47,133 repositories indexed
1–24 of 46 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
The best way of working with Protocol Buffers.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
A static analysis security vulnerability scanner for Ruby on Rails applications
Catch common Java mistakes as compile-time errors
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
Pretty good call graphs for dynamic languages
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
A Ruby code quality reporter
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
An analyzer library for C# and VB that uses Roslyn to produce refactorings, code analysis, and other niceties.
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
Code analyzer for C# and VB.NET projects
plpgsql_check is a linter tool (does source code static analyze) for the PostgreSQL language plpgsql (the native language for PostgreSQL store procedures).
Flay analyzes code for structural similarities. Differences in literal values, variable, class, method names, whitespace, programming style, braces vs do/end, etc are all ignored.