Open-source alternatives to Pipreqs

PDM is a Python package manager, dependency resolver, and build tool designed to create reproducible environments. It functions as a runtime manager that installs and switches between different versions of the Python interpreter using standalone builds, while managing isolated virtual environments to prevent version conflicts between projects. The tool distinguishes itself through the use of cross-platform lockfiles and a plugin-based extension architecture, allowing users to add new capabilities via external distributions. It provides a centralized package caching system and a parallel insta

pipx is a manager for installing and running Python command-line applications in isolated environments. It serves as a tool installer and virtual environment wrapper that automates the creation of dedicated environments for each application to prevent dependency conflicts. The system provides the ability to execute Python packages in either permanent installations or temporary transient environments. It maps executable entry points from these isolated environments into a shared global directory, allowing for direct command-line access while keeping underlying dependencies separated. The tool

Poetry is a Python build tool, dependency manager, and project orchestrator. It provides a unified workflow for managing the full lifecycle of a project, from initial environment setup to the final package release. The system centralizes project metadata and dependency specifications in a single configuration file, replacing legacy formats. It utilizes a deterministic dependency resolver to calculate compatible package versions and records the exact state of the environment in a lock file to ensure consistency across different machines. The tool handles the orchestration of isolated virtual

pip-tools is a set of utilities for Python dependency pinning, lockfile management, and virtual environment synchronization. It functions as a requirement compiler that resolves high-level package declarations into a pinned list of specific versions and content hashes to ensure repeatable builds across different environments. The tool differentiates itself by providing a mechanism to refresh locked dependencies to their latest compatible versions without manual editing. It supports a layered dependency workflow, allowing one requirements file to act as a constraint for another to maintain com

Error Prone is a static code analyzer and Java compiler extension that identifies common programming mistakes during the build process. It functions as a compiler wrapper that flags potential errors as compile-time failures to prevent bugs from reaching execution. The tool integrates directly into the Java compilation workflow to provide compile-time validation. It allows for the definition of custom linting rules and analysis checks to enforce specific coding standards and detect prohibited API usage. The system utilizes abstract syntax tree analysis and type-aware pattern matching to inspe

PHP_CodeSniffer is a static analysis tool, coding standard linter, and command-line validator for PHP. It scans files and directories to detect and report formatting errors and language-specific coding violations without executing the code. The project functions as an automated code formatter capable of correcting detected style and formatting violations to bring source code into compliance with defined standards. It uses token-based lexical analysis to match code patterns against rule sets, ensuring consistency across a codebase. The tool provides comprehensive capabilities for recursive fi

Mago is a PHP static analysis tool, linter, and code formatter. It detects type errors, dead code, and logic bugs through advanced type inference and flow analysis, while providing a deterministic engine to rewrite source files according to style guides. The project distinguishes itself with a WebAssembly runtime that enables PHP analysis to execute entirely within a web browser, allowing results to be shared via URL. It also provides a minimal Dockerized toolchain distributed as a scratch image for consistent execution across different processor architectures. The toolset covers architectur

This project is a static analysis linter, code quality tool, and language auditor for Rust. It functions as an automated refactoring system designed to identify common mistakes and suggest idiomatic improvements for Rust source code. The tool identifies non-idiomatic patterns, performance bottlenecks, and code smells to improve the overall correctness and quality of the code. It specifically audits memory safety by flagging suspicious use of unsafe blocks and pointer manipulations and detects inefficient operations to optimize execution speed. The analysis surface covers coding style enforce

SonarQube is a static code analysis platform used to scan source code and infrastructure scripts across multiple languages. It detects bugs, security vulnerabilities, and maintainability issues to ensure software meets reliability and security standards. The platform implements automated quality gates for continuous integration and delivery pipelines, verifying code against defined rules during merge or pull requests. It also integrates directly with code editors to provide real-time analysis results and quick-fix guidance during development. The system covers broad functional areas includin

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as code, container images, and Kubernetes configurations. It functions as a cloud security posture tool, an SCA vulnerability scanner, and a secret scanning utility to prevent security breaches and version control leaks. The project distinguishes itself through deep graph analysis and variable resolution, allowing it to map relationships between interconnected resources and evaluate the final state of infrastructure attributes. It provides extensibility for defining custom security

Pylint is a static code analysis tool for Python that checks source code for errors, coding standard violations, and code smells without executing the program. It parses code into an abstract syntax tree and walks the tree to detect issues, enforces configurable style rules and naming conventions, and identifies duplicate code blocks by comparing tokenised source sequences. The tool also includes an inference engine that deduces variable types by simulating code paths, enabling deeper analysis even in untyped code. What distinguishes Pylint is its plugin-based checker architecture, which allo

PHP-Parser is a tool that converts PHP source code into an abstract syntax tree for static analysis and programmatic manipulation. It functions as a parser, a code generator, and a static analysis framework. The project enables the programmatic construction of abstract syntax tree nodes through a fluent interface and provides the ability to transform these trees back into formatted source code. It includes a serializer that exports abstract syntax trees to JSON format and reconstructs them from strings. The toolset covers several capability areas, including namespace resolution, constant exp

ApplicationInspector is a multi-language static analysis tool designed to detect specific features and characteristics within source code. It utilizes a declarative JSON rules engine to identify patterns and structural tags across project directories without requiring the analyzer to be recompiled. The system distinguishes itself through a code version differ that compares two different source paths to report changes in detected features. It also provides utilities for creating and validating custom JSON-based rules, including a validation pipeline to verify syntax and identifier uniqueness.

p3c is a Java static analysis tool and code quality linter designed to enforce professional coding guidelines and quality standards. It utilizes a set of custom rules based on the PMD engine to scan source code for style violations, performance bottlenecks, and potential bugs. The project is distributed as an IDE linting plugin that provides real-time feedback and warnings during development. It also includes functionality for pre-commit code quality gates, allowing modified files to be scanned and blocked if they violate defined rules before being committed to version control. The analysis

JSHint is a JavaScript static analysis tool and linter designed to detect errors and enforce coding standards. It functions as a syntax validator that scans source code to identify potential logic problems and programming mistakes before the code is executed. The tool provides a command line interface for analyzing files and directories. It supports the export of analysis results into standardized formats such as Checkstyle for integration with external build tools. Analysis is managed through a system of linting rule management and environment global configuration. This includes the ability

Detekt is a static analysis tool, code quality linter, and complexity analyzer for Kotlin source code. It functions as a code smell detector and static scanner designed to identify potential bugs, design flaws, and violations of coding standards without executing the program. The tool differentiates itself through the use of issue baselining, which allows users to create a snapshot of existing legacy code issues to filter out old violations and focus on preventing new regressions. It further supports extensibility via a plugin-based system that allows for the integration of custom rule sets a

PMD is a multi-language static code analyzer used to identify programming flaws, unused variables, and dead code without executing the program. It functions as a code smell detector and coding standard enforcer, ensuring source code adheres to specific naming conventions, structural requirements, and project style guides. The project features an XPath-based rule engine that allows users to define custom analysis patterns using queries against an abstract syntax tree. It also includes a copy-paste detector to identify duplicated code blocks across multiple files and a visual rule designer for

ChatGPT-CodeReview is an AI-driven code analysis tool and bot that uses a large language model to automatically review pull request diffs and post feedback on code changes. It functions as a system for detecting bugs and suggesting improvements in source code. The tool provides a containerized runtime for deployment as a background process or through a GitHub Action. Users can customize the analysis behavior, style, and technical depth by adjusting model parameters and system prompts. The system handles automated code review workflows by triggering analysis via webhooks and CI pipelines, upd

pycparser is a C99 parser library that converts C source code into an abstract syntax tree consisting of Python objects. It functions as an abstract syntax tree generator, transforming preprocessed C code into a structured hierarchy for programmatic analysis and transformation. The library integrates with a C preprocessor to handle directives before parsing. It also features a stub header parser, which uses minimal mock headers to allow the parsing of C code without requiring a full system C library installation. The project provides tools for static code analysis, C program analysis, and so

The dependency analysis Gradle plugin is a diagnostic and management tool designed to optimize build configurations for JVM and Android projects. It identifies unused dependencies and plugins by inspecting source code and compiled bytecode, ensuring that project configurations remain lean and efficient. By integrating directly into the build lifecycle, the plugin provides actionable insights that help maintain clean dependency declarations and reduce unnecessary build overhead. The project distinguishes itself through a heuristic-based advice engine that explains the rationale behind every re

Standard is a zero-configuration static analyzer, linter, and formatter for JavaScript. It functions as a style guide that enforces consistent coding rules and identifies programming errors without requiring manual configuration files. The tool distinguishes itself by providing an automatic code fixer that scans source files to correct style violations and ensure a uniform codebase. It implements a predefined rule set to eliminate the need for project-specific configuration. The project covers a broad range of static analysis capabilities, including support for experimental language syntax a

go-ast-book is a collection of educational and technical resources focused on abstract syntax tree analysis, compiler development, and static code verification. It provides guides and manuals for parsing, traversing, and analyzing Go source code to extract semantic meaning. The project serves as a reference for building compiler frontends, covering the translation of high-level code into intermediate representations and single static assignment forms. It also provides instructions for using these techniques to develop language tooling and perform static code analysis. The resources cover a b

ts-morph is a TypeScript AST manipulation library and a high-level wrapper for the TypeScript compiler API. It provides a programmatic interface for analyzing, modifying, and generating TypeScript source code, serving as a tool for automated code refactoring and source code generation. The library simplifies the process of navigating and inspecting project structures by offering an object-oriented abstraction over the underlying compiler API. It allows for the programmatic transformation of existing codebases to automate structural updates and bulk code migrations. Its capabilities cover sta

npm-check is a command-line tool that audits a project's npm dependencies, comparing local package versions against the npm registry to identify outdated, unused, or incorrect entries. It scans both package.json and node_modules, and can also inspect globally installed npm packages for the same issues. The tool distinguishes itself by offering multiple modes of operation. It can automatically update all outdated dependencies to their latest versions without interaction, suitable for automated scripts. Alternatively, it provides an interactive terminal interface that lets users review and

This project is an AI-powered code reviewer and static analysis server that identifies low-quality files and generates automated critiques. It functions as an automated quality scoring tool that evaluates source code structure and complexity through local parsing. The system utilizes a standardized context protocol to stream analysis results to AI agents and editors. It integrates large language models to produce automated reviews and suggestions for improvement based on quantitative quality metrics. The tool includes a weight-based scoring engine and an asynchronous analysis pipeline for pr