Top STATIC-ANALYSIS GitHub Repositories & Tools (2026)

Extra strict and opinionated rules for PHPStan

PHPUnit extensions and rules for PHPStan

💀 PHP unused code detection via PHPStan extension. Detects dead cycles, supports libs like Laravel, Symfony, Twig, Doctrine, PHPUnit etc. Can automatically remove dead PHP code. Able to detect dead code used only in tests. Finds unused methods, constants, properties and enum cases.

SonarQube extension for Visual Studio providing code quality and security feedback directly in the IDE

Regal is a linter and language server for Rego, bringing your policy development experience to the next level!

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

Jenkins Warnings Plugin - Next Generation

PHPStan rules to detect disallowed method & function calls, constant, namespace, attribute, keyword & superglobal usages, with powerful rules to re-allow a call or a usage in places where it should be allowed.

A new language server for Julia, enabling modern, compiler-powered tooling.

Deterministic, local-first memory and guardrails for AI coding agents with no LLM in the hot path.

SonarQube plugin for Eclipse providing code quality and security feedback directly in the IDE

CPAchecker, the Configurable Software-Verification Platform (read-only mirror)

A set of custom fixers for PHP CS Fixer

pg-index-health is an embeddable schema linter for PostgreSQL that detects common anti-patterns and promotes best practices.

The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to Semgrep Pro and CodeQL.

Static analysis and state mutation auditor specifically designed for FrankenPHP's Worker Mode.

A Static Analyzer for Java Powered by Machine Learning: Identifies Anti-Patterns Begging for Refactoring

The Eclipse Checkstyle plug-in integrates the Checkstyle Java code auditor into the Eclipse IDE. The plug-in provides real-time feedback to the user about violations of rules that check for coding style and possible error prone code constructs.

Program for determining types of files for Windows, Linux and MacOS.

PHP Static Analysis Tool - discover bugs in your code without running it!