static-analysis

A Ruby code quality reporter

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

💎 Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability

Flowistry is an IDE plugin for Rust that helps you focus on relevant code.

Real-time architectural sensor that helps AI agents close the feedback loop, enabling recursive self-improvement of code quality. Pure Rust.

A fast, feature-rich static code analyzer & language server for Python

Zero shot vulnerability discovery using LLMs

Work-in-progress tool to reverse unity's IL2CPP toolchain.

PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.

Mutation testing for Ruby. AI writes your code. AI writes your tests. But who tests the tests?

Manage translation and localization with static analysis, for Ruby i18n

All-in-One malware analysis tool.

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.

Linting tool for CloudFormation templates

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.

Software analytics tool that helps developers analyse and improve software quality.

CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.

Graph-powered code intelligence engine — indexes codebases into a knowledge graph, exposed via MCP tools for AI agents and a CLI for developers.