ShellCheck, a static analysis tool for shell scripts
- haskell
- shell
- static-analysis
- bash
Repository Index
47,133 repositories indexed
1–24 of 42 · Most stars
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Your agent writes bad React. This catches it
- agents
- code-review
- doctor
- react
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
- dependency-analysis
- lint
- maintenance
- typescript
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
High performance, maintainable stylesheets.
🔰 Instant PHP quality checks from your console
- php
- static
- analytics
- code
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
- php
- static-analysis
- phan
- analysis
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
- cli
- code-quality
- dead-code
- developer-tools
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
- findbugs
- java
- security-audit
- owasp
TranslatedDesktop Android leak audit: permissions, endpoints, data flows, reversible fixes. Phone privacy audit: uses adb to scan an Android app's permissions, reporting endpoints, and data flows, and provides reversible remediation.
A semi-opinionated library which is a source generator and a code analyser. It Source generates Value Objects
- csharp-sourcegenerator
- hacktoberfest
- patterns
- contributions-welcome
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
- attack-surfaces
- pentesting
- security
- devsecops
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
- code-quality
- ci-tools
Flog reports the most tortured code in an easy to read pain report. The higher the score, the more pain the code is in.
Code analyzer for C# and VB.NET projects
- c-sharp
- sonarqube
- static-analysis
- static-analyzer
A Rake task gem that helps you find the unused routes and controller actions for your Rails 3+ app
Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
- codereview
- cybersecurity
- ruby
- sinatra
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
- dead
- phpstan
- phpstan-rules
- unused-code
Turn any codebase into a knowledge graph grounded in formal methods. Your AI agents get exact answers for any code-related task, ensure correctness, and optimize time and token usage.
A static code analyser for annotated TODO comments
- go
- linters
- todo
- hacktoberfest