Ranked by Attention Score: stars gained over the last 90 complete days
1–100 of 115 by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
An extremely fast Python linter and code formatter, written in Rust.
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
⚡A CLI tool for code structural search, lint and rewriting. Written in Rust
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Program for determining types of files for Windows, Linux and MacOS.
ShellCheck, a static analysis tool for shell scripts
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
A vulnerability scanner for container images and filesystems
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Defund the Police.
Continuous Inspection
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
Scanning APK file for URIs, endpoints & secrets.
Dockerfile linter, validate inline bash, written in Haskell
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
The modern Java bytecode editor
A tool to enforce Swift style and conventions.
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
Go security checker
PHP Static Analysis Tool - discover bugs in your code without running it!
A static analyzer for Java, C, C++, and Objective-C
Static code analysis for Kotlin
static analysis of C/C++ code
Staticcheck - The advanced Go linter
Python Type Checker / Language Server
A high-performance static analysis toolkit for Ruby
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
An extensible multilanguage static code analyzer.
Vulnerability Static Analysis for Containers
Catch common Java mistakes as compile-time errors
A tool to automatically fix PHP Coding Standards issues
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
It's not just a linter that annoys you!
A PHP parser written in PHP
Useful CMake Examples
Tfsec is now part of Trivy
Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?
A static analysis security vulnerability scanner for Ruby on Rails applications
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.
💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.
A static code analysis tool for the Elixir language with a focus on code consistency and teaching.
🔥 Fast, strict, configurable, extensible, and beautiful linter for Go
flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
Visualize call graph of a Go program using Graphviz
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Awesome autocompletion, static analysis and refactoring library for python
Protect against malicious open source packages 🤖
awesome llvm security [Welcome to PR]
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
Static analyzer for C/C++ based on the theory of Abstract Interpretation.
Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.
Static analyzer and linter for Clojure code that sparks joy
Performant type-checking for python.
✔️ PHP Architecture Tester - Easy architecture testing for PHP
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
Binary Analysis Platform
A Ruby code quality reporter
Security-focused static analysis for the Phoenix Framework
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
🚀Optimizer for mobile applications
Code analyzer for C# and VB.NET projects
Next-gen phpDoc parser with support for intersection types and generics
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
Code smell detector for Ruby
CodeCompass is a software comprehension tool for large scale software written in C/C++, C# and Python.
A static code analysis tool for Crystal
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
A static type analyzer for Python code
Error Prone extensions: extra bug checkers and a large battery of Refaster rules.
A fast, feature-rich static code analyzer & language server for Python
Manage translation and localization with static analysis, for Ruby i18n
Linting tool for CloudFormation templates
Generate OpenAPI 3.1 specs from Go source code via static analysis — zero annotations, automatic framework detection
Chat with (and visualize) your codebase
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
Detect uses of legacy Java APIs
PostgreSQL migration linter. Blocks unsafe migrations before merge: 112 rules, the real Postgres parser, lock analysis, auto-fix. CLI, GitHub Action, MCP.
AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
OPEM (Open Source PEM Fuel Cell Simulation Tool)
Architecture linter for Swift — enforce Clean Architecture import rules via SwiftSyntax. A CI-ready guardrail for AI-assisted development.
Make Java source layout deterministic: reorder class members safely, keep accessors together, format java-source, and enforce style in CI.
Code style checking for RSpec files.
SonarQube extension for Visual Studio providing code quality and security feedback directly in the IDE
An Elixir tool for checking safety of database migrations.
Swiss-army knife for D source code
C code refactoring browser