Best Open Source static analysis Libraries
A curated list of the most popular GitHub repositories tagged with static analysis. Select any project to visualize its architecture and dive into the codebase using RepoMind's AI engine.
#1WerWolv/ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
#2astral-sh/ruff
An extremely fast Python linter and code formatter, written in Rust.
#3koalaman/shellcheck
ShellCheck, a static analysis tool for shell scripts
#4realm/SwiftLint
A tool to enforce Swift style and conventions.
#5nikic/PHP-Parser
A PHP parser written in PHP
#6facebook/infer
A static analyzer for Java, C, C++, and Objective-C
#7Konloch/bytecode-viewer
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
#8reviewdog/reviewdog
🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
#9checkstyle/checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
#10We5ter/Scanners-Box
A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑
#11securego/gosec
Go security checker
#12repowise-dev/repowise
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
#13fallow-rs/fallow
Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles: unused code, duplication, circular deps, complexity hotspots, architecture boundaries, design-system drift. Optional paid runtime layer (Fallow Runtime): hot-path review and cold-path deletion evidence from real production traffic.
#14bethington/ghidra-mcp
Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.
#15phpstan/phpstan-symfony
Symfony extension for PHPStan
#16phpstan/phpstan-strict-rules
Extra strict and opinionated rules for PHPStan
#17phpstan/phpstan-doctrine
Doctrine extensions for PHPStan
#18phpstan/phpstan-phpunit
PHPUnit extensions and rules for PHPStan
#19SonarSource/sonar-php
:elephant: SonarPHP: PHP static analyzer for SonarQube & SonarLint
#20aviatesk/JETLS.jl
A new language server for Julia, enabling modern, compiler-powered tooling.
#21fallow-rs/fallow-skills
Agent skills for fallow, codebase intelligence for TypeScript and JavaScript. Teaches AI agents how to find unused code, duplication, circular deps, complexity hotspots, architecture drift, design-system drift, and (with Fallow Runtime) hot-path and cold-path evidence. Works with Claude Code, Cursor, Codex, Gemini CLI, and 30+ agents.