All repos — GH Trending Explorer

Reverse engineer anything with agents, from app behavior down to native binaries.

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

dll decryptor — dumps encrypted DLL payloads, resolves imports, rebuilds PE headers, exports or memory-maps the decrypted module

koalaman / shellcheck

ShellCheck, a static analysis tool for shell scripts

JoasASantos / Malvex

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

hadolint / hadolint

Dockerfile linter, validate inline bash, written in Haskell

facebook / infer

A static analyzer for Java, C, C++, and Objective-C

astral-sh / ruff

An extremely fast Python linter and code formatter, written in Rust.

tirth8205 / code-review-graph

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

realm / SwiftLint

A tool to enforce Swift style and conventions.

nikic / PHP-Parser

A PHP parser written in PHP

semgrep / semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

ast-grep / ast-grep

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

analysis-tools-dev / static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

phpstan / phpstan

PHP Static Analysis Tool - discover bugs in your code without running it!

PHP-CS-Fixer / PHP-CS-Fixer

A tool to automatically fix PHP Coding Standards issues

OWASP / mastg

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

anchore / grype

A vulnerability scanner for container images and filesystems

horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

SonarSource / sonarqube

Continuous Inspection

quay / clair

Vulnerability Static Analysis for Containers

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

reviewdog / reviewdog

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

checkstyle / checkstyle

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.

bridgecrewio / checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

securego / gosec

Go security checker

repowise-dev / repowise

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

Col-E / Recaf

The modern Java bytecode editor

sverweij / dependency-cruiser

Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.

presidentbeef / brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications

google / error-prone

Catch common Java mistakes as compile-time errors

detekt / detekt

Static code analysis for Kotlin

dominikh / go-tools

Staticcheck - The advanced Go linter

cppcheck-opensource / cppcheck

static analysis of C/C++ code

zizmorcore / zizmor

Static analysis for GitHub Actions (and more)

kucherenko / jscpd

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

crytic / slither

Static Analyzer for Solidity and Vyper

dsherret / ts-morph

TypeScript Compiler API wrapper for static analysis and programmatic code changes.

davidhalter / jedi

Awesome autocompletion, static analysis and refactoring library for python

vimeo / psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

bethington / ghidra-mcp

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

pylint-dev / pylint

It's not just a linter that annoys you!

phan / phan

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

revive-lint / revive

🔥 Fast, strict, configurable, extensible, and beautiful linter for Go

pmd / pmd

An extensible multilanguage static code analyzer.

rrrene / credo

A static code analysis tool for the Elixir language with a focus on code consistency and teaching.

fallow-rs / fallow

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

nikolaydubina / go-recipes

🦩 Tools for Go projects

vuejs / eslint-plugin-vue

Official ESLint plugin for Vue.js

orhun / binsider

Analyze ELF binaries like a boss 😼🕵️‍♂️

troessner / reek

Code smell detector for Ruby

uber / NullAway

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

spotbugs / spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

uber-go / nilaway

Static analysis tool to detect potential nil panics in Go code

PyCQA / flake8

flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.

stackrox / kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.

carthage-software / mago

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

whitesmith / rubycritic

A Ruby code quality reporter

shivammathur / setup-php

GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and various tools.