Awesome GitHub RepositoriesStatic Analysis Tools

该项目是一个静态分析工具和 linter，旨在提高 shell 脚本的质量、可靠性和可移植性。通过执行深度结构分析，它在脚本执行前识别常见的编程陷阱、语法错误和安全漏洞。它作为一个自动代码审查器，强制执行最佳实践，并帮助开发人员在不同的操作环境中维护一致、健壮的代码。 该工具通过其支持方言的语法解析脱颖而出，它根据检测到的特定 shell 解释器调整其解析逻辑。它利用一个复杂的引擎来构建抽象语法树，以评估逻辑、引用和可移植性问题。开发人员可以使用内联指令来抑制特定警告或配置工具如何解析外部源文件，从而对分析过程进行细粒度控制。 该项目涵盖了全面的诊断功能，从基础语法验证到复杂的逻辑检查。它提供了关于惯用脚本构建的指导，包括安全的文件处理、高效的算术运算和正确的命令替换。这些功能共同确保脚本符合 POSIX 标准，并在各种 shell 实现中保持兼容。 该工具作为命令行实用程序分发，允许集成到开发工作流中，以提供关于脚本完整性的即时反馈。

Claude Quickstarts is a development framework and collection of reference implementations designed for building autonomous agents. It provides the foundational patterns necessary to orchestrate multi-agent workflows, enabling models to perform complex, multi-step tasks across software engineering, customer support, and computer-use domains. The platform distinguishes itself through specialized capabilities for desktop and browser automation, allowing agents to interact with graphical interfaces by capturing visual context and executing precise mouse and keyboard inputs. It includes robust inf

Rust-analyzer is a language server implementation that provides real-time code intelligence, static analysis, and development productivity tools for the Rust programming language. It functions as a backend engine that communicates with text editors to deliver deep structural understanding of source code, enabling features like semantic analysis, symbol navigation, and automated refactoring. The project distinguishes itself through a core engine designed for high-performance responsiveness, utilizing incremental query-based compilation and lazy demand-driven evaluation to minimize resource con

This project provides a framework for capturing and managing architectural decision records within a version-controlled codebase. It functions as a documentation standard that enables engineering teams to record the context, rationale, and consequences of significant technical choices, ensuring that design history is preserved as a first-class artifact alongside the source code. The system distinguishes itself by integrating design documentation directly into the development lifecycle. By utilizing template-driven metadata, it enforces a consistent structure for all technical records, which f

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This tool functions as a generator that maps dynamic framework methods and database model properties to static files, ensuring integrated development environments recognize runtime features. It acts as a static analysis helper by inspecting framework structures to provide accurate type hinting and autocompletion for core classes and container-bound objects. The project distinguishes itself by its ability to interrogate the dependency injection registry and scan runtime method registrations to document dynamically added functionality. It further differentiates by performing reflection-based in

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

This project is a static analysis engine and type checker designed for PHP codebases. It evaluates source code structure and type annotations to identify potential bugs, type mismatches, and logic errors without executing the application. By parsing code into an abstract syntax tree and applying a rule-based validation framework, it enforces code quality and safety standards across a project. What distinguishes this tool is its sophisticated type inference engine, which models dynamic language features, magic methods, and conditional types to maintain accuracy even in unconventional code. It

Spring-analysis is a diagnostic utility designed to visualize the internal architecture and execution logic of Java applications built on the Spring Framework. It functions as a static analysis tool that parses source code to map structural relationships and component interactions without requiring the program to execute. The tool distinguishes itself by automatically extracting configuration and annotation data to identify beans and service definitions, which it then translates into visual representations of the system. By reconstructing method call hierarchies and event propagation paths, i

React Doctor is a static analysis tool for React codebases designed to identify security, performance, and architectural issues. It functions as a codebase health diagnostic engine that produces numeric health scores and structured diagnostics to improve maintainability. The tool features an incremental code scanner that evaluates only the files changed between branches or staged in the working tree to provide fast feedback. It is designed to operate as a quality gate within CI pipelines, allowing for the enforcement of codebase health standards by failing builds on critical errors. The anal

webpack-bundle-analyzer is a bundle size analysis tool and Webpack build plugin that visualizes the composition of web application assets. It generates an interactive treemap to identify large dependencies and analyze the distribution of modules within the final payload. The tool functions as a bundle visualizer and a static report generator, exporting analysis data as standalone HTML and JSON files. It supports live bundle tracking via WebSockets during development and allows for the analysis of existing static stats files through a command line interface. The project provides capabilities

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

SkillSpector 是一款安全扫描器，旨在在 AI 代理插件和扩展安装之前检测其中的漏洞和恶意模式。它作为一个运行时护栏，计算数值风险评分并分配严重性标签，以提供安装建议或阻止有风险的外部扩展。 该项目的独特之处在于使用语言模型执行语义代码分析，评估代码意图和上下文以减少误报。它还采用基于指纹的问题抑制技术，在重复扫描周期中跟踪并忽略已接受的风险。 该工具通过针对公共安全数据库的依赖项扫描来涵盖软件供应链安全，并支持从本地目录、远程 URL 和仓库进行多源资产摄取。它以多种机器可读和人类可读的格式提供漏洞报告，以便集成到 CI/CD 流水线中。

Terser is a JavaScript minifier and compressor designed to reduce file size through whitespace removal, symbol mangling, and logic optimization for ES6+. It functions as a toolkit for minification, a code mangler for shortening variable and property names, and a dead code eliminator that evaluates constant expressions to remove unreachable logic. The project operates as an AST toolkit that parses JavaScript source into SpiderMonkey AST format for structural analysis. It generates source maps to link compressed production code back to the original source, ensuring that minified bundles remain

Chameleon is a cross-platform application framework and component library used to develop applications for the web and various mini-app platforms from a single shared codebase. It functions as a multi-platform build pipeline that compiles source code into different target formats while providing an MVVM-based user interface system for managing application state. The framework employs a polymorphic protocol to extend custom components and APIs, allowing for platform-specific implementations while maintaining cross-end compatibility. It includes a specialized build tool for static analysis that

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

Checkstyle is a Java static analysis tool and linter designed to identify and enforce coding standards and best practices. It functions as a code quality auditor and Javadoc validation tool, checking source code against configurable rulesets to ensure structural and stylistic consistency. The project allows for the creation of custom linting rules by extending a core API to inspect the abstract syntax tree. It further enables specialized validation through the use of XPath expressions to query the syntax tree for specific code patterns and violations. Capability areas include the enforcement

Soar is a suite of specialized tools designed for analyzing MySQL performance, advising on indexing, and optimizing SQL syntax. It functions as a performance analyzer, index advisor, and query optimizer to identify bottlenecks and suggest structural improvements for faster execution. The project distinguishes itself through a system for rewriting SQL statements into optimized equivalent versions using custom heuristic rules and patterns. It also features a dedicated index advisor that evaluates query patterns and database metadata to recommend the creation of new indexes. Its broader capabil

Travis CI is a continuous integration platform and CI/CD pipeline orchestrator that automates the testing and building of code changes from version control systems. It functions as a multi-language test runner and build infrastructure manager, ensuring software quality through automated testing across various programming languages and runtimes. The platform is distinguished by its use of virtual-machine-based isolation for reproducible environments and a configuration-driven approach to pipeline generation. It supports complex testing strategies through parallel matrix execution, allowing job