Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
https://github.com/analysis-tools-dev/static-analysis

Last synced: 7 days ago
JSON representation

  • Meaning of Symbols:

  • More Collections

  • Multiple languages

    • Android Studio
    • AppChecker
    • ArchUnit
    • Axivion Bauhaus Suite - prone code locations, style violations, cloned or dead code, cyclic dependencies and more for C/C++, C#/.NET, Java and Ada 83/Ada 95.
    • biome
    • BugProve
    • CAST Highlight
    • Checkmarx CxSAST - compilation.
    • Clayton - powered code reviews for Salesforce. Secure your developments, enforce best practice and control your technical debt in real-time.
    • coala - supports [over 60 languages](https://coala.io/languages) by default.
    • Cobra
    • Code Intelligence - agnostic DevSecOps platform which combines industry-leading fuzzing engines for finding bugs and visualizing code coverage
    • Codeac - hosted). Available for JavaScript, TypeScript, Python, Ruby, Go, PHP, Java, Docker, and more. (open-source free)
    • codechecker
    • CodeFlow
    • CodeIt.Right
    • CodePatrol
    • CodeQue
    • CodeRush
    • CodeScan
    • CodeScene
    • CodeSee
    • CodeSonar from GrammaTech - to-understand explanations and code and path visualization.
    • Codiga
    • Synopsys
    • DeepCode
    • Embold
    • ezno
    • Find Security Bugs
    • Fortify - C, PHP, PL/SQL, T-SQL, Python (2.6, 2.7), Ruby (1.9.3), Swift, Scala, VB, and XML.
    • Goodcheck
    • graudit - source code auditing tool.
    • HCL AppScan Source
    • Kiuwan
    • Klocwork
    • MOPSA
    • Offensive 360 - compilation.
    • OpenRewrite - recipes/popular-recipe-guides/common-static-analysis-issue-remediation) reported through Sonar and other tools using a Maven and Gradle plugin or the Moderne CLI.
    • parasoft - , API-, and web UI testing. Complies with MISRA, OWASP, and others.
    • pfff - preserving source transformation for many languages.
    • PVS-Studio - studio.com/en/order/open-source-license) for FOSS and individual developers) static analysis of C, C++, C# and Java code. For advertising purposes [you can propose a large FOSS project for analysis by PVS employees](https://github.com/viva64/pvs-studio-check-list). Supports CWE mapping, OWASP ASVS, MISRA, AUTOSAR and SEI CERT coding standards.
    • Qwiet AI
    • Refactoring Essentials
    • Rome - status) for JavaScript, TypeScript, JSON, HTML, Markdown, and CSS. It has since been succeeded by [biome](https://biomejs.dev/).
    • Rome Formatter - tolerant code formatter for JS/TS written in Rust. Superceded by [biome](https://biomejs.dev/).
    • Security Code Scan
    • SafeQL - generate TypeScript types from raw SQL queries in PostgreSQL. SafeQL is an ESLint plugin for writing SQL queries in a type-safe way.
    • SAST Online
    • Scanmycode CE (Community Edition) - Code Scanning/SAST/Linting using many tools/Scanners with One Report
    • Semgrep Supply Chain - priority security issues. Semgrep Supply Chain prioritizes the 2% of vulnerabilities that are reachable from your code.
    • Similarity Tester
    • SonarLint for Visual Studio - the-fly feedback to developers on new bugs and quality issues injected into .NET code.
    • Soto Platform
    • SourceMeter - form).
    • StaticReviewer - in validation rules for Security, Deadcode & Best Practices Available a module for Software Composition Analysis (SCA) to find vulnerabilities in open source and third party libraries.
    • Svace
    • Teamscale
    • TencentCodeAnalysis - named CodeDog inside the company early) is a comprehensive platform for code analysis and issue tracking. TCA consist of three components, server, web and client. It integrates of a number of self-developed tools, and also supports dynamic integration of code analysis tools in various programming languages.
    • Understand
    • Veracode - C, C, C++ and more.
    • Codemodder - trivial security issues and other code quality problems.
    • Sigrid
    • Freeplane Code Explorer
    • Mobb - source projects.
    • WhiteHat Application Security Platform
    • Bearer - Source static code analysis tool to discover, filter and prioritize security risks and vulnerabilities leading to sensitive data exposures (PII, PHI, PD). Highly configurable and easily extensible, built for security and engineering teams.
    • DevSkim - based static analysis tool for Visual Studio, VS Code, and Sublime Text - C/C++, C#, PHP, ASP, Python, Ruby, Java, and others.
    • ApplicationInspector
    • ast-grep - grep is a powerful tool designed for managing code at scale using Abstract Syntax Trees (AST). Think of it as a hybrid of grep, eslint, and codemod, with the ability to search, lint, and rewrite code based on its structure rather than plain text.
    • autocorrect
    • callGraph
    • ClassGraph
    • codeburner
    • codeql - semantic queries and dataflow for several languages with VSCode plugin support.
    • CodeScan
    • Corgea - powered SAST scanner that helps developers find and fix insecure code. It finds business logic flaws, broken authentication, API vulnerabilities, and more with little false positives. Additionally, it automatically writes security fixes for them to approve. Corgea integrates with GitHub, GitLab, Azure DevOps, IDEs and CLI. It is free to try it.
    • cpp-linter-action - tidy and clang-format to collect feedback provided in the form of thread comments and/or annotations.
    • DeepSource - depth static analysis to find issues in verticals of bug risks, security, anti-patterns, performance, documentation and style. Native integrations with GitHub, GitLab and Bitbucket. Less than 5% false positives.
    • deleaker
    • Depends
    • DerScanner - language Static Application Security Testing (SAST) platform that detects critical vulnerabilities, including hardcoded secrets, weak cryptography, backdoors, SQL injections, insecure configurations, etc.
    • dotnet-format - format is able to format C# and Visual Basic projects with a subset of supported `.editorconfig` options.
    • emerge
    • Enforster AI
    • ESLint
    • Fortify - C, PHP, PL/SQL, T-SQL, Python (2.6, 2.7), Ruby (1.9.3), Swift, Scala, VB, and XML.
    • graudit - source code auditing tool.
    • keploy - source testing platform that helps developers automate and streamline their testing process. It provides API, and integration testing agents, generating tests, mocks/stubs for APIs that actually work. Additionally, Keploy offers an AI-powered Unit Testing Agent that generates stable, useful unit tests directly in your GitHub PRs and in VSCode, helping catch errors and improve code quality.
    • lizard - paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.
    • Mega-Linter - Linter can handle any type of project thanks to its 70+ embedded Linters,
    • Mobb - source projects.
    • OpenStaticAnalyzer
    • Precaution
    • Pronto
    • Putout - in eslint, babel plugins support for js, jsx typescript, flow, markdown, yaml and json.
    • PVS-Studio - studio.com/en/order/open-source-license) for FOSS and individual developers) static analysis of C, C++, C# and Java code. For advertising purposes [you can propose a large FOSS project for analysis by PVS employees](https://github.com/viva64/pvs-studio-check-list). Supports CWE mapping, OWASP ASVS, MISRA, AUTOSAR and SEI CERT coding standards.
    • pylama
    • relint
    • Roslyn Analyzers - based implementation of FxCop analyzers.
    • ShiftLeft Scan - source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines.
    • ThreatMapper - of-exploit.
    • todocheck
    • trivy
    • TscanCode
    • Undebt - independent tool for massive, automatic, programmable refactoring based on simple pattern definitions.
    • WALA
    • WhiteHat Application Security Platform
    • XCode - analyzer.llvm.org/xcode.html) static code analyzer (C/C++, Obj-C).
    • Sigrid
    • SonarQube Cloud
    • SonarQube for IDE - time, flagging issues as you code, just like a spell-checker. More than a linter, it also delivers rich contextual guidance to help developers understand why there is an issue, assess the risk, and educate them on how to fix it.
    • LangLint - 20x faster with concurrent processing.
    • sqlvet - and column names.
    • Rev-dep
    • oxc - performance tools for the JavaScript / TypeScript language re-written in Rust.
    • Seqra - focused static analyzer for Java and Kotlin web applications. Analyzes bytecode with Semgrep-style YAML rules and CodeQL-grade dataflow (with first-class Spring support) to find vulnerabilities that source-only scanners miss.
    • BlockWatch - agnostic linter that keeps code, documentation, and configuration in sync and enforces strict formatting and validation rules.
    • Xygeni - powered remediation, Software Composition Analysis (SCA) with real-time malware detection, Infrastructure as Code (IaC) scanning, and Secrets detection to ensure end-to-end code security.
    • MOPSA
    • Skylos - aware analysis with 98% recall. Includes CI/CD GitHub Action, VS Code extension, and MCP server for AI agent integration.
    • Code-Graph-RAG - language codebases using Tree-sitter AST parsing and stores them in Memgraph. Supports 11 programming languages with a unified graph schema and enables natural language querying and editing of code structure and relationships. Functions as an MCP server for AI assistant integration.
    • diesel-guard
    • ale
    • codeburner
    • codechecker
    • CodeFactor
    • CodeFlow
    • CodeQue
    • CodeRush
    • CodeScan
    • CodeScene
    • Codety
    • Embold
    • Find Security Bugs
    • Goodcheck
    • HCL AppScan Source
    • Infer - C
    • Joern - language code analysis. Code property graphs are stored in a custom graph database. This allows code to be mined using search queries formulated in a Scala-based domain-specific query language. Joern is developed with the goal of providing a useful tool for vulnerability discovery and research in static program analysis.
    • Kiuwan
    • Neurolint-CLI - based transformations.
    • PMD
    • PVS-Studio - studio.com/en/order/open-source-license) for FOSS and individual developers) static analysis of C, C++, C# and Java code. For advertising purposes [you can propose a large FOSS project for analysis by PVS employees](https://github.com/viva64/pvs-studio-check-list). Supports CWE mapping, OWASP ASVS, MISRA, AUTOSAR and SEI CERT coding standards.
    • ReSharper - the-fly code inspections for C#, VB.NET, ASP.NET, JavaScript, TypeScript and other technologies.
    • RIPS
    • Roslyn Security Guard - site scripting (XSS), CSRF, cryptography weaknesses, hardcoded passwords and many more.
    • SafeQL - generate TypeScript types from raw SQL queries in PostgreSQL. SafeQL is an ESLint plugin for writing SQL queries in a type-safe way.
    • Semgrep Supply Chain - priority security issues. Semgrep Supply Chain prioritizes the 2% of vulnerabilities that are reachable from your code.
    • Seqra - focused static analyzer for Java and Kotlin web applications. Analyzes bytecode with Semgrep-style YAML rules and CodeQL-grade dataflow (with first-class Spring support) to find vulnerabilities that source-only scanners miss.
    • SonarQube for IDE - time, flagging issues as you code, just like a spell-checker. More than a linter, it also delivers rich contextual guidance to help developers understand why there is an issue, assess the risk, and educate them on how to fix it.
    • Svace
    • Teamscale
    • Understand
    • Unibeautify - C, Java, Python, PHP, GraphQL, Markdown, and more.
    • weggli

  • Other

Programming Languages
Go 45 Python 38 Rust 27 Ruby 23 PHP 22 Java 15 JavaScript 11 C++ 10 C# 8 TypeScript 7
Categories
Programming Languages 331 Other 174 Multiple languages 154 More Collections 7 License 3 Sponsors 1 Meaning of Symbols: 1
Sub Categories
Keywords
static-analysis 45 linter 40 security 23 python 20 golang 19 go 19 php 16 static-code-analysis 15 lint 15 rust 12 formatter 11 security-tools 11 kubernetes 10 ruby 9 cli 9 static-analyzer 8 typescript 8 code-quality 8 javascript 7 java 7 devsecops 6 code-analysis 6 docker 6 eslint 6 security-audit 6 linters 6 vulnerability 5 vulnerabilities 5 security-scanner 5 containers 5 analyzer 5 compliance 5 architecture 4 quality 4 analysis 4 program-analysis 4 vulnerability-scanners 4 ast 4 nodejs 4 elixir 4 tool 4 best-practices 4 testing 4 linting 4 cargo 4 sast 4 metrics 3 checker 3 parser 3 rails 3