Awesome GitHub RepositoriesStatic Analysis Tools

Dieses Projekt ist ein statisches Analysetool und Linter, das darauf ausgelegt ist, die Qualität, Zuverlässigkeit und Portabilität von Shell-Skripten zu verbessern. Durch eine tiefgehende strukturelle Analyse identifiziert es häufige Programmierfallen, Syntaxfehler und Sicherheitslücken, bevor Skripte ausgeführt werden. Es fungiert als automatisierter Code-Reviewer, der Best Practices durchsetzt und Entwicklern hilft, konsistenten, robusten Code über verschiedene Betriebsumgebungen hinweg zu pflegen. Das Tool zeichnet sich durch seine dialektbewusste Grammatikauflösung aus, die seine Parsing-Logik basierend auf dem erkannten spezifischen Shell-Interpreter anpasst. Es nutzt eine hochentwickelte Engine, die einen abstrakten Syntaxbaum konstruiert, um Logik, Quoting und Portabilitätsbedenken zu bewerten. Entwickler können durch die Verwendung von Inline-Direktiven eine granulare Kontrolle über den Analyseprozess ausüben, um spezifische Warnungen zu unterdrücken oder zu konfigurieren, wie das Tool externe Quelldateien auflöst. Das Projekt deckt eine umfassende Oberfläche an Diagnosefähigkeiten ab, die von grundlegender Syntaxvalidierung bis hin zu komplexen Logikprüfungen reicht. Es bietet Anleitungen zur idiomatischen Skriptkonstruktion, einschließlich sicherer Dateibehandlung, effizienter arithmetischer Operationen und korrekter Befehlssubstitution. Diese Funktionen stellen gemeinsam sicher, dass Skripte POSIX-Standards einhalten und über verschiedene Shell-Implementierungen hinweg kompatibel bleiben. Das Tool wird als Befehlszeilen-Dienstprogramm vertrieben, was die Integration in Entwicklungsworkflows ermöglicht, um sofortiges Feedback zur Skriptintegrität zu geben.

Claude Quickstarts is a development framework and collection of reference implementations designed for building autonomous agents. It provides the foundational patterns necessary to orchestrate multi-agent workflows, enabling models to perform complex, multi-step tasks across software engineering, customer support, and computer-use domains. The platform distinguishes itself through specialized capabilities for desktop and browser automation, allowing agents to interact with graphical interfaces by capturing visual context and executing precise mouse and keyboard inputs. It includes robust inf

Rust-analyzer is a language server implementation that provides real-time code intelligence, static analysis, and development productivity tools for the Rust programming language. It functions as a backend engine that communicates with text editors to deliver deep structural understanding of source code, enabling features like semantic analysis, symbol navigation, and automated refactoring. The project distinguishes itself through a core engine designed for high-performance responsiveness, utilizing incremental query-based compilation and lazy demand-driven evaluation to minimize resource con

This project provides a framework for capturing and managing architectural decision records within a version-controlled codebase. It functions as a documentation standard that enables engineering teams to record the context, rationale, and consequences of significant technical choices, ensuring that design history is preserved as a first-class artifact alongside the source code. The system distinguishes itself by integrating design documentation directly into the development lifecycle. By utilizing template-driven metadata, it enforces a consistent structure for all technical records, which f

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This tool functions as a generator that maps dynamic framework methods and database model properties to static files, ensuring integrated development environments recognize runtime features. It acts as a static analysis helper by inspecting framework structures to provide accurate type hinting and autocompletion for core classes and container-bound objects. The project distinguishes itself by its ability to interrogate the dependency injection registry and scan runtime method registrations to document dynamically added functionality. It further differentiates by performing reflection-based in

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

This project is a static analysis engine and type checker designed for PHP codebases. It evaluates source code structure and type annotations to identify potential bugs, type mismatches, and logic errors without executing the application. By parsing code into an abstract syntax tree and applying a rule-based validation framework, it enforces code quality and safety standards across a project. What distinguishes this tool is its sophisticated type inference engine, which models dynamic language features, magic methods, and conditional types to maintain accuracy even in unconventional code. It

Spring-analysis is a diagnostic utility designed to visualize the internal architecture and execution logic of Java applications built on the Spring Framework. It functions as a static analysis tool that parses source code to map structural relationships and component interactions without requiring the program to execute. The tool distinguishes itself by automatically extracting configuration and annotation data to identify beans and service definitions, which it then translates into visual representations of the system. By reconstructing method call hierarchies and event propagation paths, i

React Doctor is a static analysis tool for React codebases designed to identify security, performance, and architectural issues. It functions as a codebase health diagnostic engine that produces numeric health scores and structured diagnostics to improve maintainability. The tool features an incremental code scanner that evaluates only the files changed between branches or staged in the working tree to provide fast feedback. It is designed to operate as a quality gate within CI pipelines, allowing for the enforcement of codebase health standards by failing builds on critical errors. The anal

webpack-bundle-analyzer is a bundle size analysis tool and Webpack build plugin that visualizes the composition of web application assets. It generates an interactive treemap to identify large dependencies and analyze the distribution of modules within the final payload. The tool functions as a bundle visualizer and a static report generator, exporting analysis data as standalone HTML and JSON files. It supports live bundle tracking via WebSockets during development and allows for the analysis of existing static stats files through a command line interface. The project provides capabilities

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

SkillSpector ist ein Security-Scanner, der darauf ausgelegt ist, Schwachstellen und bösartige Muster in KI-Agent-Plugins und -Erweiterungen zu erkennen, bevor diese installiert werden. Er fungiert als Runtime-Guardrail, der numerische Risikoscores berechnet und Schweregrad-Labels zuweist, um Installations-Empfehlungen zu geben oder riskante externe Erweiterungen zu blockieren. Das Projekt zeichnet sich dadurch aus, dass es Sprachmodelle verwendet, um semantische Code-Analysen durchzuführen, wobei Code-Intention und Kontext bewertet werden, um False Positives zu reduzieren. Zudem setzt es auf Fingerprint-basiertes Issue-Suppression, um zuvor akzeptierte Risiken über wiederholte Scan-Zyklen hinweg zu verfolgen und zu ignorieren. Das Tool deckt Software-Supply-Chain-Security durch Dependency-Scanning gegen öffentliche Sicherheitsdatenbanken ab und unterstützt Multi-Source-Asset-Ingestion aus lokalen Verzeichnissen, Remote-URLs und Repositories. Es bietet Schwachstellen-Reporting in mehreren maschinen- und menschenlesbaren Formaten für die Integration in CI/CD-Pipelines.

Terser is a JavaScript minifier and compressor designed to reduce file size through whitespace removal, symbol mangling, and logic optimization for ES6+. It functions as a toolkit for minification, a code mangler for shortening variable and property names, and a dead code eliminator that evaluates constant expressions to remove unreachable logic. The project operates as an AST toolkit that parses JavaScript source into SpiderMonkey AST format for structural analysis. It generates source maps to link compressed production code back to the original source, ensuring that minified bundles remain

Chameleon is a cross-platform application framework and component library used to develop applications for the web and various mini-app platforms from a single shared codebase. It functions as a multi-platform build pipeline that compiles source code into different target formats while providing an MVVM-based user interface system for managing application state. The framework employs a polymorphic protocol to extend custom components and APIs, allowing for platform-specific implementations while maintaining cross-end compatibility. It includes a specialized build tool for static analysis that

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Soar is a suite of specialized tools designed for analyzing MySQL performance, advising on indexing, and optimizing SQL syntax. It functions as a performance analyzer, index advisor, and query optimizer to identify bottlenecks and suggest structural improvements for faster execution. The project distinguishes itself through a system for rewriting SQL statements into optimized equivalent versions using custom heuristic rules and patterns. It also features a dedicated index advisor that evaluates query patterns and database metadata to recommend the creation of new indexes. Its broader capabil

Travis CI is a continuous integration platform and CI/CD pipeline orchestrator that automates the testing and building of code changes from version control systems. It functions as a multi-language test runner and build infrastructure manager, ensuring software quality through automated testing across various programming languages and runtimes. The platform is distinguished by its use of virtual-machine-based isolation for reproducible environments and a configuration-driven approach to pipeline generation. It supports complex testing strategies through parallel matrix execution, allowing job