SaaSHub helps you find the best software and product alternatives Learn more →
Top 11 Java static-code-analysis Projects
-
Checkstyle
Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard. By default it supports the Google Java Style Guide and Sun Code Conventions, but is highly configurable. It can be invoked with an ANT task and a command line program.
We had a list of suggested code formation tools, as my code was written in Java I decided to use suggested formatter GoogleJavaFormat. However, I didn't decide to pick suggested tool for Linter. I picked Checkstyle; for the reason, that SpotBugs wasn't available for JDK 22.
-
CodeRabbit
CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.
-
-
NullAway
A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead
Would be cool if Java got this feature, explicit optionality at a language level a la T? is an enormous developer QoL in Kotlin and Typescript in my experience. In Java there's tools like NullAway [1] but they're a hassle.
Language-level support is leagues better than Optional/Maybe in my experience too because it keeps the code focused on the actual logic instead of putting everything in a map/flatMap railway.
[1] https://github.com/uber/NullAway
-
Project mention: We Have Code Quality At Home: Open Source Java Code Quality Tools | dev.to | 2024-05-06
SpotBugs is an open source static anlysis tool. "SpotBugs uses static analysis to inspect Java bytecode for occurrences of bug patterns." This means that SpotBugs runs against the compiled source source code, rather than raw Java files. Because it analyses bytecode, it can catch some types of bugs that source code analysis would not catch.
-
-
-
Project mention: Show HN: FlowTracker – Track data flowing through Java programs | news.ycombinator.com | 2024-09-13
Last time I was this blown away was with jitwatch ( https://github.com/AdoptOpenJDK/jitwatch )
FlowTracker reminds me a little of taint analysis, which is used for tracking unvalidated user inputs or secrets through a program, making sure it is not leaked or used without validation.
search keywords are "dynamic taint tracking/analysis"
https://github.com/gmu-swe/phosphor
https://github.com/soot-oss/SootUp
https://github.com/feliam/klee-taint
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
-
-
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Java static-code-analysis discussion
Java static-code-analysis related posts
-
Análise Comparativa: Aider vs. PMD vs. Semgrep
-
Contribution Instructions: Formate Code and Linting
-
Show HN: FlowTracker – Track data flowing through Java programs
-
We Have Code Quality At Home: Open Source Java Code Quality Tools
-
Handling EI_EXPOSE_REP & EI_EXPOSE_REP2 👨🏻💻
-
PMD 7 Is Here
-
Amazon CodeGuru Reviewer: already time for retirement?
-
A note from our sponsor - SaaSHub
www.saashub.com | 17 Mar 2025
Index
What are some of the best open-source static-code-analysis projects in Java? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | Checkstyle | 8,511 |
| 2 | PMD | 5,002 |
| 3 | NullAway | 3,701 |
| 4 | Spotbugs | 3,601 |
| 5 | phpinspectionsea | 1,455 |
| 6 | SonarJava | 1,162 |
| 7 | SootUp | 656 |
| 8 | sonar-php | 399 |
| 9 | warnings-ng-plugin | 345 |
| 10 | forbidden-apis | 343 |
| 11 | fb-contrib | 158 |
Sponsored
CodeRabbit: AI Code Reviews for Developers
Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.
coderabbit.ai