Static Analysis & Code Quality
535 items from analysis-tools-dev/static-analysis ★14,831
-
Mega-Linter megalinter.io
Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes
-
mdformat mdformat.rtfd.io
CommonMark compliant Markdown formatter
-
Polyspace Code Prover mathworks.com
copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in C and C++ source code.
-
Polyspace Bug Finder mathworks.com
copyright: — Identifies run-time errors, concurrency issues, security vulnerabilities, and other defects in C and C++ embedded software.
-
Polyspace for Ada mathworks.com
copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in source code.
-
mlint mathworks.com
copyright: — Check MATLAB code files for possible problems.
-
Mariana Trench mariana-tren.ch
Our security focused static analysis tool for Android and Java applications. Mariana Trench analyzes Dalvik bytecode and is built to run fast on large codebases (10s of millions of lines of code). It can find vulnerabilities as code changes, before it ever lands in your…
-
Malcat malcat.fr
copyright: — Hexadecimal editor and disassembler for malware analysis and binary file inspection. Supports over 50 file formats and multiple CPU architectures (x86/x64, MIPS, .NET, Python, VB p-code). Features rapid analysis, embedded file extraction, Yara signature scanning…
-
mago mago.carthage.software
Mago is a complete toolchain for PHP, written in Rust, designed from the ground up for maximum performance.
-
pyscn ludo-technologies.github.io
Intelligent Python code quality analyzer with CFG-based cyclomatic complexity analysis, dead code detection, clone detection (Type 1-4), and coupling metrics. Uses tree-sitter for parsing. Written in Go.
-
LintLang lintlang.ai
Static linter for natural-language instructions that control AI agents. Detects ambiguous tool descriptions, missing limits, conflicting directives, and schema gaps in local files and CI without model or network calls.
-
LDRA ldra.com
copyright: — A tool suite including static analysis (TBVISION) to various standards including MISRA C & C++, JSF++ AV, CWE, CERT C, CERT C++ & Custom Rules.
-
kube-score kube-score.com
Static code analysis of your Kubernetes object definitions.
-
ktlint ktlint.github.io
An anti-bikeshedding Kotlin linter with built-in formatter.
-
Stan kowainik.github.io
Stan is a command-line tool for analysing Haskell projects and outputting discovered vulnerabilities in a helpful way with possible solutions for detected problems.
-
ktfmt kotlin.github.io
A program that reformats Kotlin source code to comply with the common community standard for Kotlin code conventions. A ktfmt IntelliJ plugin is available from the plugin repository. To install it, go to your IDE's settings and select the Plugins category. Click the Marketplace…
-
KLEE klee.github.io
A dynamic symbolic execution engine built on top of the LLVM compiler infrastructure. It can auto-generate test cases for programs such that the test cases exercise as much of the program as possible.
-
Kiuwan kiuwan.com
copyright: — Identify and remediate cyber threats in a blazingly fast, collaborative environment, with seamless integration in your SDLC. Python, C\C++, Java, C#, PHP and more.
-
Kin kinlab.ai
A graph-native code repository for people and AI agents. Kin parses supported languages into code entities and their relationships (calls, references, imports, inheritance) and versions them with the source. The kin CLI and an MCP server query the same graph for callers…
-
kics kics.io
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations in your infrastructure-as-code. Supports Terraform, Kubernetes, Docker, AWS CloudFormation and Ansible
-
ezno kaleidawave.github.io
A JavaScript compiler and TypeScript checker written in Rust with a focus on static analysis and runtime performance. Ezno's type checker is built from scratch. The checker is fully compatible with TypeScript type annotations and can work without any type annotations at all.
-
Misspelled Words In Context jwilk.net
A spell-checker that groups possible misspellings and shows them in their contexts.
-
graudit justanotherhacker.com
Grep rough audit - source code auditing tool.
-
jscpd jscpd.dev
Copy/paste detector for programming source code. Finds duplicated blocks in 200+ file formats — JavaScript, TypeScript, Python, Java, C#, C/C++, Go, Rust, PHP, Ruby and more — using token-based detection. Supports configurable thresholds and ignore patterns, git blame…
-
jQAssistant jqassistant.org
jQAssistant is a plugin based software analytics platform which allows scanning code structures and metadata from repositories into a Neo4j graph database. The gathered data can be used for ad-hoc exploration using queries, visualization or defining rules for continuous…
-
Joern joern.io
Joern is a platform for analyzing source code, bytecode, and binary executables. It generates code property graphs (CPGs), a graph representation of code for cross-language code analysis. Code property graphs are stored in a custom graph database. This allows code to be mined…
-
ReSharper jetbrains.com
copyright: — Extends Visual Studio with on-the-fly code inspections for C#, VB.NET, ASP.NET, JavaScript, TypeScript and other technologies.
-
jedi jedi.readthedocs.io
Autocompletion/static analysis library for Python.
-
JArchitect jarchitect.com
copyright: — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity.
-
Svace ispras.ru
copyright: — Static code analysis tool for Java,C,C++,C#,Go.
-
ionide-analyzers ionide.io
A collection of F# analyzers, built with the FSharp.Analyzers.SDK.
-
Symfony Insight insight.symfony.com
copyright: — Detect security risks, find bugs and provide actionable metrics for PHP projects.
-
Inkog inkog.io
AI agent security scanner. Detects behavioral vulnerabilities (prompt injection, infinite loops, token bombing, SQL injection via LLM) across 11 framework adapters including LangChain, CrewAI, and pydantic-ai. Audits MCP servers. Maps findings to EU AI Act, OWASP LLM Top 10…
-
Password Model huggingface.co
. This scanner is able to detect passwords and non structured tokens with a low false positive rate.
-
autocorrect huacnlee.github.io
A linter and formatter to help you to improve copywriting, correct spaces, words, punctuations between CJK (Chinese, Japanese, Korean).
-
HTMLHint htmlhint.com
A Static Code Analysis Tool for HTML.
-
HTML-Validate html-validate.org
Offline HTML5 validator.
-
IDA Free hex-rays.com
copyright: — Binary code analysis tool.
-
Soto Platform hello2morrow.com
copyright: — Suite of static analysis tools consisting of the three components Sotoarc (Architecture Analysis), Sotograph (Quality Analysis), and Sotoreport (Quality report). Helps find differences between architecture and implementation, interface violations (e.g. external…
-
HCL AppScan Source hcltechsw.com
copyright: — Commercial Static Code Analysis.
-
Haxe Checkstyle haxecheckstyle.github.io
A static analysis tool to help developers write Haxe code that adheres to a coding standard.
-
PullRequest hackerone.com
copyright: — Code review as a service with built-in static analysis. Increase velocity and reduce technical debt through quality code review by expert engineers backed by best-in-class automation.
-
pytype google.github.io
A static type analyzer for Python code.
-
GolangCI-Lint golangci-lint.run
Fast linters runner for Go. It aggregates multiple Go linters and provides a unified configuration, caching, and output format. Alternative to Go Meta Linter.
-
go/ast golang.org
Package ast declares the types used to represent syntax trees for Go packages.
-
go tool vet --shadow golang.org
Reports variables that may have been unintentionally shadowed.
-
gofmt -s golang.org
Checks if the code is properly formatted and could not be further simplified.
-
Goblint goblint.in.tum.de
A static analyzer for the analysis of multi-threaded C programs. Its primary focus is the detection of data races, but it also reports other runtime errors, such as buffer overflows and null-pointer dereferences.
-
govulncheck go.dev
Govulncheck reports known vulnerabilities that affect Go code. It uses static analysis of source code or a binary's symbol table to narrow down reports to only those that could affect the application. By default, govulncheck makes requests to the Go vulnerability database at…
-
gawk --lint gnu.org
Warns about constructs that are dubious or nonportable to other awk implementations.
- next page of items loading…
