Top Static Analysis repositories

Biggest movers this week

git clone https://github.com/zizmorcore/zizmor.git

git clone https://github.com/Verlintas/NOIR.git

git clone https://github.com/repowise-dev/repowise.git

git clone https://github.com/kucherenko/jscpd.git

git clone https://github.com/sverweij/dependency-cruiser.git

git clone https://github.com/anchore/grype.git

Top 44 on the Elo ladder

1. #542
   astral-sh/ruff

   An extremely fast Python linter and code formatter, written in Rust.

   • Diamond IV

   1,960 Elo −6051.2kRust
2. #756
   WerWolv/ImHex

   🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

   • Emerald I

   1,904 Elo −2155.8kC++
3. #883
   tirth8205/code-review-graph

   Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read…

   • Emerald I

   1,878 Elo −532.7kPython
4. #1,062
   semgrep/semgrep

   Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

   • Emerald II

   1,846 Elo +4617.6kC
5. #1,263
   MobSF/Mobile-Security-Framework-MobSF

   Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing…

   • Emerald III

   1,818 Elo −1922.2kPython
6. #1,480
   koalaman/shellcheck

   ShellCheck, a static analysis tool for shell scripts

   • Emerald IV

   1,787 Elo +240.3kHaskell
7. #2,121
   ast-grep/ast-grep

   ⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

   • Platinum II

   1,714 Elo +3016.5kRust
8. #2,532
   anchore/grype

   A vulnerability scanner for container images and filesystems

   • Platinum III

   1,673 Elo +5113.2kGo
9. #2,777
   rshipp/awesome-malware-analysis

   Defund the Police.

   • Platinum IV

   1,654 Elo +1914.4k
10. #2,811
    horsicq/Detect-It-Easy

    Program for determining types of files for Windows, Linux and MacOS.

    • Platinum IV

    1,651 Elo +311.9kJavaScript
11. #2,935
    OWASP/mastg

    The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing…

    • Platinum V

    1,642 Elo +2113.3kPython
12. #2,954
    checkstyle/checkstyle

    Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it…

    • Platinum V

    1,640 Elo +359.6kJava
13. #3,067
    anchore/syft

    CLI tool and library for generating a Software Bill of Materials from container images and filesystems

    • Platinum V

    1,632 Elo +459.8kGo
14. #3,075
    repowise-dev/repowise

    Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection…

    • Platinum V

    1,631 Elo +838.1kPython
15. #3,435
    analysis-tools-dev/static-analysis

    ⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools…

    • Gold I

    1,609 Elo +2214.9kRust
16. #3,575
    zizmorcore/zizmor

    Static analysis for GitHub Actions (and more)

    • Gold II

    1,600 Elo +1087kRust
17. #3,579
    realm/SwiftLint

    A tool to enforce Swift style and conventions.

    • Gold II

    1,600 Elo −1219.7kSwift
18. #3,666
    SonarSource/sonarqube

    Continuous Inspection

    • Gold II

    1,594 Elo −1611.1kJava
19. #4,006
    meta/infer

    A static analyzer for Java, C, C++, and Objective-C

    • Gold III

    1,573 Elo −415.7kOCaml
20. #4,249
    bridgecrewio/checkov

    Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images…

    • Gold III

    1,559 Elo +209.1kPython
21. #4,448
    nikic/PHP-Parser

    A PHP parser written in PHP

    • Gold IV

    1,548 Elo −1517.4kPHP
22. #4,627
    Konloch/bytecode-viewer

    A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

    • Gold IV

    1,538 Elo −1215.7kJava
23. #5,245
    PHP-CS-Fixer/PHP-CS-Fixer

    A tool to automatically fix PHP Coding Standards issues

    • Silver I

    1,508 Elo −913.5kPHP
24. #5,401
    hadolint/hadolint

    Dockerfile linter, validate inline bash, written in Haskell

    • Silver I

    1,501 Elo +3112.5kHaskell
25. #5,417
    ttroy50/cmake-examples

    Useful CMake Examples

    • Silver II

    1,500 Elo −913kCMake
26. #5,581
    phpstan/phpstan

    PHP Static Analysis Tool - discover bugs in your code without running it!

    • Silver II

    1,493 Elo −1314.1kPHP
27. #5,831
    sverweij/dependency-cruiser

    Validate and visualize dependencies. Your rules. JavaScript, TypeScript, CoffeeScript. ES6, CommonJS, AMD.

    • Silver III

    1,481 Elo +617.4kJavaScript
28. #5,986
    kucherenko/jscpd

    Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server…

    • Silver III

    1,474 Elo +736.5kRust
29. #6,220
    reviewdog/reviewdog

    🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

    • Silver III

    1,464 Elo +269.7kGo
30. #6,444
    quay/clair

    Vulnerability Static Analysis for Containers

    • Silver IV

    1,455 Elo −511kGo
31. #6,602
    securego/gosec

    Go security checker

    • Silver IV

    1,448 Elo +139kGo
32. #7,172
    crytic/slither

    Static Analyzer for Solidity and Vyper

    • Bronze I

    1,426 Elo +66.4kPython
33. #7,329
    squizlabs/PHP_CodeSniffer

    PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

    • Bronze I

    1,420 Elo −3510.7kPHP
34. #7,483
    cppcheck-opensource/cppcheck

    static analysis of C/C++ code

    • Bronze II

    1,414 Elo +226.7kC++
35. #7,650
    detekt/detekt

    Static code analysis for Kotlin

    • Bronze II

    1,409 Elo +377.1kKotlin
36. #7,947
    dwisiswant0/apkleaks

    Scanning APK file for URIs, endpoints & secrets.

    • Bronze III

    1,398 Elo +446.3kPython
37. #8,026
    google/error-prone

    Catch common Java mistakes as compile-time errors

    • Bronze III

    1,394 Elo +257.2kJava
38. #8,069
    Col-E/Recaf

    The modern Java bytecode editor

    • Bronze III

    1,393 Elo +467.4kJava
39. #8,951
    dominikh/go-tools

    Staticcheck - The advanced Go linter

    • Copper I

    1,353 Elo −46.9kGo
40. #9,047
    presidentbeef/brakeman

    A static analysis security vulnerability scanner for Ruby on Rails applications

    • Copper I

    1,347 Elo −177.2kRuby
41. #9,127
    aquasecurity/tfsec

    Tfsec is now part of Trivy

    • Copper I

    1,343 Elo +67kGo
42. #9,630
    meta/pyre-check

    Performant type-checking for python.

    • Copper III

    1,303 Elo −117.1kOCaml
43. #9,878
    ondrajz/go-callvis

    Visualize call graph of a Go program using Graphviz

    • Copper IV

    1,251 Elo −176.5kGo
44. #9,977
    Verlintas/NOIR

    手机隐私审计：用 adb 扫出 Android 应用的权限、上报端点与数据流向，并给出可回滚的处置。Desktop Android leak audit: permissions, endpoints, data flows…

    • Copper IV

    1,098 Elo +903.5kKotlin