Awesome GitHub RepositoriesStatic Analysis Tools

Este proyecto es una herramienta de análisis estático y linter diseñado para mejorar la calidad, fiabilidad y portabilidad de los scripts de shell. Al realizar un análisis estructural profundo, identifica errores comunes de programación, errores de sintaxis y vulnerabilidades de seguridad antes de que se ejecuten los scripts. Funciona como un revisor de código automatizado que aplica las mejores prácticas y ayuda a los desarrolladores a mantener un código consistente y robusto en diferentes entornos operativos. La herramienta se distingue por su resolución gramatical consciente del dialecto, que adapta su lógica de análisis según el intérprete de shell específico detectado. Utiliza un motor sofisticado que construye un árbol de sintaxis abstracta para evaluar la lógica, las comillas y las preocupaciones de portabilidad. Los desarrolladores pueden ejercer un control granular sobre el proceso de análisis utilizando directivas en línea para suprimir advertencias específicas o configurar cómo la herramienta resuelve los archivos fuente externos. El proyecto cubre una superficie integral de capacidades de diagnóstico, que van desde la validación fundamental de sintaxis hasta comprobaciones lógicas complejas. Proporciona orientación sobre la construcción idiomática de scripts, incluyendo el manejo seguro de archivos, operaciones aritméticas eficientes y la sustitución adecuada de comandos. Estas características aseguran colectivamente que los scripts se adhieran a los estándares POSIX y permanezcan compatibles en varias implementaciones de shell. La herramienta se distribuye como una utilidad de línea de comandos, lo que permite la integración en flujos de trabajo de desarrollo para proporcionar retroalimentación inmediata sobre la integridad del script.

Claude Quickstarts is a development framework and collection of reference implementations designed for building autonomous agents. It provides the foundational patterns necessary to orchestrate multi-agent workflows, enabling models to perform complex, multi-step tasks across software engineering, customer support, and computer-use domains. The platform distinguishes itself through specialized capabilities for desktop and browser automation, allowing agents to interact with graphical interfaces by capturing visual context and executing precise mouse and keyboard inputs. It includes robust inf

Rust-analyzer is a language server implementation that provides real-time code intelligence, static analysis, and development productivity tools for the Rust programming language. It functions as a backend engine that communicates with text editors to deliver deep structural understanding of source code, enabling features like semantic analysis, symbol navigation, and automated refactoring. The project distinguishes itself through a core engine designed for high-performance responsiveness, utilizing incremental query-based compilation and lazy demand-driven evaluation to minimize resource con

This project provides a framework for capturing and managing architectural decision records within a version-controlled codebase. It functions as a documentation standard that enables engineering teams to record the context, rationale, and consequences of significant technical choices, ensuring that design history is preserved as a first-class artifact alongside the source code. The system distinguishes itself by integrating design documentation directly into the development lifecycle. By utilizing template-driven metadata, it enforces a consistent structure for all technical records, which f

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This tool functions as a generator that maps dynamic framework methods and database model properties to static files, ensuring integrated development environments recognize runtime features. It acts as a static analysis helper by inspecting framework structures to provide accurate type hinting and autocompletion for core classes and container-bound objects. The project distinguishes itself by its ability to interrogate the dependency injection registry and scan runtime method registrations to document dynamically added functionality. It further differentiates by performing reflection-based in

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

This project is a static analysis engine and type checker designed for PHP codebases. It evaluates source code structure and type annotations to identify potential bugs, type mismatches, and logic errors without executing the application. By parsing code into an abstract syntax tree and applying a rule-based validation framework, it enforces code quality and safety standards across a project. What distinguishes this tool is its sophisticated type inference engine, which models dynamic language features, magic methods, and conditional types to maintain accuracy even in unconventional code. It

Spring-analysis is a diagnostic utility designed to visualize the internal architecture and execution logic of Java applications built on the Spring Framework. It functions as a static analysis tool that parses source code to map structural relationships and component interactions without requiring the program to execute. The tool distinguishes itself by automatically extracting configuration and annotation data to identify beans and service definitions, which it then translates into visual representations of the system. By reconstructing method call hierarchies and event propagation paths, i

React Doctor is a static analysis tool for React codebases designed to identify security, performance, and architectural issues. It functions as a codebase health diagnostic engine that produces numeric health scores and structured diagnostics to improve maintainability. The tool features an incremental code scanner that evaluates only the files changed between branches or staged in the working tree to provide fast feedback. It is designed to operate as a quality gate within CI pipelines, allowing for the enforcement of codebase health standards by failing builds on critical errors. The anal

webpack-bundle-analyzer is a bundle size analysis tool and Webpack build plugin that visualizes the composition of web application assets. It generates an interactive treemap to identify large dependencies and analyze the distribution of modules within the final payload. The tool functions as a bundle visualizer and a static report generator, exporting analysis data as standalone HTML and JSON files. It supports live bundle tracking via WebSockets during development and allows for the analysis of existing static stats files through a command line interface. The project provides capabilities

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

SkillSpector es un escáner de seguridad diseñado para detectar vulnerabilidades y patrones maliciosos en plugins y extensiones de agentes de IA antes de que sean instalados. Funciona como un guardrail en tiempo de ejecución que calcula puntuaciones de riesgo numéricas y asigna etiquetas de severidad para proporcionar recomendaciones de instalación o bloquear extensiones externas arriesgadas. El proyecto se distingue por utilizar modelos de lenguaje para realizar análisis de código semántico, evaluando la intención y el contexto del código para reducir los falsos positivos. También emplea la supresión de problemas basada en huellas digitales para rastrear e ignorar riesgos previamente aceptados a través de ciclos de escaneo repetidos. La herramienta cubre la seguridad de la cadena de suministro de software mediante el escaneo de dependencias contra bases de datos de seguridad públicas y admite la ingesta de activos de múltiples fuentes desde directorios locales, URLs remotas y repositorios. Proporciona informes de vulnerabilidad en múltiples formatos legibles por máquina y por humanos para su integración en pipelines de CI/CD.

Terser is a JavaScript minifier and compressor designed to reduce file size through whitespace removal, symbol mangling, and logic optimization for ES6+. It functions as a toolkit for minification, a code mangler for shortening variable and property names, and a dead code eliminator that evaluates constant expressions to remove unreachable logic. The project operates as an AST toolkit that parses JavaScript source into SpiderMonkey AST format for structural analysis. It generates source maps to link compressed production code back to the original source, ensuring that minified bundles remain

Chameleon is a cross-platform application framework and component library used to develop applications for the web and various mini-app platforms from a single shared codebase. It functions as a multi-platform build pipeline that compiles source code into different target formats while providing an MVVM-based user interface system for managing application state. The framework employs a polymorphic protocol to extend custom components and APIs, allowing for platform-specific implementations while maintaining cross-end compatibility. It includes a specialized build tool for static analysis that

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Soar is a suite of specialized tools designed for analyzing MySQL performance, advising on indexing, and optimizing SQL syntax. It functions as a performance analyzer, index advisor, and query optimizer to identify bottlenecks and suggest structural improvements for faster execution. The project distinguishes itself through a system for rewriting SQL statements into optimized equivalent versions using custom heuristic rules and patterns. It also features a dedicated index advisor that evaluates query patterns and database metadata to recommend the creation of new indexes. Its broader capabil

Travis CI is a continuous integration platform and CI/CD pipeline orchestrator that automates the testing and building of code changes from version control systems. It functions as a multi-language test runner and build infrastructure manager, ensuring software quality through automated testing across various programming languages and runtimes. The platform is distinguished by its use of virtual-machine-based isolation for reproducible environments and a configuration-driven approach to pipeline generation. It supports complex testing strategies through parallel matrix execution, allowing job