Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

fucking-static-analysis

⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more. With repository stars⭐ and forks🍴
https://github.com/correia-jpv/fucking-static-analysis

Last synced: 15 days ago
JSON representation

Meaning of Symbols:

More Collections

Multiple languages

  • ApplicationInspector
  • Bearer - Source static code analysis tool to discover, filter and prioritize security risks and vulnerabilities leading to sensitive data exposures (PII, PHI, PD). Highly configurable and easily extensible, built for security and engineering teams.
  • callGraph
  • ClassGraph
  • codeql - semantic queries and dataflow for several languages with VSCode plugin support.
  • Depends
  • DevSkim - based static analysis tool for Visual Studio, VS Code, and Sublime Text - C/C++, C#, PHP, ASP, Python, Ruby, Java, and others.
  • dotnet-format - format is able to format C# and Visual Basic projects with a subset of supported .editorconfig options.
  • emerge
  • ESLint
  • graudit - source code auditing tool.
  • lizard - paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.
  • OpenStaticAnalyzer
  • Pronto
  • Putout - in eslint, babel plugins support for js, jsx typescript, flow, markdown, yaml and json.
  • relint
  • Roslyn Analyzers - based implementation of FxCop analyzers.
  • ShiftLeft Scan - source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines.
  • ThreatMapper - of-exploit.
  • todocheck
  • trivy
  • TscanCode
  • Undebt - independent tool for massive, automatic, programmable refactoring based on simple pattern definitions.
  • WALA
  • LangLint - 20x faster with concurrent processing.
  • sqlvet - and column names.
  • Rev-dep
  • oxc - performance tools for the JavaScript / TypeScript language re-written in Rust.
  • BlockWatch - agnostic linter that keeps code, documentation, and configuration in sync and enforces strict formatting and validation rules.
  • pfff - preserving source transformation for many languages.
  • diesel-guard
  • Skylos - aware analysis with 98% recall. Includes CI/CD GitHub Action, VS Code extension, and MCP server for AI agent integration.
  • nestjs-doctor - patterns across security, performance, correctness, and architecture with 30+ built-in rules. Outputs a 0-100 health score. Includes module graph visualization, endpoint dependency graphs, and database schema analysis. CLI and VS Code extension.
  • sem - level diffs, blame, and impact analysis on top of git. Uses tree-sitter to parse 26 languages and builds a cross-file dependency graph with structural hashing. Commands include sem diff, sem blame, sem graph, and sem impact for blast-radius analysis of code changes.
  • Super-Linter
  • weave - level semantic merge driver for git. Resolves false conflicts that line-based merge produces when independent changes touch the same file. Parses functions and classes via tree-sitter, matches by name, and merges at the entity level. Benchmarked at 100% clean merges vs git's 48% on a 31-scenario suite.
  • Neurolint-CLI - based transformations.

Other

Programming Languages