Ranked by Attention Score: stars gained over the last 30 complete days
63 repositories by Attention Score · Oct 5, 2026 – Nov 3, 2026 (UTC)
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Turn any codebase into a knowledge graph grounded in formal methods. Your AI agents get exact answers for any code-related task, ensure correctness, and optimize time and token usage.
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
ShellCheck, a static analysis tool for shell scripts
Your agent writes bad React. This catches it
Security linter for AI-generated code: catches the exact vulnerabilities Copilot, Cursor and ChatGPT repeatedly produce. SQL injection, hardcoded secrets, JWT bypass, command injection and 15+ more rules. Grade A–F. Zero config. CI/CD ready.
Bandit is a tool designed to find common security issues in Python code.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
The best way of working with Protocol Buffers.
Go security checker
PHP Static Analysis Tool - discover bugs in your code without running it!
A static analyzer for Java, C, C++, and Objective-C
An extensible multilanguage static code analyzer.
static analysis of C/C++ code
Static code analysis for Kotlin
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Staticcheck - The advanced Go linter
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
It's not just a linter that annoys you!
Tfsec is now part of Trivy
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
A static analysis security vulnerability scanner for Ruby on Rails applications
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
A tool for use with clang to analyze #includes in C and C++ source files
Roslynator is a set of code analysis tools for C#, powered by Roslyn.
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
🔰 Instant PHP quality checks from your console
Awesome autocompletion, static analysis and refactoring library for python
Pretty good call graphs for dynamic languages
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
High performance, maintainable stylesheets.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
🚀Optimizer for mobile applications
A tool to identify unused code in Swift projects.
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
A Ruby code quality reporter
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
Mirror kept for legacy. Moved to https://github.com/llvm/llvm-project
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
Detect copy-pasted and structurally similar code
Manage translation and localization with static analysis, for Ruby i18n
Beautiful and understandable static analysis tool for PHP