Best Static Analysis & Linters GitHub Repositories

An agent-first linter for Tailwind design systems. Write design system rules that agents can verify.

textlint is the pluggable linter for natural language text.

Soot - A Java optimization framework

Interactive architecture diagrams for codebases

Extremely fast tool to remove duplicates and other lint from your filesystem

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

Find leaked secrets everywhere.

Manage translation and localization with static analysis, for Ruby i18n

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

Next-gen phpDoc parser with support for intersection types and generics

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

FlowDroid Static Data Flow Tracker

A powerful C# Roslyn analyzer that uses static analysis to detect bugs, surface security issues, and enforce best practices—helping developers and AI write more reliable code.

An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.

vacuum is the worlds fastest and most versatile OpenAPI, Arazzo, AsyncAPI & JSON Schema linter, docs generator and toolkit. It tears through API specs at light speed. 100% compatible with Spectral rulesets, and OpenAPI 3.0, 3.1 and 3.2

Protect against malicious open source packages 🤖

Code quality analysis for Python in the age of AI coding.