AwesomeRepos
Sign in

Tags / Developer tools /

Static analysis

Tool that analyzes source code without running it to find bugs, security flaws, or dead code; not a style linter.

Repositories

17

Net stars gained, last 7 days

+4,020

Top-level Tag

Developer tools

Net stars gained each day, last 90 days

2026-10-18: +1,014 net stars. Most from AhmadHassan-BTed/OpenHeart, +864.2026-10-25: +971 net stars. Most from NVIDIA/SkillSpector, +280.2026-10-26: +976 net stars. Most from NVIDIA/SkillSpector, +562.2026-10-27: +1,123 net stars. Most from NVIDIA/SkillSpector, +565.2026-10-29: +858 net stars. Most from NVIDIA/SkillSpector, +290.

Peak days

  1. 1

    Oct 18, 2026 +1,014 net stars (median day +173)

  2. 2

    Oct 25, 2026 +971 net stars (median day +173)

  3. 3

    Oct 26, 2026 +976 net stars (median day +173)

  4. 4

    Oct 27, 2026 +1,123 net stars (median day +173)

  5. 5

    Oct 29, 2026 +858 net stars (median day +173)

A peak day has at least 2 times the net stars of the median day of this chart, and at least 100 more. For each peak day, the list shows the repositories that gained the most net stars that day. It also shows their GitHub releases of that day or the day before (UTC), and their creation date when it was 14 days or less before. These events occur near the same day. They do not show why the stars came.

Largest

Most stars in total now.

  1. koalaman/shellcheck40K

    description: ShellCheck, a static analysis tool for shell scripts

  2. NVIDIA/SkillSpector24K

    readme: **Two-stage analysis**: Fast static analysis + optional LLM semantic evaluation

  3. MobSF/Mobile-Security-Framework-MobSF22K

    description: security assessment framework capable of performing static and dynamic analysis.

  4. semgrep/semgrep17K

    readme: Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards.

  5. ast-grep/ast-grep16K

    readme: It can help you to do lightweight static analysis and massive scale code manipulation in an intuitive way.

  6. meta/infer16K

    description: A static analyzer for Java, C, C++, and Objective-C

  7. millionco/react-doctor15K

    description: Your agent writes bad React. This catches it

  8. phpstan/phpstan14K

    readme: PHPStan focuses on finding errors in your code without actually running it.

  9. AhmadHassan-BTed/OpenHeart5.9K

    description: Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.

  10. FinanceFlash/unvibecode990

    readme: Reverse engineer a complex codebase into business workflows, connected code, edge cases, and evidence-backed risks.

Newest Admissions

Entered the index by the rising rule, newest first.

  1. theconsensuslabs/noalloc133

    readme: the noalloc CLI will check the entire call tree from that function for heap allocations.

  2. zeroFhacker/vibeguard142

    description: Security linter for AI-generated code: catches the exact vulnerabilities Copilot, Cursor and ChatGPT repeatedly produce.

  3. FinanceFlash/unvibecode990

    readme: Reverse engineer a complex codebase into business workflows, connected code, edge cases, and evidence-backed risks.

  4. winnin/farol172

    readme: It works from static analysis (the compilers' own view of your code, not a model's guess), so the same pull request always gets the same answer.

  5. songjianyang/xss-audit551

    description: Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.

  6. Ernket/CodeScan-Artex266

    readme: **只做静态分析。** 平台不发起任何网络请求、不执行任何系统命令、不做任何运行时验证——结论必须由源码证据支撑。

  7. AxiomCodeAI/axiomcodegraph461

    readme: AxiomCode resolves each call from the receiver's declared and inferred type, as the compiler does.

  8. AhmadHassan-BTed/OpenHeart5.9K

    description: Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.

All 17 in the Repository Index

How a repository gets this Tag

An agent reads the description, the GitHub topics, and the start of the README of each repository. It chooses Tags only from the Tag list in the AwesomeRepos source code. For each Tag, it quotes the text. A code check keeps the Tag only when the quote is in that text. The quote under each repository is that evidence. A Tag does not rank repositories. It does not say that one repository can replace another. To report a wrong Tag, use "Report a problem with this page" on the page of the repository. All numbers on this page count only visible repositories.