SonarSource / sonarqube

Continuous Inspection

Col-E / Recaf

The modern Java bytecode editor

uber / NullAway

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

SonarSource / sonar-java

:coffee: SonarSource Static Analyzer for Java Code Quality and Security

checkstyle / checkstyle

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.

google / error-prone

Catch common Java mistakes as compile-time errors

pmd / pmd

An extensible multilanguage static code analyzer.

spotbugs / spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

soot-oss / soot

Soot - A Java optimization framework

find-sec-bugs / find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

INRIA / spoon

Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.

secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker

jspecify / jspecify

An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.

wala / WALA

T.J. Watson Libraries for Analysis, with front ends for Java, Android, and JavaScript, and many common static program analyses.

soot-oss / SootUp

A new version of Soot with a completely overhauled architecture

SonarSource / sonarqube-mcp-server

Official SonarQube MCP Server for code quality and security in AI agents

refactorfirst / RefactorFirst

Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.