Static Analysis GitHub Repositories (2026) · Open Source Tools

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

Analyze Rust crates without touching compiler internals

Go security checker

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Continuous Inspection

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

It's not just a linter that annoys you!

A tool to enforce Swift style and conventions.

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

An opinionated, curated list of tools for enforcing software development standards: one recommended tool per job, with limits.

A tool to automatically fix PHP Coding Standards issues

An artifact of fully-specified annotations to power static-analysis checks, beginning with nullness analysis.

A new version of Soot with a completely overhauled architecture

A powerful C# Roslyn analyzer that uses static analysis to detect bugs, surface security issues, and enforce best practices—helping developers and AI write more reliable code.

FlowDroid Static Data Flow Tracker

Regal is a linter and language server for Rego, bringing your policy development experience to the next level!

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

Static analysis for GitHub Actions (and more)