facebook / infer
A static analyzer for Java, C, C++, and Objective-C
facebook / infer
usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
realm / SwiftLint
A tool to enforce Swift style and conventions.
keploy / keploy
Open-source platform for creating safe, isolated production sandboxes for API, integration, and E2E testing.
analysis-tools-dev / static-analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
Kristories / awesome-guidelines
Programming style, best practices, and coding conventions.
SonarSource / sonarqube
Continuous Inspection
super-linter / super-linter
Combination of multiple linters to run as a GitHub Action or standalone
reviewdog / reviewdog
🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
checkstyle / checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
repowise-dev / repowise
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
lintsinghua / DeepAudit
DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。
facebook / pyrefly
A fast type checker and language server for Python
detekt / detekt
Static code analysis for Kotlin
kucherenko / jscpd
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
pylint-dev / pylint
It's not just a linter that annoys you!
pmd / pmd
An extensible multilanguage static code analyzer.
fallow-rs / fallow
Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.
simplecov-ruby / simplecov
Code coverage for Ruby with a powerful configuration library and automatic merging of coverage across test suites
phpro / grumphp
A PHP code-quality tool
crate-ci / typos
Source code spell checker
htmlhint / HTMLHint
⚙️ The static code analysis tool you need for your HTML
CyberStrikeus / CyberStrike
Open-source AI-powered offensive security harness for automated penetration testing.
qltysh / qlty
💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability
KhazP / vibe-coding-prompt-template
Templates and workflow for generating PRDs, Tech Designs, and MVP and more using LLMs for AI IDEs
wemake-services / wemake-python-styleguide
The strictest and most opinionated python linter ever!
tach-org / tach
A Python tool to visualize + enforce dependencies, using modular architecture 🌎 Open source 🐍 Installable via pip 🔧 Able to be adopted incrementally - ⚡ Implemented with no runtime impact ♾️ Interoperable with your existing systems 🦀 Written in rust
Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
oxsecurity / megalinter
🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or locally.
mattzcarey / shippie
extendable code review and QA agent 🚢
uber / piranha
A tool for refactoring code related to feature flag APIs
nizos / tdd-guard
Automated TDD enforcement for Claude Code
mbj / mutant
Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?
maxritter / pilot-shell
Professional context and harness engineering for Claude Code and OpenAI Codex. Build production-grade software with spec-driven development, TDD, persistent memory, quality gates, code intelligence, human oversight, and end-to-end verification.
the-open-engine / zeroshot
Open-source orchestration for coding agents. Define your own workflows, reviewers and repair loops. zeroshot enforces the process you configure.
sourcery-ai / sourcery
Instant AI code reviews
hyhmrright / brooks-lint
AI code reviews grounded in 12 classic engineering books — decay risk diagnostics with book citations, severity labels, and 6 analysis modes including full-sweep auto-fix
ehmicky / modern-errors
Handle errors in a simple, stable, consistent way
jakzal / phpqa
Docker image that provides static analysis tools for PHP
SonarSource / SonarJS
SonarSource Static Analyzer for JavaScript and TypeScript
DmytroLitvinov / awesome-flake8-extensions
:octocat: A curated awesome list of flake8 extensions. Feel free to contribute! :mortar_board:
modu-ai / moai-adk
Agentic development harness for Claude Code — SPEC-driven plan/run/sync, TRUST 5 quality gates, model+effort routing, and Claude×GLM multi-LLM cost control. Single Go binary, 16 languages, zero deps.
meziantou / Meziantou.Analyzer
A powerful C# Roslyn analyzer that uses static analysis to detect bugs, surface security issues, and enforce best practices—helping developers and AI write more reliable code.
protofire / solhint
Solhint is an open-source project to provide a linting utility for Solidity code.
PyCQA / flake8-bugbear
A plugin for Flake8 finding likely bugs and design problems in your program. Contains warnings that don't belong in pyflakes and pycodestyle.
maglnet / ComposerRequireChecker
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
data-prep-kit / data-prep-kit
Open source project for data preparation for GenAI applications
pdepend / pdepend
PHP_Depend is an adaptation of the established Java development tool JDepend. This tool shows you the quality of your design in terms of extensibility, reusability and maintainability.
SonarSource / sonar-dotnet
Code analyzer for C# and VB.NET projects
bencherdev / bencher
🐰 Bencher - Continuous Benchmarking
rohaquinlop / complexipy
Blazingly fast cognitive complexity analysis for Python, written in Rust.
duriantaco / skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
grodowski / undercover
undercover warns about methods, classes and blocks that were changed without tests, to help you easily find untested code and reduce the number of bugs. It does so by analysing data from git diffs, code structure and SimpleCov coverage reports
rafal-qa / slopo
Embedding-based discovery of duplicated logic for projects too large or messy to maintain reliably
openqodex / openqodex
Open source code review that runs in your coding agent before you push. Scanners plus a separate AI reviewer, on your own login, no key.
AmazingAng / old-coder
An old coder's strategy for the agent era: don't read the code — make it run the gauntlet. Evidence-first development skill for coding agents, inspired by Uncle Bob.
shinpr / claude-code-workflows
Development workflows for Claude Code that keep broad exploration focused on the outcome you approved.
scanaislop / aislop
Catch and fix the code-quality issues AI coding agents leave behind - dead code, unsafe casts, swallowed errors, duplication, security risks, and more. 50+ deterministic rules across 10 language targets, with CLI, CI, and GitHub Actions. No LLM at runtime. MIT.
econchick / interrogate
Explain yourself! Interrogate a codebase for docstring coverage.
SonarSource / sonarqube-mcp-server
Official SonarQube MCP Server for code quality and security in AI agents