Static Analysis & Code Quality
535 items from analysis-tools-dev/static-analysis ★14,831
-
checkov checkov.io
Static analysis tool for Terraform files (tf>=v0.12), preventing cloud misconfigs at build time.
-
Bytebase bytebase.com
Database DevSecOps platform with a built-in SQL Review engine that lints schema migrations and queries against 100+ configurable rules — naming conventions, anti-patterns, and safety checks — across MySQL, PostgreSQL, Oracle, SQL Server, Snowflake, and more.
-
Better Code Hub bettercodehub.com
copyright: — Better Code Hub checks your GitHub codebase against 10 engineering guidelines devised by the authority in software quality, Software Improvement Group.
-
Designite designite-tools.com
Compute source code metrics and detect a variety of implementation, design, and architecture smells for C#.
-
Pa11y - automated accessibility testing pa11y.org
Automated accessibility testing tool that runs HTML CodeSniffer or axe-core from the command line. Supports CI/CD integration, multiple reporters, and testing against WCAG 2.1 AA standards.
-
Pascal Analyzer peganza.com
(free Lite version available). [Delphi] Pascal Analyzer, or PAL for short, parses Delphi or Borland Pascal source code. It builds large internal tables of identifiers, and collects other information such as calls between subprograms. When the parsing is completed, extensive…
-
Frama-C frama-c.com
A sound and extensible static analyzer for C code.
-
Trunk trunk.io
Toolkit to check, test, merge, and monitor code.
-
OCLint oclint.org
A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C. - source
-
Deleaker deleaker.com
A tool for resource leak detection, including memory, GDI and handle leaks.
-
CppDepend cppdepend.com
Simplifies managing a complex C/C++ code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and comparing different versions of the code.
-
goimports pkg.go.dev
Tool to fix (add, remove) your Go imports automatically.
-
Flow.js flow.org
A static type checker for JavaScript.
-
.NET Analyzers github.com
An organization for the development of analyzers (diagnostics and code fixes) using the .NET Compiler Platform.
-
terrascan github.com
Collection of security and best practice tests for static code analysis of Terraform templates.
-
zydis zydis.re
Fast and lightweight x86/x86-64 disassembler library
-
ZPA zpa.felipebz.com
An open source parser and code analyzer for PL/SQL and Oracle SQL code.
-
zod zod.dev
TypeScript-first schema validation with static type inference. The goal is to eliminate duplicative type declarations. With Zod, you declare a validator once and Zod will automatically infer the static TypeScript type. It is easy to compose simpler types into complex data…
-
zizmor zizmor.sh
Static analysis for GitHub Actions workflows, detecting insecure CI/CD patterns such as excessive token permissions, template injection risks, credential persistence, and unsafe workflow references.
-
yamllint yamllint.readthedocs.io
Checks YAML files for syntax validity, key repetition and cosmetic problems such as lines length, trailing spaces, and indentation.
-
Xygeni xygeni.io
copyright: — Xygeni is a comprehensive Software Supply Chain Security platform. It provides Advanced SAST with AI-powered remediation, Software Composition Analysis (SCA) with real-time malware detection, Infrastructure as Code (IaC) scanning, and Secrets detection to ensure…
-
lintian wiki.debian.org
Static analysis tool for Debian packages.
-
wemake-python-styleguide wemake-python-styleguide.rtfd.io
The strictest and most opinionated python linter ever.
-
WartRemover wartremover.org
A flexible Scala code linting tool.
-
Wakaru wakarujs.com
JavaScript decompiler that turns bundled, minified, transpiled production code back into readable modules. Unpacks webpack, esbuild, Metro, Browserify, SystemJS, and AMD/UMD bundles, then reverses minifier artifacts and Babel/TypeScript/SWC helpers (async/await, classes…
-
Vuls vuls.io
Agent-less Linux vulnerability scanner based on information from NVD, OVAL, etc. It has some container image support, although is not a container specific tool.
-
Visual Expert visual-expert.com
copyright: — Code analysis for PowerBuilder, Oracle, and SQL Server Explores, analyzes, and documents Code
-
Veracode veracode.com
copyright: — Find flaws in binaries and bytecode without requiring source. Support all major programming languages: Java, .NET, JavaScript, Swift, Objective-C, C, C++ and more.
-
vastlint vastlint.org
copyright: — Validator and linter for VAST XML ad tags. Checks wrappers and inline tags against the IAB VAST 2.0-4.3 specification and can auto-fix deterministic issues.
-
Nu Html Checker validator.github.io
Helps you catch problems in your HTML/CSS/SVG
-
vale vale.sh
A syntax-aware linter for prose built with speed and extensibility in mind.
-
unimport unimport.hakancelik.dev
A linter, formatter for finding and removing unused import statements.
-
Unibeautify unibeautify.com
Universal code beautifier with a GitHub app. Supports HTML, CSS, JavaScript, TypeScript, JSX, Vue, C++, Go, Objective-C, Java, Python, PHP, GraphQL, Markdown, and more.
-
Liquid Haskell ucsd-progsys.github.io
Liquid Haskell is a refinement type checker for Haskell programs.
-
TrustInSoft Analyzer trust-in-soft.com
copyright: — Exhaustive detection of coding errors and their associated security vulnerabilities. This encompasses a sound undefined behavior detection (buffer overflows, out-of-bounds array accesses, null-pointer dereferences, use-after-free, divide-by-zeros, uninitialized…
-
trufflehog trufflesecurity.com
Find credentials all over the place TruffleHog is an open source secret-scanning engine that resolves exposed secrets across your company’s entire tech stack.
-
trentclaw trent.ai
Security assessment for your OpenClaw agent environment. Flags misconfigurations and risky skills — prompt injection, permission escalation, data exfiltration — and the chained attack paths between them, across gateway config, tool permissions, MCP servers, and plugins.
-
EasyCodingStandard tomasvotruba.com
Combine PHP_CodeSniffer and PHP-CS-Fixer.
-
Fix Insight tmssoftware.com
copyright: — A free IDE Plugin for static code analysis. A Pro edition includes a command line tool for automation purposes.
-
thailint thai-lint.readthedocs.io
Multi-language linter targeting anti-patterns that appear disproportionately in AI-generated code: duplicated blocks across files, excessive nesting, magic numbers, Single Responsibility violations, and linter suppressions added without justification. Covers Python, TypeScript…
-
TeXLab texlab.netlify.app
A Language Server Protocol implementation for TeX/LaTeX, including lint capabilities.
-
tern ternjs.net
A JavaScript code analyzer for deep, cross-editor language support.
-
Teamscale teamscale.com
copyright: — Static and dynamic analysis tool supporting more than 25 languages and direct IDE integration. Free hosting for Open Source projects available on request. Free academic licenses available.
-
TencentCodeAnalysis tca.tencent.com
Tencent Cloud Code Analysis (TCA for short, code-named CodeDog inside the company early) is a comprehensive platform for code analysis and issue tracking. TCA consist of three components, server, web and client. It integrates of a number of self-developed tools, and also…
-
TangleGuard tangleguard.com
copyright: — Helps you understand and maintain a scalable software architecture. To do so, it generates a interactive, nested dependency graph out of the source code. You can choose the level of details and get the portion of your codebase that matters to you.
-
sysdig sysdig.com
copyright: — A secure DevOps platform for cloud and container forensics. Built on an open source stack, Sysdig provides Docker image scanning and created Falco, the open standard for runtime threat detection for containers, Kubernetes and cloud.
-
Coverity synopsys.com
copyright: — Synopsys Coverity supports 20 languages and over 70 frameworks including Ruby on rails, Scala, PHP, Python, JavaScript, TypeScript, Java, Fortran, C, C++, C#, VB.NET.
-
SVF svf-tools.github.io
A static tool that enables scalable and precise interprocedural dependence analysis for C and C++ programs.
-
styler styler.r-lib.org
Formatting of R source code files and pretty-printing of R code.
-
Spectral stoplight.io
A flexible JSON/YAML linter, with out-of-the-box support for OpenAPI v2/v3 and AsyncAPI v2.
- next page of items loading…
