static-analysis

An extremely fast Python linter and code formatter, written in Rust.

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

A tool to enforce Swift style and conventions.

A PHP parser written in PHP

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

PHP Static Analysis Tool - discover bugs in your code without running it!

A tool to automatically fix PHP Coding Standards issues

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

A vulnerability scanner for container images and filesystems

Program for determining types of files for Windows, Linux and MacOS.

Vulnerability Static Analysis for Containers

Continuous Inspection

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.

Go security checker