Open-source alternatives to Pmd

Credo is a static analysis tool and linter for Elixir. It functions as a code quality analyzer that scans source code to identify stylistic inconsistencies, common mistakes, and potential security vulnerabilities. The tool provides a customizable framework for defining and testing specialized rules to enforce project-specific coding standards. It identifies complex code fragments and duplication to highlight opportunities for refactoring and simplification. Its capabilities cover automated code reviews, the enforcement of Elixir coding standards, and real-time developer feedback through edit

SonarQube is a static code analysis platform used to scan source code and infrastructure scripts across multiple languages. It detects bugs, security vulnerabilities, and maintainability issues to ensure software meets reliability and security standards. The platform implements automated quality gates for continuous integration and delivery pipelines, verifying code against defined rules during merge or pull requests. It also integrates directly with code editors to provide real-time analysis results and quick-fix guidance during development. The system covers broad functional areas includin

Detekt is a static analysis tool, code quality linter, and complexity analyzer for Kotlin source code. It functions as a code smell detector and static scanner designed to identify potential bugs, design flaws, and violations of coding standards without executing the program. The tool differentiates itself through the use of issue baselining, which allows users to create a snapshot of existing legacy code issues to filter out old violations and focus on preventing new regressions. It further supports extensibility via a plugin-based system that allows for the integration of custom rule sets a

Pylint is a static code analysis tool for Python that checks source code for errors, coding standard violations, and code smells without executing the program. It parses code into an abstract syntax tree and walks the tree to detect issues, enforces configurable style rules and naming conventions, and identifies duplicate code blocks by comparing tokenised source sequences. The tool also includes an inference engine that deduces variable types by simulating code paths, enabling deeper analysis even in untyped code. What distinguishes Pylint is its plugin-based checker architecture, which allo

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

This project is an ESLint plugin and static analysis tool designed to enforce best practices, prevent bugs, and maintain code quality in React projects. It functions as a specialized JSX linter that analyzes the syntax and structure of components to detect anti-patterns and API misuse. The plugin distinguishes itself by providing deep analysis of React-specific patterns, such as detecting state race conditions, preventing nested component definitions, and identifying unstable references that cause unnecessary re-renders. It also includes security hardening rules to identify vulnerabilities li

p3c is a Java static analysis tool and code quality linter designed to enforce professional coding guidelines and quality standards. It utilizes a set of custom rules based on the PMD engine to scan source code for style violations, performance bottlenecks, and potential bugs. The project is distributed as an IDE linting plugin that provides real-time feedback and warnings during development. It also includes functionality for pre-commit code quality gates, allowing modified files to be scanned and blocked if they violate defined rules before being committed to version control. The analysis

code2flow is a static program flow mapper and source code call graph generator. It analyzes source code to produce visual flow diagrams that map function call relationships and execution paths. The project includes an asynchronous call trace visualizer that follows execution paths through async and await calls to map the logic of asynchronous programs. It also provides a programmable code analysis interface, allowing the call graph generation logic to be integrated into other software applications. The system handles static code analysis by converting source code into abstract syntax trees t

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

RuboCop is a static code analyzer and linter for Ruby. It functions as a static analysis tool designed to detect potential bugs, identify style violations, and improve overall code quality in Ruby projects. The project provides an automated code formatter that rewrites source code to align with established community standards. It also implements a language server protocol to surface linting and formatting errors directly within text editors. Its capabilities cover automated code linting and the analysis of Ruby code style to ensure consistency across a project. These functions are driven by

SpotBugs is a static analysis tool and bytecode analyzer for Java applications. It scans compiled class files to identify bugs, security vulnerabilities, and performance issues without executing the code. The system functions as both a bug detector and a static application security testing tool to locate logical errors and API misuse. The project distinguishes itself through a plugin-based detector architecture that allows the integration of external libraries to add custom detection rules. It provides specialized security auditing for vulnerabilities such as SQL injection, cross-site scripti

ApplicationInspector is a multi-language static analysis tool designed to detect specific features and characteristics within source code. It utilizes a declarative JSON rules engine to identify patterns and structural tags across project directories without requiring the analyzer to be recompiled. The system distinguishes itself through a code version differ that compares two different source paths to report changes in detected features. It also provides utilities for creating and validating custom JSON-based rules, including a validation pipeline to verify syntax and identifier uniqueness.

PHP_CodeSniffer is a static analysis tool, coding standard linter, and command-line validator for PHP. It scans files and directories to detect and report formatting errors and language-specific coding violations without executing the code. The project functions as an automated code formatter capable of correcting detected style and formatting violations to bring source code into compliance with defined standards. It uses token-based lexical analysis to match code patterns against rule sets, ensuring consistency across a codebase. The tool provides comprehensive capabilities for recursive fi

WordPress Coding Standards is a collection of rules for the PHP CodeSniffer engine designed to enforce consistent coding conventions and best practices within PHP projects. It functions as a specialized static analysis tool that scans source code to identify style violations, security vulnerabilities, and potential bugs before execution. By integrating into development workflows, it ensures that code adheres to official project conventions, maintaining readability and consistency across large-scale plugin and theme development. The project distinguishes itself through deep domain-specific val

Esprima is a JavaScript parser that converts source code into a structured abstract syntax tree. It implements a specification-driven grammar to ensure compliance with ECMAScript standards, enabling the programmatic analysis and transformation of JavaScript programs. The project provides capabilities for lexical tokenization to break source code into individual symbols and static syntax validation to verify that scripts are well-formed without executing the code. Its functional surface covers JavaScript static analysis, lexical analysis, and the generation of abstract syntax trees.

CodeQL is a semantic code analysis engine and vulnerability scanning tool that treats source code as data. It utilizes a static analysis query language to define complex patterns and security vulnerabilities within a code graph database. The system represents source code as a relational database, enabling the execution of structural queries and data flow analysis. This approach allows for the detection of security flaws and coding errors across large-scale repositories. The tool provides capabilities for automated code auditing, static analysis security testing, and custom vulnerability dete

Standard is a zero-configuration static analyzer, linter, and formatter for JavaScript. It functions as a style guide that enforces consistent coding rules and identifies programming errors without requiring manual configuration files. The tool distinguishes itself by providing an automatic code fixer that scans source files to correct style violations and ensure a uniform codebase. It implements a predefined rule set to eliminate the need for project-specific configuration. The project covers a broad range of static analysis capabilities, including support for experimental language syntax a

syn is a Rust syntax tree parser and token stream converter. It serves as a toolkit for procedural macro development, providing a framework to parse Rust source code into structured syntax trees for analysis and transformation. The project enables the manipulation of Rust abstract syntax trees through specialized visitor and folder patterns for traversing and mutating nodes. It provides a bidirectional mapping that allows developers to convert token streams into structured trees and print those trees back into tokens for code generation. The library covers a broad range of syntax analysis ca

RuboCop is a static code analyzer, linter, and formatter for the Ruby language. It identifies style violations, smells, and errors in source code to ensure consistency and maintainability based on community guidelines. The project provides automatic source code formatting to rewrite files according to defined stylistic standards. It also functions as a language server protocol implementation, surfacing violations and suggested fixes directly within code editors. The tool covers code complexity monitoring to track the size of classes and methods and employs non-inclusive language detection to

Standard is a suite of static analysis tools for JavaScript, comprising a linter, formatter, and a predefined style guide. It functions as a static code analyzer that scans source code for style violations and potential errors without executing the program. The project provides an automatic code fixer that rewrites source code to resolve formatting issues and enforce syntax consistency. It implements a standardized set of rules for JavaScript formatting and syntax to ensure a uniform appearance across different projects. The system covers a wide range of static analysis capabilities, includi

This project is an AI-powered code reviewer and static analysis server that identifies low-quality files and generates automated critiques. It functions as an automated quality scoring tool that evaluates source code structure and complexity through local parsing. The system utilizes a standardized context protocol to stream analysis results to AI agents and editors. It integrates large language models to produce automated reviews and suggestions for improvement based on quantitative quality metrics. The tool includes a weight-based scoring engine and an asynchronous analysis pipeline for pr

Rector is an automated PHP refactoring and modernization tool designed to upgrade language versions and modernize syntax using predefined rules. It functions as a static analysis engine that inspects code structures and types to identify refactoring targets without executing the code. The project provides a framework for defining custom transformation logic to automate project-specific changes. It distinguishes itself by offering specialized capabilities for migrating legacy or custom frameworks to modern alternatives and converting docblock annotations into native language attributes. The s

Reek is a static code analyzer for Ruby projects designed to identify design flaws and maintainability issues known as code smells. It functions as a quality assurance tool that inspects source code without executing it to find structural weaknesses and architectural debt. The analyzer identifies specific patterns such as large classes, long methods, and uncommunicative naming. It also detects more complex design issues, including feature envy, data clumps, simulated polymorphism, and control coupling. The tool includes capabilities for issue baselining to manage legacy code and configuratio

Scriban is a .NET text templating engine and embedded scripting language used for dynamic text generation. It functions as an abstract syntax tree manipulation tool and a template parser, allowing for the conversion of scripts into visitable trees for analysis, modification, and rendering. The engine is specifically designed for Native AOT compatibility, utilizing a reflection-free API to execute templates in trimmed environments. It also provides a dedicated parser and conversion system for Liquid templates, enabling the migration and execution of Liquid scripts within .NET. The project cov

Oclint is a static analysis engine and extensible linting framework designed for C, C++, and Objective-C source code. It functions as a code quality tool that identifies bugs, code smells, and structural complexities by parsing source code into abstract syntax trees to perform semantic inspection. The project is distinguished by its modular architecture, which supports dynamic plugin loading for custom inspection rules and a pluggable reporter system for exporting analysis findings in multiple formats. It replicates build configurations by reading compiler flags and include paths to ensure th

Luau is a high-performance programming language evolved from Lua 5.1. It consists of a bytecode virtual machine, an embeddable scripting engine, and a static code analyzer designed to provide a secure, sandboxed execution environment for host applications. The project is distinguished by its gradual typing system, which combines automatic type inference with optional manual annotations to detect bugs without requiring full static typing. It also features native vector mathematics for high-performance operations and a specialized debugging system that uses bytecode patching to minimize executi