1.ast-grep / ast-grep
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
- codemod
- linter
- ast
- babel
- command-line
- command-line-tool
- +9 more
+1,086 stars
from 15,345 · score 6.99
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
30 repositories by Attention Score · Aug 6, 2026 – Nov 3, 2026 (UTC)
2.fallow-rs / fallow
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
- cli
- code-quality
- dead-code
- developer-tools
- javascript
- oxc
- +12 more
+1,073 stars
from 4,223 · score 6.98
3.anthropics / claude-code-security-review
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
+985 stars
from 5,720 · score 6.89
4.kucherenko / jscpd
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
- copy-paste
- duplicates
- cpd
- code-quality
- clones-detection
- ai
- +14 more
+545 stars
from 5,952 · score 6.30
+136 stars
from 4,732 · score 4.92
6.owasp-noir / noir
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
- attack-surfaces
- pentesting
- security
- devsecops
- hacktoberfest
- owasp
- +5 more
+117 stars
from 1,355 · score 4.77
7.phpstan / phpstan
PHP Static Analysis Tool - discover bugs in your code without running it!
- phpstan
- static-analysis
- php
- php7
- testing
- static-code-analysis
- +1 more
+106 stars
from 14,043 · score 4.67
8.meta / infer
A static analyzer for Java, C, C++, and Objective-C
- static-analysis
- static-code-analysis
- code-quality
- java
- c
- cpp
- +1 more
+102 stars
from 15,640 · score 4.63
9.dominikh / go-tools
Staticcheck - The advanced Go linter
- linters
- static-analysis
- linter
- staticcheck
- sponsor
+95 stars
from 6,826 · score 4.56
10.larastan / larastan
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
- laravel
- phpstan
- php
- code-analysis
+89 stars
from 6,459 · score 4.50
+67 stars
from 2,979 · score 4.22
12.uber / NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
- java
- static-analysis
- android
- nullability
- nullability-analysis
- static-code-analysis
+55 stars
from 4,074 · score 4.03
13.aquasecurity / tfsec
Tfsec is now part of Trivy
- terraform
- security
- scanner
- static-analysis
- ci
- aws
- +13 more
+47 stars
from 7,014 · score 3.87
14.vimeo / psalm
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
- static-analysis
- php
- type-inference
- security-analysis
- taint-analysis
- hacktoberfest
+42 stars
from 5,864 · score 3.76
15.rrrene / credo
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
- elixir
- code-analysis
- static-analysis
- linter
- credo
+35 stars
from 5,194 · score 3.58
16.scottrogowski / code2flow
Pretty good call graphs for dynamic languages
+33 stars
from 4,587 · score 3.53
17.nunomaduro / phpinsights
🔰 Instant PHP quality checks from your console
- php
- static
- analytics
- code
- quality
- style
- +7 more
+30 stars
from 5,617 · score 3.43
18.phpmetrics / PhpMetrics
Beautiful and understandable static analysis tool for PHP
+19 stars
from 2,598 · score 3.00
19.microsoft / DevSkim
DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.
+18 stars
from 999 · score 2.94
20.peripheryapp / peripheryArchived
A tool to identify unused code in Swift projects.
+15 stars
from 6,166 · score 2.77
21.whitesmith / rubycritic
A Ruby code quality reporter
- ruby
- static-analysis
- quality-reporter
- metrics
- best-practices
+14 stars
from 3,494 · score 2.71
+14 stars
from 2,038 · score 2.71
23.SergeyTeplyakov / ErrorProne.NET
Set of roslyn-based analyzers for catching common C# errors (inspired by Google's error-prone)
+14 stars
from 1,120 · score 2.71
24.maglnet / ComposerRequireChecker
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
- code-quality
- ci-tools
+7 stars
from 1,004 · score 2.08
25.glebm / i18n-tasks
Manage translation and localization with static analysis, for Ruby i18n
- static-analysis
- static-code-analysis
- ruby
- i18n
- translation-management
+6 stars
from 2,154 · score 1.95
26.stelligent / cfn_nag
Linting tool for CloudFormation templates
- continuous-testing
- unit-testing
- cloudformation
- aws
- devops
- iam-rules
- +14 more
+6 stars
from 1,306 · score 1.95
27.djezzzl / database_consistency
The tool to avoid various issues due to inconsistencies and inefficiencies between a database schema and application models.
- ruby-on-rails
- activerecord
- tool
- database
- consistency
- optimization
- +3 more
+5 stars
from 1,191 · score 1.79
28.danielstjules / jsinspect
Detect copy-pasted and structurally similar code
- code-analysis
- duplication
- refactoring
- clean-code
- javascript
+4 stars
from 3,575 · score 1.61
+2 stars
from 1,457 · score 1.10
30.vincentcox / StaCoAn
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
- bugbounty
- security
- security-tools
- mobile-security
- static-code-analysis
+2 stars
from 868 · score 1.10