Best Open Source static analysis Libraries

A curated list of the most popular GitHub repositories tagged with static analysis. Select any project to visualize its architecture and dive into the codebase using RepoMind's AI engine.

#1WerWolv/ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

52,890C++

Explore Repo

#2astral-sh/ruff

An extremely fast Python linter and code formatter, written in Rust.

46,319Rust

Explore Repo

#3koalaman/shellcheck

ShellCheck, a static analysis tool for shell scripts

39,122Haskell

Explore Repo

#4realm/SwiftLint

A tool to enforce Swift style and conventions.

19,498Swift

Explore Repo

#5nikic/PHP-Parser

A PHP parser written in PHP

17,427PHP

Explore Repo

#6facebook/infer

A static analyzer for Java, C, C++, and Objective-C

15,542OCaml

Explore Repo

#7Konloch/bytecode-viewer

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

15,449Java

Explore Repo

#8PHP-CS-Fixer/PHP-CS-Fixer

A tool to automatically fix PHP Coding Standards issues

13,559PHP

Explore Repo

#9reviewdog/reviewdog

🐶 Automated code review tool integrated with any code analysis tools regardless of programming language

9,150Go

Explore Repo

#10checkstyle/checkstyle

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.

8,891Java

Explore Repo

#11We5ter/Scanners-Box

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

8,861

Explore Repo

#12securego/gosec

Go security checker

8,723Go

Explore Repo

#13repowise-dev/repowise

Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.

7,152Python

Explore Repo

#14vimeo/psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

5,897PHP

Explore Repo

#15fallow-rs/fallow

Codebase intelligence for TypeScript and JavaScript. Health, complexity hotspots, duplication, architecture boundaries, circular dependencies, design-system drift, and unused code, from one graph. CLI, GitHub Action, LSP, MCP, and VS Code. Rust, MIT licensed.

5,002Rust

Explore Repo

#16bethington/ghidra-mcp

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

4,229Java

Explore Repo