1.AhmadHassan-BTed / OpenHeart
Succinct Compositional Program Graph (SCPG) static analysis engine & 14-diagram UML generator in Rust.
+1,639 stars
from 4,122 · score 7.40
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
72 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.openqodex / openqodex
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
+309 stars
from 784 · score 5.74
3.morluto / awesome-reverse-engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
+268 stars
from 1,233 · score 5.59
4.repowise-dev / repowise
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
+182 stars
from 7,908 · score 5.21
5.tirth8205 / code-review-graph
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
+162 stars
from 32,381 · score 5.09
6.semgrep / semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
+132 stars
from 17,268 · score 4.89
7.WerWolv / ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
+126 stars
from 55,565 · score 4.84
8.astral-sh / ruff
An extremely fast Python linter and code formatter, written in Rust.
+100 stars
from 50,289 · score 4.62
9.mokevnin / dev-quality-gates
An opinionated, curated list of tools for enforcing software development standards: one recommended tool per job, with limits.
+81 stars
from 113 · score 4.41
10.MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
+61 stars
from 22,035 · score 4.13
11.ast-grep / ast-grep
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
+60 stars
from 16,349 · score 4.11
12.anchore / syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
+60 stars
from 9,750 · score 4.11
13.winnin / farol
Know the risk of merging a pull request, and where it lives. Free, open-source CLI and GitHub Action: after your AI review, farol shows the riskiest files, what they reach, diff coverage and contract breaks. TypeScript/React, Go, Python.
+52 stars
from 119 · score 3.97
14.anchore / grype
A vulnerability scanner for container images and filesystems
+48 stars
from 13,107 · score 3.89
15.fallow-rs / fallow
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
+44 stars
from 5,245 · score 3.81
16.horsicq / Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
+41 stars
from 11,802 · score 3.74
17.rshipp / awesome-malware-analysis
Defund the Police.
+34 stars
from 14,331 · score 3.56
18.kucherenko / jscpd
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
+33 stars
from 6,449 · score 3.53
19.koalaman / shellcheck
ShellCheck, a static analysis tool for shell scripts
+32 stars
from 40,237 · score 3.50
20.bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
+26 stars
from 9,100 · score 3.30
21.SonarSource / sonarqube
Continuous Inspection
+25 stars
from 11,111 · score 3.26
22.OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
+22 stars
from 13,285 · score 3.14
23.meta / infer
A static analyzer for Java, C, C++, and Objective-C
+12 stars
from 15,728 · score 2.56
24.Col-E / Recaf
The modern Java bytecode editor
+12 stars
from 7,440 · score 2.56
25.Konloch / bytecode-viewer
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
+11 stars
from 15,690 · score 2.48
26.carthage-software / mago
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
+10 stars
from 3,531 · score 2.40
27.securego / gosec
Go security checker
+9 stars
from 8,986 · score 2.30
28.tanprathan / MobileApp-Pentest-Cheatsheet
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
+9 stars
from 5,310 · score 2.30
29.hadolint / hadolint
Dockerfile linter, validate inline bash, written in Haskell
+8 stars
from 12,496 · score 2.20
30.pylint-dev / pylint
It's not just a linter that annoys you!
+8 stars
from 5,740 · score 2.20
31.checkstyle / checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
+7 stars
from 9,620 · score 2.08
32.Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
+7 stars
from 2,772 · score 2.08
33.analysis-tools-dev / static-analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
+6 stars
from 14,855 · score 1.95
34.dominikh / go-tools
Staticcheck - The advanced Go linter
+6 stars
from 6,915 · score 1.95
35.phpstan / phpstan
PHP Static Analysis Tool - discover bugs in your code without running it!
+5 stars
from 14,141 · score 1.79
36.presidentbeef / brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications
+5 stars
from 7,287 · score 1.79
37.google / error-prone
Catch common Java mistakes as compile-time errors
+5 stars
from 7,261 · score 1.79
38.pmd / pmd
An extensible multilanguage static code analyzer.
+5 stars
from 5,518 · score 1.79
39.NASA-SW-VnV / ikos
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
+5 stars
from 3,172 · score 1.79
40.safedep / vet
Protect against malicious open source packages 🤖
+5 stars
from 1,118 · score 1.79
41.realm / SwiftLint
A tool to enforce Swift style and conventions.
+4 stars
from 19,774 · score 1.61
42.nikic / PHP-Parser
A PHP parser written in PHP
+4 stars
from 17,460 · score 1.61
43.quay / clair
Vulnerability Static Analysis for Containers
+4 stars
from 11,082 · score 1.61
44.meta / pyre-checkArchived
Performant type-checking for python.
+4 stars
from 7,177 · score 1.61
45.dwisiswant0 / apkleaks
Scanning APK file for URIs, endpoints & secrets.
+4 stars
from 6,370 · score 1.61
46.revive-lint / revive
🔥 Fast, strict, configurable, extensible, and beautiful linter for Go
+4 stars
from 5,556 · score 1.61
47.mbj / mutant
Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?
+4 stars
from 2,209 · score 1.61
48.carlosas / phpat
✔️ PHP Architecture Tester - Easy architecture testing for PHP
+4 stars
from 1,286 · score 1.61
49.shipmonk-rnd / dead-code-detector
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
+4 stars
from 530 · score 1.61
50.detekt / detekt
Static code analysis for Kotlin
+3 stars
from 7,103 · score 1.39
51.cppcheck-opensource / cppcheck
static analysis of C/C++ code
+3 stars
from 6,787 · score 1.39
52.uber / NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
+3 stars
from 4,124 · score 1.39
53.PyCQA / flake8
flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.
+3 stars
from 3,830 · score 1.39
54.PHPCSStandards / PHP_CodeSniffer
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
+3 stars
from 1,564 · score 1.39
55.spotbugs / spotbugs
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
+2 stars
from 3,963 · score 1.10
56.shivammathur / setup-php
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
+2 stars
from 3,267 · score 1.10
57.glebm / i18n-tasks
Manage translation and localization with static analysis, for Ruby i18n
+2 stars
from 2,158 · score 1.10
58.nccgroup / sobelow
Security-focused static analysis for the Phoenix Framework
+2 stars
from 1,796 · score 1.10
59.phpstan / phpdoc-parser
Next-gen phpDoc parser with support for intersection types and generics
+2 stars
from 1,539 · score 1.10
60.gmh5225 / awesome-llvm-security
awesome llvm security [Welcome to PR]
+2 stars
from 888 · score 1.10
61.Shopify / rubydex
A high-performance static analysis toolkit for Ruby
+2 stars
from 370 · score 1.10
62.antonagestam / phantom-types
Phantom types for Python.
+2 stars
from 233 · score 1.10
63.shobrook / adrenaline
Chat with (and visualize) your codebase
+1 stars
from 3,734 · score 0.69
64.whitesmith / rubycritic
A Ruby code quality reporter
+1 stars
from 3,507 · score 0.69
65.find-sec-bugs / find-sec-bugs
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
+1 stars
from 2,452 · score 0.69
66.clj-kondo / clj-kondo
Static analyzer and linter for Clojure code that sparks joy
+1 stars
from 1,864 · score 0.69
67.SonarSource / sonar-dotnet
Code analyzer for C# and VB.NET projects
+1 stars
from 921 · score 0.69
68.rubocop / rubocop-rspec
Code style checking for RSpec files.
+1 stars
from 859 · score 0.69
69.insidersec / insider
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
+1 stars
from 553 · score 0.69
70.shinagawa-web / gomarklint
Catch broken links before your readers do.
+1 stars
from 19 · score 0.69
71.cpeoples / ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
+1 stars
from 11 · score 0.69
72.zakariagharzouli / sparda
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
+1 stars
from 8 · score 0.69