Ranked by Attention Score: stars gained over the last 90 complete days
58 repositories by Attention Score · Aug 6, 2026 – Nov 3, 2026 (UTC)
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
Complex code hides connections, workflows, and business risks.Unvibe complex code. Trace business workflows.
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Your agent writes bad React. This catches it
✂️ Find unused files, dependencies and exports in your JavaScript and TypeScript projects. Knip it before you ship it!
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
ShellCheck, a static analysis tool for shell scripts
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
The best way of working with Protocol Buffers.
Bandit is a tool designed to find common security issues in Python code.
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
Go security checker
PHP Static Analysis Tool - discover bugs in your code without running it!
A static analyzer for Java, C, C++, and Objective-C
static analysis of C/C++ code
Static code analysis for Kotlin
Staticcheck - The advanced Go linter
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
An extensible multilanguage static code analyzer.
A tool for use with clang to analyze #includes in C and C++ source files
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
It's not just a linter that annoys you!
Tfsec is now part of Trivy
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
A static analysis security vulnerability scanner for Ruby on Rails applications
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
Roslynator is a set of code analysis tools for C#, powered by Roslyn.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
Awesome autocompletion, static analysis and refactoring library for python
Pretty good call graphs for dynamic languages
🔰 Instant PHP quality checks from your console
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
Beautiful and understandable static analysis tool for PHP
🚀Optimizer for mobile applications
A tool to identify unused code in Swift projects.
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
A Ruby code quality reporter
High performance, maintainable stylesheets.
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
Mirror kept for legacy. Moved to https://github.com/llvm/llvm-project
Detect copy-pasted and structurally similar code