Ranked by Attention Score: stars gained over the last 180 complete days
42 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
PHP Static Analysis Tool - discover bugs in your code without running it!
A static analyzer for Java, C, C++, and Objective-C
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
Staticcheck - The advanced Go linter
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
A tool to identify unused code in Swift projects.
Tfsec is now part of Trivy
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Pretty good call graphs for dynamic languages
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
🔰 Instant PHP quality checks from your console
Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
Beautiful and understandable static analysis tool for PHP
A Ruby code quality reporter
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
eBPF verifier based on abstract interpretation
An Elixir tool for checking safety of database migrations.
Linting tool for CloudFormation templates
Manage translation and localization with static analysis, for Ruby i18n
A static analysis tool for security
Linter for dangerous Postgres migration patterns in Diesel and SQLx. Prevents downtime caused by unsafe schema changes.
Detect copy-pasted and structurally similar code
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
A static code analyser for annotated TODO comments
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
H(igh) A(ssurance) ROS - Static analysis of ROS1 application code.
Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.