#static-analysis

SonarSource/sonarqube

Java

90

health

Continuous Inspection

horsicq/Detect-It-Easy

JavaScript

89

health

Program for determining types of files for Windows, Linux and MacOS.

PHP-CS-Fixer/PHP-CS-Fixer

PHP

89

health

A tool to automatically fix PHP Coding Standards issues

fallow-rs/fallow

Rust

88

health

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

bethington/ghidra-mcp

Java

88

health

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

whitesmith/rubycritic

Ruby

88

health

A Ruby code quality reporter

nikic/PHP-Parser

PHP

88

health

A PHP parser written in PHP

detekt/detekt

Kotlin

88

health

Static code analysis for Kotlin

rrrene/credo

Elixir

88

health

A static code analysis tool for the Elixir language with a focus on code consistency and teaching.

spotbugs/spotbugs

Java

87

health

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

semgrep/semgrep

C

87

health

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

phpstan/phpstan

PHP

87

health

PHP Static Analysis Tool - discover bugs in your code without running it!

troessner/reek

Ruby

86

health

Code smell detector for Ruby

psalm/psalm-plugin-laravel

PHP

86

health

Security-focused Laravel static analyser

realm/SwiftLint

Swift

86

health

A tool to enforce Swift style and conventions.

google/error-prone

Java

81

health

Catch common Java mistakes as compile-time errors

vimeo/psalm

PHP

80

health

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications