Open-source alternatives to Semgrep

Oclint is a static analysis engine and extensible linting framework designed for C, C++, and Objective-C source code. It functions as a code quality tool that identifies bugs, code smells, and structural complexities by parsing source code into abstract syntax trees to perform semantic inspection. The project is distinguished by its modular architecture, which supports dynamic plugin loading for custom inspection rules and a pluggable reporter system for exporting analysis findings in multiple formats. It replicates build configurations by reading compiler flags and include paths to ensure th

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This project is a PHP web application framework designed to provide a structured foundation for building and scaling applications. It utilizes a model-view-controller architecture to separate data management, user interface rendering, and request handling, while employing a service container to manage dependency injection and modular code organization. The framework distinguishes itself by integrating a comprehensive suite of development and maintenance tools directly into the ecosystem. It features a command-line interface for automating repetitive tasks and managing application state, along

Error Prone is a static code analyzer and Java compiler extension that identifies common programming mistakes during the build process. It functions as a compiler wrapper that flags potential errors as compile-time failures to prevent bugs from reaching execution. The tool integrates directly into the Java compilation workflow to provide compile-time validation. It allows for the definition of custom linting rules and analysis checks to enforce specific coding standards and detect prohibited API usage. The system utilizes abstract syntax tree analysis and type-aware pattern matching to inspe

Hadolint is a static analysis tool designed to validate container build configurations. It functions as a security scanner and configuration auditor, parsing build instructions into a structured format to identify deviations from security and efficiency standards. The tool distinguishes itself by performing deep inspection of embedded shell commands. By tokenizing and analyzing these scripts, it detects common scripting errors and security vulnerabilities that might otherwise persist within a container image. It integrates external analysis tools to provide specialized validation for these in

The AWS Cloud Development Kit is an infrastructure-as-code framework that enables developers to define and provision cloud resources using familiar programming languages. By utilizing construct-based synthesis, it translates high-level, object-oriented code into declarative templates, allowing for the automated management of complex cloud environments through a centralized, code-driven control plane. The framework distinguishes itself through its ability to model infrastructure as a dependency-aware resource graph, ensuring that components are provisioned and updated in the correct order. It

Detekt is a static analysis tool, code quality linter, and complexity analyzer for Kotlin source code. It functions as a code smell detector and static scanner designed to identify potential bugs, design flaws, and violations of coding standards without executing the program. The tool differentiates itself through the use of issue baselining, which allows users to create a snapshot of existing legacy code issues to filter out old violations and focus on preventing new regressions. It further supports extensibility via a plugin-based system that allows for the integration of custom rule sets a

Standard is a zero-configuration static analyzer, linter, and formatter for JavaScript. It functions as a style guide that enforces consistent coding rules and identifies programming errors without requiring manual configuration files. The tool distinguishes itself by providing an automatic code fixer that scans source files to correct style violations and ensure a uniform codebase. It implements a predefined rule set to eliminate the need for project-specific configuration. The project covers a broad range of static analysis capabilities, including support for experimental language syntax a

p3c is a Java static analysis tool and code quality linter designed to enforce professional coding guidelines and quality standards. It utilizes a set of custom rules based on the PMD engine to scan source code for style violations, performance bottlenecks, and potential bugs. The project is distributed as an IDE linting plugin that provides real-time feedback and warnings during development. It also includes functionality for pre-commit code quality gates, allowing modified files to be scanned and blocked if they violate defined rules before being committed to version control. The analysis

ansible-lint is a static code analysis tool and linter designed to identify syntax errors and best practice violations within Ansible playbooks and roles. It functions as a quality gate for automation pipelines, scanning configuration files and scripts without executing the code to ensure reliability and consistency. The project distinguishes itself by acting as an automated code formatter that can correct identified linting issues and reformat files to meet community standards. It also serves as a dependency manager, automatically detecting and installing required roles and collections from

This project is a JavaScript optimizer, minifier, module bundler, transpiler, and static analysis tool. It provides a compilation pipeline designed to shrink file sizes and improve runtime performance. The system utilizes a multi-pass compilation process to perform dead code elimination, global name mangling, and static type inference. It identifies unreachable functions and unused variables to reduce the final output size and detects potential runtime errors without executing the code. The tool manages assets through dependency resolution, code chunking, and bundle management. It ensures co

This project is a static analysis engine and type checker designed for PHP codebases. It evaluates source code structure and type annotations to identify potential bugs, type mismatches, and logic errors without executing the application. By parsing code into an abstract syntax tree and applying a rule-based validation framework, it enforces code quality and safety standards across a project. What distinguishes this tool is its sophisticated type inference engine, which models dynamic language features, magic methods, and conditional types to maintain accuracy even in unconventional code. It

This project is a web application security standard and vulnerability framework. It provides a comprehensive list of the most critical security risks facing web applications, paired with technical guidance and a structured methodology for identifying and mitigating these flaws. The framework functions as a secure coding guide and a risk assessment methodology, offering a standardized approach to prioritizing vulnerabilities based on their potential impact and likelihood of exploitation. It defines architectural patterns and technical recommendations to help developers implement defense in dep

This project is a React ESLint plugin and static analysis tool designed to validate React component syntax and enforce recommended framework patterns. It functions as a JavaScript static analysis utility that scans source code to identify errors and maintain consistent coding standards. The plugin focuses on the enforcement of React best practices and the prevention of common bugs, such as missing keys in iterators and improper prop usage. It provides a system for validating JSX syntax and style to ensure a uniform codebase. The tool covers broader capabilities in frontend code quality autom

JSHint is a JavaScript static analysis tool and linter designed to detect errors and enforce coding standards. It functions as a syntax validator that scans source code to identify potential logic problems and programming mistakes before the code is executed. The tool provides a command line interface for analyzing files and directories. It supports the export of analysis results into standardized formats such as Checkstyle for integration with external build tools. Analysis is managed through a system of linting rule management and environment global configuration. This includes the ability

This project is a static analysis engine designed to identify patterns, enforce coding standards, and automate code quality improvements in software projects. By parsing source code into structured abstract syntax trees, it enables deep programmatic inspection and the automated remediation of identified programming issues. The engine functions as a pluggable linting framework, allowing developers to extend its core capabilities through a modular architecture. Users can inject custom rules, parsers, and processors to support non-standard file formats or domain-specific logic. This extensibilit

ast-grep is a command-line utility and static analysis engine designed for searching, linting, and refactoring source code. It operates by identifying and transforming code blocks based on their underlying syntactic structure rather than relying on text-based or regular expression matching. The tool utilizes a language-agnostic abstraction to normalize diverse programming grammars into a unified tree structure. By employing a rule-driven engine, it allows users to define complex patterns that capture syntax nodes as variables, enabling consistent and syntactically valid modifications across e

SwiftLint is a static analysis tool and code formatter designed to enforce consistent coding styles and identify semantic issues within Swift source code. It functions as a command-line utility that evaluates code against established conventions to ensure uniform structure and architectural standards across a project. The tool distinguishes itself through a custom linting engine that leverages compiler-integrated syntax analysis to perform deep inspections of code structure. Beyond simple pattern matching, it supports automated source code transformation to correct formatting violations and r

HTMLHint is an HTML linter and static analysis tool designed to identify structural errors and syntax violations in source code. It functions as a configurable validator that scans local files and remote URLs to detect malformed tags, duplicate IDs, and document structure inconsistencies. The tool serves as an accessibility auditor, verifying that web elements include necessary labels and alternative text for images. It further distinguishes itself by enforcing web document compliance, checking for the presence of doctypes, language attributes, and head metadata. The project covers a broad r

Phan is a static analyzer and type checker for PHP that identifies bugs and type incompatibilities without executing the code. It serves as a quality gate for continuous integration pipelines and a tool for verifying type safety, specifically checking union types, generics, and array shapes. The project is distinguished by its use of a background daemon and Language Server Protocol implementation, which provide real-time diagnostics and navigation within editors. It also features a baseline-based suppression system that allows developers to record existing errors in a snapshot file to focus e

Closure Compiler is a JavaScript build utility designed to transform, optimize, and validate source code for production environments. It functions as a minifier and transpiler, converting modern ECMAScript syntax into older, widely compatible versions to ensure reliable execution across diverse browsers. The tool distinguishes itself through a multi-pass optimization pipeline that performs complex refactoring, such as constant folding, function inlining, and variable renaming. It utilizes a static type inference engine to detect potential runtime errors and enforce type safety without requiri

This project is a boilerplate for building RESTful web services using Node.js, Express, and Mongoose. It provides a structured foundation for developing backend applications, incorporating schema-driven data modeling to manage database interactions and a middleware-based pipeline to handle request processing and validation. The framework distinguishes itself by integrating token-based stateless authentication to secure API endpoints and manage user identity. It includes built-in support for containerization, allowing the application to be packaged into portable images for consistent deploymen

This project is a static analysis runner designed to identify bugs, performance bottlenecks, and stylistic inconsistencies within Go codebases. It functions as a comprehensive quality assurance suite that executes multiple analysis tools concurrently to provide a unified diagnostic report. By parsing source code into a structured representation, the tool enforces coding standards, validates import structures, and ensures consistent formatting across entire projects. The tool distinguishes itself through its ability to automate the remediation of identified issues, applying programmatic fixes

PRQL is a functional, modular data transformation language that serves as a compiler for relational data pipelines. It allows developers to write expressive, pipelined queries that are translated into standard SQL dialects. By abstracting complex data manipulation into a readable, sequential syntax, the project enables the construction of maintainable workflows that remain independent of specific database engines. The language distinguishes itself through a robust compilation infrastructure that performs type validation and relational algebra analysis before generating target-specific code. I

This project is a high-performance static type checker and comprehensive development toolkit for Python. It functions as a core analysis engine that identifies type inconsistencies and enforces code correctness, while simultaneously providing a language server implementation to deliver real-time diagnostics and intelligence directly within development environments. The tool distinguishes itself through a parallelized execution engine that maximizes performance across large-scale codebases and monorepo structures. It supports gradual type adoption, allowing developers to integrate type checkin

PentestGPT is an autonomous security testing framework that leverages large language models to plan, execute, and coordinate end-to-end penetration testing engagements. By functioning as an autonomous agent, the system automates the entire testing lifecycle, from initial reconnaissance and vulnerability analysis to the generation of custom exploits and the execution of post-exploitation tasks. The platform distinguishes itself through a multi-agent orchestration system that coordinates specialized AI agents to collaborate on complex, multi-stage attack chains. It integrates multimodal context