Awesome GitHub RepositoriesStatic Analysis Tools

Create React App is a command-line tool that generates a pre-configured project structure and build pipeline for React web applications. It serves as a frontend project scaffold, providing a set of predefined directory structures and dependencies to start development without manual compiler or bundler setup. The tool manages a complete frontend build pipeline that compiles, minifies, and optimizes code into production-ready bundles with hashed filenames. It also includes a configuration tool for progressive web app standards, implementing web app manifests and service workers for offline func

PHP-Parser is a tool that converts PHP source code into an abstract syntax tree for static analysis and programmatic manipulation. It functions as a parser, a code generator, and a static analysis framework. The project enables the programmatic construction of abstract syntax tree nodes through a fluent interface and provides the ability to transform these trees back into formatted source code. It includes a serializer that exports abstract syntax trees to JSON format and reconstructs them from strings. The toolset covers several capability areas, including namespace resolution, constant exp

This project is a static analysis framework and linting engine designed to inspect TypeScript codebases. It functions as a plugin suite that enables standard linting workflows to parse source code into abstract syntax trees, allowing for the automated enforcement of coding standards and the identification of potential bugs through a modular, rule-based visitor pattern. The engine distinguishes itself by integrating directly with the TypeScript compiler to perform type-aware analysis. By accessing compiler type information, it can identify complex errors and unsafe patterns that standard synta

Pyright is a static type checker for Python designed to validate type hints and identify potential errors within large codebases. It functions as a command-line utility that integrates into local development environments and continuous integration pipelines to ensure code quality and consistency. The tool distinguishes itself through a high-performance analysis engine that utilizes incremental dependency graph analysis and persistent state caching to re-evaluate only the affected portions of a project. By implementing the Language Server Protocol, it provides real-time feedback, including err

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

Reviewdog is an automated review bot and CI code review orchestrator that converts the output of static analysis tools into automated pull request comments. It functions as a linter output parser and static analysis commenter, transforming unstructured logs from compilers or linters into structured diagnostics. The project distinguishes itself by using pattern-based output parsing and a platform-agnostic plugin architecture to unify multi-language linting workflows. It employs diff-based result filtering to isolate issues introduced in a specific commit and provides the ability to post action

SwiftFormat is a tool for the Swift language that functions as a code formatter, linter, and refactoring utility. It automatically applies consistent style rules and visual formatting to source files to ensure a uniform appearance across a project. The project differentiates itself by providing both a command-line interface for batch processing and an Xcode extension for integration directly into the development environment. It includes specialized capabilities for modernizing legacy API usage, simplifying language constructs, and inferring formatting options by analyzing an existing codebase

xo is a zero-configuration linting tool for JavaScript and TypeScript. It functions as a wrapper for the ESLint engine, providing a set of strict default rules and static analysis to enforce professional coding standards without requiring manual configuration files. The tool distinguishes itself by providing a zero-config runtime that automatically determines parser settings and linting rules at execution time. It includes a code style formatter to standardize indentation and syntax across all project files. The project covers automated error correction and source code formatting to eliminat

Bullet is an Active Record performance monitor and query profiler for Ruby on Rails applications. It serves as a diagnostic utility to identify inefficient database access patterns, flag redundant requests, and suggest eager loading strategies to improve response times. The tool specifically detects N+1 queries, missing counter caches, and unused eager loading. It monitors these patterns across both standard web requests and background jobs, identifying records that are fetched but never accessed to reduce memory usage and query overhead. Analysis is supported by a system that intercepts dat

go-tools is a collection of utilities for Go static analysis and memory layout optimization. It provides a toolset designed to analyze source code to detect bugs and dead code, alongside specialized tools for optimizing how structs are arranged in memory. The project includes a memory alignment visualizer to display physical memory layouts and padding, as well as a struct layout optimizer that reorders fields to minimize memory padding. Additionally, it provides a boilerplate generator to automate the creation of registration and test files required for developing custom Go analyzers. The to

rustfmt is a Rust code formatter that operates as a Cargo subcommand, applying consistent formatting to Rust source files according to official style guidelines. It parses source code into a syntax tree, applies formatting rules to tree nodes, and pretty-prints the result back to text, with support for TOML-driven configuration that allows per-project style customization. The formatter is edition-aware, automatically selecting formatting rules based on the Rust edition specified in the project, and supports a style edition override that decouples formatting rules from the Rust edition used fo

Larastan is a static analysis extension and type inference engine for PHP designed to detect bugs and type errors in Laravel applications. It extends PHPStan to resolve framework-specific patterns and magic methods, providing a rule-based scanning engine to audit code quality without executing the application. The tool specializes in Eloquent analysis, verifying that model properties, casts, and relationships align with database schemas and migrations. It tracks types across Eloquent collections, custom builders, and model factories to ensure type safety during database operations and iterati

google-java-format is a Java code formatter and style enforcement tool. It reformats Java source code to adhere to a standardized style guide, ensuring consistent layout and indentation across entire projects or individual files. The project functions as a build pipeline linting tool for continuous integration workflows and as an IDE formatting plugin to replace native editor formatting. It can be embedded as a formatting library within code generation software to ensure machine-written output remains human-readable. The tool provides capabilities for reorganizing source code indentation and

Phan is a static analyzer and type checker for PHP that identifies bugs and type incompatibilities without executing the code. It serves as a quality gate for continuous integration pipelines and a tool for verifying type safety, specifically checking union types, generics, and array shapes. The project is distinguished by its use of a background daemon and Language Server Protocol implementation, which provide real-time diagnostics and navigation within editors. It also features a baseline-based suppression system that allows developers to record existing errors in a snapshot file to focus e

PhpInsights is a static analysis tool and code quality analyzer for PHP. It evaluates source code to identify bugs, style violations, and technical debt without executing the application. The tool functions as a complexity metric utility, calculating architectural and cyclomatic complexity to locate overly complicated logic. It measures overall software health and maintainability by comparing code against industry standards. The system manages technical debt through rule-based validation and metric-driven scoring. It uses a static analysis engine to parse source code, delivering the results

Credo 是一个用于 Elixir 的静态分析工具和 Linter。它作为一个代码质量分析器，扫描源代码以识别风格不一致、常见错误和潜在的安全漏洞。 该工具提供了一个可定制的框架，用于定义和测试专门的规则，以强制执行项目特定的编码标准。它识别复杂的代码片段和重复代码，以突出重构和简化的机会。 其功能涵盖自动化代码审查、Elixir 编码标准的强制执行，以及通过编辑器集成提供的实时开发者反馈。

Shellharden 是一个 Shell 脚本加固工具和 linter，旨在提高 Bash 脚本的安全性和可靠性。它作为一个自动化工具，重写脚本以遵循行业标准的引用和安全实践。 该项目提供了一个优化器和标准化工具，用更安全的函数等效项替换不安全的模式和别名。它包含一个语法高亮器，使用视觉标记和颜色来指示漏洞以及需要进行引用修正的区域。 该工具涵盖了广泛的功能，包括自动安全修复、漏洞检测和脚本错误检测。这些功能通过自动重写和结构化语法验证确保脚本的一致性。

Vulture is a static analysis tool and linter designed to find unused variables, functions, and classes in Python source code. It operates as a dead code detector and unused code finder that scans source files to identify unreachable expressions and imports without executing the code. The tool employs a confidence-based heuristic scoring system to assign probability values to detections, helping to distinguish truly unused symbols from potential false positives. It further assists in pruning dead logic by sorting detected unused classes and functions by line count to prioritize the removal of

GrumPHP 是一个 Git 提交验证器和 PHP 代码质量编排器。它充当 Git 钩子 (hook) 管理器，自动化脚本触发器的安装和执行，以在 PHP 项目中强制执行代码质量标准。 该工具通过在 Git 工作流期间运行一系列验证和 linting 任务，防止不合规的代码被提交。它将自动化质量检查直接集成到本地开发环境中，以维护项目标准。 该系统通过执行质量测试和自动化 Git 钩子来管理预提交 (pre-commit) 测试工作流。它使用基于任务的流水线来运行验证工具，并验证退出代码以确定是否应完成提交。

Reek 是一个用于 Ruby 项目的静态代码分析器，旨在识别被称为“代码异味”的设计缺陷和可维护性问题。它作为一个质量保证工具，在不执行源代码的情况下对其进行检查，以发现结构性弱点和架构债务。 该分析器可以识别特定的模式，如大类、长方法和不具描述性的命名。它还能检测更复杂的设计问题，包括特性依恋、数据泥团、模拟多态和控制耦合。 该工具包括用于管理遗留代码的问题基线功能，以及用于排除特定目录的配置驱动过滤功能。它支持通过 CI/CD 流水线进行自动化质量检查，并提供 JSON、YAML、XML 和 HTML 等格式的分析报告。