compiler-theory
• program-analysis
• robdd

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

• php
• static-analysis
• phan
• analysis

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

• java
• static-analysis
• android
• nullability

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

• findbugs
• static-analysis
• code-analysis
• static-code-analysis

A Ruby code quality reporter

• ruby
• static-analysis
• quality-reporter
• metrics

Roslynator is a set of code analysis tools for C#, powered by Roslyn.

• csharp
• roslyn
• visual-studio
• dotnet

A Golang tool that does static analysis, unit testing, code review and generate code quality report.

• codereview
• reporter
• golang
• golang-tools

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

• iac
• infrastructure-as-code
• security
• appsec

TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.

• adb
• android
• cli
• kotlin

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

• findbugs
• java
• security-audit
• owasp

TranslatedA SQL full-lifecycle quality management platform that supports many different types of databases, covers pre-event control, post-event supervision, and standard release scenarios, and helps you establish quality standards

• mysql
• sql-audit
• sql
• audit

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

• attack-surfaces
• pentesting
• security
• devsecops

A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

• code-quality
• ci-tools

Flog reports the most tortured code in an easy to read pain report. The higher the score, the more pain the code is in.

plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).

• plpgsql
• postgresql
• extension
• c

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

• codereview
• cybersecurity
• ruby
• sinatra

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

• sast
• security-tools
• security-scanner
• security-automation

Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.

• maven-plugin
• maven
• java
• report