Trending repositories

1.ast-grep / ast-grep

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

• codemod
• linter
• ast
• babel
• command-line
• command-line-tool
• +9 more

2.fallow-rs / fallow

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

• cli
• code-quality
• dead-code
• developer-tools
• javascript
• oxc
• +12 more

3.anthropics / claude-code-security-review

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

4.kucherenko / jscpd

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

• copy-paste
• duplicates
• cpd
• code-quality
• clones-detection
• ai
• +14 more

5.jendrikseipp / vulture

Find dead Python code

• python
• dead-code-removal

6.owasp-noir / noir

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

• attack-surfaces
• pentesting
• security
• devsecops
• hacktoberfest
• owasp
• +5 more

7.meta / infer

A static analyzer for Java, C, C++, and Objective-C

• static-analysis
• static-code-analysis
• code-quality
• java
• c
• cpp
• +1 more

8.phpstan / phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

• phpstan
• static-analysis
• php
• php7
• testing
• static-code-analysis
• +1 more

9.dominikh / go-tools

Staticcheck - The advanced Go linter

• linters
• static-analysis
• linter
• staticcheck
• sponsor

10.larastan / larastan

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

• laravel
• phpstan
• php
• code-analysis

11.deptrac / deptrac

Keep your architecture clean.

• architecture
• php
• clean-architecture

12.uber / NullAway

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

• java
• static-analysis
• android
• nullability
• nullability-analysis
• static-code-analysis

13.aquasecurity / tfsec

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis
• ci
• aws
• +13 more

14.vimeo / psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

• static-analysis
• php
• type-inference
• security-analysis
• taint-analysis
• hacktoberfest

15.shipmonk-rnd / dead-code-detector

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

• dead
• phpstan
• phpstan-rules
• unused-code
• php
• dead-code-removal
• +2 more

16.rrrene / credo

A static code analysis tool for the Elixir language with a focus on code consistency and teaching.

• elixir
• code-analysis
• static-analysis
• linter
• credo

17.scottrogowski / code2flow

Pretty good call graphs for dynamic languages

18.nunomaduro / phpinsights

🔰 Instant PHP quality checks from your console

• php
• static
• analytics
• code
• quality
• style
• +7 more

19.phpmetrics / PhpMetrics

Beautiful and understandable static analysis tool for PHP

• static-analyzer
• quality
• php
• metrics
• ci

20.microsoft / DevSkim

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

• security
• sdl
• linter
• visual-studio-code-extension
• visual-studio-extension

21.jayu / rev-dep

Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.

• dependency-analysis
• reverse-dependencies
• dependency-resolution
• file-dependencies
• unused-files
• dead-files
• +14 more

22.peripheryapp / peripheryArchived

A tool to identify unused code in Swift projects.

• swift
• xcode
• ios
• macos
• apple

23.whitesmith / rubycritic

A Ruby code quality reporter

• ruby
• static-analysis
• quality-reporter
• metrics
• best-practices

24.mpeterv / luacheck

A tool for linting and static analysis of Lua code.

• lua
• linter

25.SergeyTeplyakov / ErrorProne.NET

Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)

26.designsecurity / progpilot

A static analysis tool for security

• php
• static-code-analysis
• security-tools
• vulnerability-scanners

27.glebm / i18n-tasks

Manage translation and localization with static analysis, for Ruby i18n

• static-analysis
• static-code-analysis
• ruby
• i18n
• translation-management

28.stelligent / cfn_nag

Linting tool for CloudFormation templates

• continuous-testing
• unit-testing
• cloudformation
• aws
• devops
• iam-rules
• +14 more

29.djezzzl / database_consistency

The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.

• ruby-on-rails
• activerecord
• tool
• database
• consistency
• optimization
• +3 more

30.maglnet / ComposerRequireChecker

A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

• code-quality
• ci-tools

31.vbpf / prevail

eBPF verifier based on abstract interpretation

• abstract-interpretation
• static-analyzer
• ebpf
• ebpf-verifier

32.Shopify / spoom

Useful tools for Sorbet enthusiasts

• sorbet
• typing
• coverage
• lsp

33.danielstjules / jsinspect

Detect copy-pasted and structurally similar code

• code-analysis
• duplication
• refactoring
• clean-code
• javascript

34.insidersec / insider

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

• sast
• security-tools
• security-scanner
• security-automation
• cli
• android-security
• +14 more

35.fsprojects / FSharpLint

Lint tool for F#

• fsharp
• lint
• linter
• dotnet

36.bladestan / bladestan

PHPStan analysis for Blade templates

37.woshiccm / Pecker

CodePecker is a tool to detect unused Swift code.

38.vincentcox / StaCoAn

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

• bugbounty
• security
• security-tools
• mobile-security
• static-code-analysis

39.presmihaylov / todocheck

A static code analyser for annotated TODO comments

• go
• linters
• todo
• hacktoberfest

40.mibk / dupl

a tool for code clone detection

• go
• tool
• code-clones
• golang
• golang-tools

41.Artur-Sulej / excellent_migrations

An Elixir tool for checking safety of database migrations.

• elixir
• static-analysis
• code-analysis
• credo
• ecto
• migrations
• +1 more

42.ClaudiuGeorgiu / RiskInDroid

A tool for quantitative risk analysis of Android applications based on machine learning techniques

• android
• risk
• android-permissions
• quantitative-risk-analysis
• machine-learning
• riskindroid

43.ayarotsky / diesel-guard

Linter for dangerous Postgres migration patterns in Diesel and SQLx. Prevents downtime caused by unsafe schema changes.

• rust
• postgresql
• linter
• zero-downtime
• cli
• database
• +9 more

44.thesp0nge / dawnscanner

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

• codereview
• cybersecurity
• ruby
• sinatra
• padrino
• vulnerabilities
• +4 more

45.tomzx / php-semver-checker

Compares two source sets and determines the appropriate semantic versioning to apply.

• php
• semver
• inspection
• ruleset
• analyzer