Awesome GitHub RepositoriesStatic Analysis Tools

यह प्रोजेक्ट शेल स्क्रिप्ट्स की गुणवत्ता, विश्वसनीयता, और पोर्टेबिलिटी में सुधार करने के लिए डिज़ाइन किया गया एक स्टेटिक विश्लेषण टूल और लिंटर है। गहरा संरचनात्मक विश्लेषण करके, यह स्क्रिप्ट निष्पादित होने से पहले सामान्य प्रोग्रामिंग नुकसान, सिंटैक्स त्रुटियों, और सुरक्षा कमजोरियों की पहचान करता है। यह एक स्वचालित कोड समीक्षक के रूप में कार्य करता है जो सर्वोत्तम प्रथाओं को लागू करता है और डेवलपर्स को विभिन्न ऑपरेटिंग वातावरणों में सुसंगत, मजबूत कोड बनाए रखने में मदद करता है। यह टूल अपने डायलेक्ट-अवेयर ग्रामर रिज़ॉल्यूशन के माध्यम से खुद को अलग करता है, जो पहचाने गए विशिष्ट शेल इंटरप्रेटर के आधार पर अपने पार्सिंग लॉजिक को अनुकूलित करता है। यह एक परिष्कृत इंजन का उपयोग करता है जो लॉजिक, कोटिंग, और पोर्टेबिलिटी चिंताओं का मूल्यांकन करने के लिए एक एब्स्ट्रैक्ट सिंटैक्स ट्री बनाता है। डेवलपर्स विशिष्ट चेतावनियों को दबाने या टूल बाहरी सोर्स फ़ाइलों को कैसे हल करता है, इसे कॉन्फ़िगर करने के लिए इनलाइन निर्देशों का उपयोग करके विश्लेषण प्रक्रिया पर दानेदार नियंत्रण (granular control) कर सकते हैं। यह प्रोजेक्ट डायग्नोस्टिक क्षमताओं की एक व्यापक सतह को कवर करता है, जो मौलिक सिंटैक्स वैलिडेशन से लेकर जटिल लॉजिक चेक तक है। यह मुहावरेदार स्क्रिप्ट निर्माण पर मार्गदर्शन प्रदान करता है, जिसमें सुरक्षित फ़ाइल हैंडलिंग, कुशल अंकगणितीय संचालन, और उचित कमांड प्रतिस्थापन शामिल है। ये विशेषताएं सामूहिक रूप से सुनिश्चित करती हैं कि स्क्रिप्ट POSIX मानकों का पालन करती हैं और विभिन्न शेल इम्प्लीमेंटेशन में संगत बनी रहती हैं। यह टूल एक कमांड-लाइन यूटिलिटी के रूप में वितरित किया जाता है, जो स्क्रिप्ट अखंडता पर तत्काल प्रतिक्रिया प्रदान करने के लिए डेवलपमेंट वर्कफ़्लो में एकीकरण की अनुमति देता है।

Claude Quickstarts is a development framework and collection of reference implementations designed for building autonomous agents. It provides the foundational patterns necessary to orchestrate multi-agent workflows, enabling models to perform complex, multi-step tasks across software engineering, customer support, and computer-use domains. The platform distinguishes itself through specialized capabilities for desktop and browser automation, allowing agents to interact with graphical interfaces by capturing visual context and executing precise mouse and keyboard inputs. It includes robust inf

Rust-analyzer is a language server implementation that provides real-time code intelligence, static analysis, and development productivity tools for the Rust programming language. It functions as a backend engine that communicates with text editors to deliver deep structural understanding of source code, enabling features like semantic analysis, symbol navigation, and automated refactoring. The project distinguishes itself through a core engine designed for high-performance responsiveness, utilizing incremental query-based compilation and lazy demand-driven evaluation to minimize resource con

This project provides a framework for capturing and managing architectural decision records within a version-controlled codebase. It functions as a documentation standard that enables engineering teams to record the context, rationale, and consequences of significant technical choices, ensuring that design history is preserved as a first-class artifact alongside the source code. The system distinguishes itself by integrating design documentation directly into the development lifecycle. By utilizing template-driven metadata, it enforces a consistent structure for all technical records, which f

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This tool functions as a generator that maps dynamic framework methods and database model properties to static files, ensuring integrated development environments recognize runtime features. It acts as a static analysis helper by inspecting framework structures to provide accurate type hinting and autocompletion for core classes and container-bound objects. The project distinguishes itself by its ability to interrogate the dependency injection registry and scan runtime method registrations to document dynamically added functionality. It further differentiates by performing reflection-based in

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

This project is a static analysis engine and type checker designed for PHP codebases. It evaluates source code structure and type annotations to identify potential bugs, type mismatches, and logic errors without executing the application. By parsing code into an abstract syntax tree and applying a rule-based validation framework, it enforces code quality and safety standards across a project. What distinguishes this tool is its sophisticated type inference engine, which models dynamic language features, magic methods, and conditional types to maintain accuracy even in unconventional code. It

Spring-analysis is a diagnostic utility designed to visualize the internal architecture and execution logic of Java applications built on the Spring Framework. It functions as a static analysis tool that parses source code to map structural relationships and component interactions without requiring the program to execute. The tool distinguishes itself by automatically extracting configuration and annotation data to identify beans and service definitions, which it then translates into visual representations of the system. By reconstructing method call hierarchies and event propagation paths, i

React Doctor is a static analysis tool for React codebases designed to identify security, performance, and architectural issues. It functions as a codebase health diagnostic engine that produces numeric health scores and structured diagnostics to improve maintainability. The tool features an incremental code scanner that evaluates only the files changed between branches or staged in the working tree to provide fast feedback. It is designed to operate as a quality gate within CI pipelines, allowing for the enforcement of codebase health standards by failing builds on critical errors. The anal

webpack-bundle-analyzer is a bundle size analysis tool and Webpack build plugin that visualizes the composition of web application assets. It generates an interactive treemap to identify large dependencies and analyze the distribution of modules within the final payload. The tool functions as a bundle visualizer and a static report generator, exporting analysis data as standalone HTML and JSON files. It supports live bundle tracking via WebSockets during development and allows for the analysis of existing static stats files through a command line interface. The project provides capabilities

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

SkillSpector is a security scanner designed to detect vulnerabilities and malicious patterns in AI agent plugins and extensions before they are installed. It functions as a runtime guardrail that calculates numeric risk scores and assigns severity labels to provide installation recommendations or block risky external extensions. The project distinguishes itself by using language models to perform semantic code analysis, evaluating code intent and context to reduce false positives. It also employs fingerprint-based issue suppression to track and ignore previously accepted risks across repeated

Terser is a JavaScript minifier and compressor designed to reduce file size through whitespace removal, symbol mangling, and logic optimization for ES6+. It functions as a toolkit for minification, a code mangler for shortening variable and property names, and a dead code eliminator that evaluates constant expressions to remove unreachable logic. The project operates as an AST toolkit that parses JavaScript source into SpiderMonkey AST format for structural analysis. It generates source maps to link compressed production code back to the original source, ensuring that minified bundles remain

Chameleon is a cross-platform application framework and component library used to develop applications for the web and various mini-app platforms from a single shared codebase. It functions as a multi-platform build pipeline that compiles source code into different target formats while providing an MVVM-based user interface system for managing application state. The framework employs a polymorphic protocol to extend custom components and APIs, allowing for platform-specific implementations while maintaining cross-end compatibility. It includes a specialized build tool for static analysis that

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Soar is a suite of specialized tools designed for analyzing MySQL performance, advising on indexing, and optimizing SQL syntax. It functions as a performance analyzer, index advisor, and query optimizer to identify bottlenecks and suggest structural improvements for faster execution. The project distinguishes itself through a system for rewriting SQL statements into optimized equivalent versions using custom heuristic rules and patterns. It also features a dedicated index advisor that evaluates query patterns and database metadata to recommend the creation of new indexes. Its broader capabil

Travis CI is a continuous integration platform and CI/CD pipeline orchestrator that automates the testing and building of code changes from version control systems. It functions as a multi-language test runner and build infrastructure manager, ensuring software quality through automated testing across various programming languages and runtimes. The platform is distinguished by its use of virtual-machine-based isolation for reproducible environments and a configuration-driven approach to pipeline generation. It supports complex testing strategies through parallel matrix execution, allowing job