SonarSource / sonarqube
Continuous Inspection
SonarSource / sonarqube
checkstyle / checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
Col-E / Recaf
The modern Java bytecode editor
google / error-prone
Catch common Java mistakes as compile-time errors
bethington / ghidra-mcp
Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.
pmd / pmd
An extensible multilanguage static code analyzer.
uber / NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
spotbugs / spotbugs
SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.
soot-oss / soot
Soot - A Java optimization framework
find-sec-bugs / find-sec-bugs
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
sanluan / PublicCMS
More than 2.7 million lines of code modification continuously iterated for 10 years to modernize java cms, easily supporting tens of millions of data, tens of millions of PV; Support static, server side includes; Currently has 0.0005% of the world's users (w3techs provided data), language support in Chinese, Japanese, English
INRIA / spoon
Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.
88250 / solo
🎸 B3log 分布式社区的 Java 博客端节点系统，欢迎加入下一代社区网络。B3log distributed community blog-end node based on Java, welcome to join the next generation community network.
secure-software-engineering / FlowDroid
FlowDroid Static Data Flow Tracker
SonarSource / sonar-java
:coffee: SonarSource Static Analyzer for Java Code Quality and Security
jspecify / jspecify
An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.
yegor256 / takes
True Object-Oriented Java Web Framework without NULLs, Static Methods, Annotations, and Mutable Objects
wala / WALA
T.J. Watson Libraries for Analysis, with front ends for Java, Android, and JavaScript, and many common static program analyses.
OWASP-Benchmark / BenchmarkJava
OWASP Benchmark is a test suite designed to verify the speed and accuracy of software vulnerability detection tools. A fully runnable web app written in Java, it supports analysis by Static (SAST), Dynamic (DAST), and Runtime (IAST) tools that support Java. The idea is that since it is fully runnable and all the vulnerabilities are actually exploitable, it’s a fair test for any kind of vulnerability detection tool. For more details on this project, please see the OWASP Benchmark Project home page.
soot-oss / SootUp
A new version of Soot with a completely overhauled architecture
SonarSource / sonarqube-mcp-server
Official SonarQube MCP Server for code quality and security in AI agents
refactorfirst / RefactorFirst
Identifies and prioritizes Class and Package Cycles and Anti-pattens in Java & Kotlin codebases you should refactor first.
Wizardtastic / Ecstatic
A hilariously optimized level of detail mod for low end (and high end) machines that retains vanilla performance
HebiRobotics / jfx-static-feature
—