-
zizmor
Static analysis for GitHub Actions
-
fallow-mcp
MCP server for the fallow JavaScript/TypeScript codebase analyzer
-
inspequte
Fast, CLI-first static analysis for JVM class and JAR files
-
fallow-config
Configuration types for the fallow JavaScript/TypeScript codebase analyzer
-
ra_ap_load-cargo
Loads a Cargo project into a static instance of rust-analyzer for analysis
-
sprocket
A command line tool for working with Workflow Description Language (WDL) documents
-
mago-type-syntax
core utilities useful for building lexers and parsers within Mago
-
fallow-cli
CLI for the fallow JavaScript/TypeScript codebase analyzer
-
hotspots-cli
Static analysis CLI for TypeScript, JavaScript, Go, Python, Rust, and Java that computes Local Risk Score (LRS)
-
ucm-cli
CLI tool for UCM impact analysis on codebases
-
veracode-platform
A comprehensive Rust client library for the Veracode platform (Applications, Identity, Pipeline Scan, Sandbox)
-
mcplint-cli
Compiler-style static security analyzer for MCP (Model Context Protocol) configurations
-
nyx-scanner
A CLI security scanner for automating vulnerability checks
-
momoa
A JSON parsing library suitable for static analysis
-
cargo-cola
Security static analyzer for Rust. Analyzes MIR to detect vulnerabilities. (Requires nightly)
-
exspec
Static analyzer for test design quality -- verifies tests function as executable specifications
-
rapx
A static analysis platform for use-after-free, memory leakage detection, etc
-
semwave
Static analysis tool for semver bump propagation in Cargo workspaces
-
rubyfast
An ultra-fast Ruby performance linter rewritten in Rust — detects 19 common anti-patterns
-
srb-lens
Static analysis tool for Sorbet-typed Ruby projects — extracts method signatures, call graphs, and type information from Sorbet's CFG, symbol table, and parse tree
-
fallow-graph
Module graph construction, resolution, and project state for the fallow JavaScript/TypeScript codebase analyzer
-
rma-lsp
Language Server Protocol implementation for Qryon - provides IDE integration for security analysis
-
fallow-core
Core analysis engine for the fallow JavaScript/TypeScript codebase analyzer
-
rusty-cpp
A Rust-based static analyzer that applies Rust's ownership and borrowing rules to C++ code
-
infr
A gradually typed superset of R
-
dupast
Fast code duplication detector with Cargo-like ergonomics
-
mad-useful
A multi-tool utility for file operations and text processing
-
cargo-check-external-types
Static analysis tool to detect external types exposed in a library's public API
-
ucm-api
HTTP API server for UCM graph queries and event ingestion
-
octofhir-fhirpath-analyzer
FHIRPath static analysis and type-enriched AST engine with semantic validation
-
shinchan
Checks if a GitHub repo is code or just aura
-
fta
Fast TypeScript Analyzer
-
ucm-ingest
Data ingestion adapters for UCM (Git, Jira, Linear, code parsing)
-
fallow-extract
Parsing and extraction engine for the fallow JavaScript/TypeScript codebase analyzer
-
decy
CLI tool for C-to-Rust transpilation with EXTREME quality standards
-
of-vscode-project-generator-rs
openFrameworks VSCode Project Generator (for static analysis only)
-
lol-lint
A strict, unapologetic linter for LOLCODE
-
hotspots-core
Core library for static analysis and Local Risk Score (LRS) computation across TypeScript, JavaScript, Go, Python, Rust, and Java
-
boundary
A static analysis tool for evaluating DDD and Hexagonal Architecture
-
intent
Static analysis tool for the Intent design constraint language — machine-verifiable architectural constraints for codebases
-
vibecheck-core
Detect AI-generated code and attribute it to Claude, GPT, Gemini, Copilot, or Human
-
cargo_pup
architectural linting tool that integrates with rustc to enforce architectural patterns and boundaries
-
ucm-events
Event sourcing and projection layer for UCM graphs
-
rma-cli
Qryon - Ultra-fast code intelligence and security analyzer for polyglot projects
-
fallow-types
Shared types for the fallow JavaScript/TypeScript codebase analyzer
-
prevail
eBPF Verifier using Abstract Interpretation
-
cargo-perf
Preventive performance analysis for Rust - catch anti-patterns before production
-
garbage-code-hunter
A humorous Rust code quality detector that roasts your garbage code
-
chelonian
Static analyzer for ROS workspaces
-
ucm-graph-core
Core graph types and entity model for the UCM impact-analysis engine
-
cargo-lint-extra
Configurable, extensible linting rules for Rust projects beyond rustfmt and Clippy
-
ucm-observe
Observability and tracing hooks for UCM event streams
-
pylyzer
A static code analyzer & language server for Python
-
repotoire
Graph-powered code analysis CLI. 99 detectors for security, architecture, and code quality.
-
cargo-fa
Static analysis tool for framealloc - detect memory intent violations before runtime
-
decy-codegen
Rust code generation from HIR with minimal unsafe blocks
-
ruchyruchy
JIT Compiler + Advanced Debugging Tools - Cranelift-based JIT with mixed-mode execution, eBPF syscall tracing, statistical profiling, 10 quality tools, automated bug detection, 95%+ detection rate…
-
thread
A safe, fast, flexible code analysis and parsing library built in Rust. High-level entry point for the Thread ecosystem.
-
ratchets
Progressive lint enforcement tool with budgeted violations that can only decrease over time
-
gdeye
Static analysis tool and library for GDScript
-
srb-lens-cli
CLI for srb-lens — query Sorbet type information from Ruby projects
-
debtmap
Code complexity and technical debt analyzer
-
mlua-check
Lua checker on mlua — undefined variable/global/field detection with LuaCats support
-
loctree
Structural code intelligence for AI agents. Scan once, query everything.
-
ucm-reason
Bayesian impact analysis and intent reasoning for UCM graphs
-
decy-parser
C AST parsing using clang-sys for Decy transpiler
-
rust-guardian
Dynamic code quality enforcement preventing incomplete or placeholder code
-
decy-ownership
Ownership and lifetime inference for C-to-Rust conversion (CRITICAL)
-
lynx_eye
A code complexity analyzer for JavaScript, TypeScript, and Rust using tree-sitter. Calculates NLOC, CCN, token count, and complexity scores.
-
mir-extractor
MIR extraction and security rule engine for Rust-cola. (Requires nightly)
-
sqlsurge-core
Core library for SQL static analysis against schema definitions
-
decy-hir
High-level Intermediate Representation for C-to-Rust transpilation
-
dei
Static analysis tool for detecting god classes and god methods
-
cargo-memlense
Static analysis tool for memkit - detect memory issues before runtime
-
rustd_cli
Command-line interface for RustD compiler
-
flowistry
Modular information flow analysis
-
rma-analyzer
Code analysis and security scanning for Qryon
-
decy-verify
Safety property verification for transpiled Rust code
-
brrr-lint
A fast linter and language server for F* (FStar) with autofix capabilities
-
plceye
PLC code smell detector and static analyzer for L5X and PLCopen files
-
foch
Paradox mod static analysis toolkit with CLI and EU4-focused language tooling
-
shapels
Shape inference for torch on your editor
-
convex-doctor
Diagnose your Convex backend for anti-patterns, security issues, and performance problems
-
cipherscope
A high-performance, language-aware tool for scanning source code to detect cryptographic libraries and algorithms usage
-
oxidescan
A fast, human-friendly Rust code health checker that runs in seconds and tells you what’s risky, what’s slow, and what’s messy—so you can ship with confidence
-
sqlsurge-cli
CLI tool for SQL static analysis against schema definitions
-
codesize
Report code size violations by file and function
-
decy-stdlib
C standard library prototypes for the Decy C-to-Rust transpiler
-
sarif_rust
A comprehensive Rust library for parsing, generating, and manipulating SARIF (Static Analysis Results Interchange Format) v2.1.0 files
-
searchdeadcode
A fast CLI tool to detect and remove dead/unused code in Android projects (Kotlin & Java)
-
oxilean-lint
OxiLean linter - Static analysis and lint rules
-
bappy-script
Gankra's toy compiler
-
proteus-engine
Advanced zero-day static analysis engine built with Rust and Python
-
decy-analyzer
Static analysis and type inference for C code
-
cargo-capsec
Static capability audit for Rust — find out what your code can do to the outside world
-
py2erg
A Python -> Erg converter
-
boltffi_verify
Static analysis and verification for BoltFFI generated bindings
-
aws-fully-qualified-names
For extracting def use statements from code
-
context-footprint
A static analysis tool for measuring architectural context exposure in codebases
-
swiftsc-cli
Command-line interface for SwiftSC-Lang compiler
-
scoper
A TypeScript code analyzer using the OXC parser
-
decy-agent
Background daemon for incremental transpilation and watching
-
neural-complexity
Code complexity analyzer for Python and TypeScript using cyclomatic and cognitive complexity metrics
-
decy-repo
GitHub repository transpilation with parallel processing
-
tethys
Code intelligence cache and query interface
-
decy-book
Book-based verification for transpiled Rust code
-
thread-services
Service layer interfaces for Thread
-
masterror-template
Template utilities for masterror and its derive macros
-
diedeadcode
Conservative TypeScript dead code detection with transitive analysis and confidence scoring
-
decy-mcp
MCP server for Claude Code integration
-
issun-analyzer
Static analysis tools for ISSUN game framework code
-
flowistry_ide
Information Flow in the IDE for Rust
-
sparta
software components specially designed for building high-performance static analyzers based on the theory of Abstract Interpretation
-
omnitype
A hybrid type checker for Python and other dynamic languages
-
sunshiner
Cross-language dead code finder for Python, TypeScript, and Rust
-
tinymist-analysis
Typst Static Analyzers for Tinymist
-
qlty-llm
Code quality toolkit
-
chandeliers-san
AST definition and static analysis procedures of Candle
-
circomspect
A static analyzer and linter for the Circom zero-knowledge DSL
-
qlty-types
Code quality toolkit
-
go-analyzer
A high-performance Language Server Protocol (LSP) implementation for Go code analysis, providing real-time variable lifecycle tracking and data race detection
-
pydeadcode
Fast Python dead code finder, built in Rust
-
veriwasm
A safety verifier for native-compiled WebAssembly code
-
qlty-analysis
Code quality toolkit
-
am_list
A tree-sitter-powered command line tool to list functions marked with Autometrics annotations
-
cpg-rs
working with Code Property Graphs (CPG)
-
qlty-test-utilities
Code quality toolkit
-
arch-lint-rules
Built-in lint rules for arch-lint
-
qlty-config
Code quality toolkit
-
mirsa
rust mir static analysis
-
qlty-smells
Code quality toolkit
-
qlty-cloud
Code quality toolkit
-
oalacea-lumen-analysis
Analysis engine for Oalacea Lumen - static analysis, diff, and history tracking
-
chandeliers-syn
Syntax of the Lustre language, to be parsed by procedural macros
-
kotoba-linter
Kotoba Code Linter - Static analysis tool for .kotoba files
-
vuln-reach
Code reachability path analysis
-
decy-debugger
Interactive debugger for Decy C-to-Rust transpiler with spydecy integration
-
decy-core
Core transpilation pipeline for C-to-Rust conversion
-
binsec
Swiss Army Knife for Binary (In)Security
-
autoken
A rust-lang static analysis tool to automatically check for runtime borrow violations
-
cargo-typesize
Cargo extension to list size of all types in a crate
-
pylyzer_core
pylyzer core
-
arch-lint-core
Core framework for architecture linting - traits, types, and analyzer
-
cargo-recon
Enumerate viable fuzzing targets in Rust code
-
sfink_callgraph_traversal
Experimental callgraph traversal/analysis tool, currently limited to loading an internal format produced by a static analysis
-
cargo-powdr
CLI to create, manage and run powdrVM projects
-
sentri-cli
Sentri: multi-chain smart contract security analyzer with static analysis, invariant checking, and vulnerability detection for Solana, EVM, and Move programs
-
shadowhare
Production-grade static analyzer for Cairo/Starknet smart contracts
-
crown-annotation
Annotations that are useful for the static analyser Crown
-
riscv_analysis_cli
RISC-V static analysis tool -- CLI
-
dei-core
Core types and traits for DEI static analysis tool
-
binary-serialize-derive
A small representation for objects in the Ezno checker, used for caching to make checking faster
-
riscv_analysis
RISC-V static analysis tools
-
swiftsc-analyzer
Static analysis tools for SwiftSC-Lang
-
qlty-coverage
Code quality toolkit
-
autoken-rustc
A rust-lang static analysis tool to automatically check for runtime borrow violations
-
arch-lint-macros
Procedural macros for arch-lint rule definitions
-
code-blocks-server
re-order your code
-
surrealguard-core
Core static analysis logic for SurrealGuard's powerful type inference
-
drake
A tree-sitter based codebase dependency explorer
-
sentri-analyzer-move
Sentri: Move language analyzer with static analysis and invariant checking for Aptos and other Move-based networks
-
staticrypt_macros
Macros for the
staticryptcrate -
sentri-analyzer-evm
Sentri: EVM smart contract analyzer with static analysis and invariant checking for Ethereum, Polygon, and other EVM chains
-
safepkt-backend
A backend to run static analysis tools against rust-based programs
-
stagraph
A graph-based static timing analysis (GB-STA) engine
-
sparta-proc-macros
Rust proc macros
-
riscv_analysis_lsp
RISC-V static analysis tool -- LSP helpers
-
libvex-sys
Basic wrapper around libVEX from Valgrind - source included in the crate, based on trailofbits' static analysis fork
-
vsec
Detect secrets and in Rust codebases
Try searching with DuckDuckGo.