SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Python Static Analysis Projects
-
code-review-graph
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Project mention: Put code-review-graph Behind a Read-Only MCP Boundary Before Connecting Your Repository | dev.to | 2026-07-21code-review-graph is trending because it promises a useful trade: build a persistent local map of a codebase so an AI reviewer reads relevant context instead of ingesting the whole repository. The repository is MIT-licensed and exposes MCP and CLI interfaces.
-
AppSignal
Monitoring that respects your time & budget. APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
-
mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
-
checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
# See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v5.0.0 hooks: - id: end-of-file-fixer - id: check-merge-conflict - id: trailing-whitespace args: [--markdown-linebreak-ext=md] - id: check-shebang-scripts-are-executable # YAML - id: check-yaml # Cross platform - id: check-case-conflict # checks for files that would conflict in case-insensitive filesystems. - id: mixed-line-ending # replaces or checks mixed line ending. args: [--fix=lf] - repo: https://github.com/antonbabenko/pre-commit-terraform # Ensure the PRE_COMMIT_TERRAFORM_VERSION value is the same in .gitlab-ci.yml rev: v1.105.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt - id: terraform_docs args: ["--args=--lockfile=false"] - id: terraform_tflint - id: terraform_checkov args: - --args=--framework=terraform - --args=--soft-fail - --args=--config-file=__GIT_WORKING_DIR__/.checkov.yaml - --args=--skip-path=__GIT_WORKING_DIR__/.cache/pre-commit - repo: https://github.com/bridgecrewio/checkov.git rev: 3.2.524 hooks: - id: checkov_secrets args: [--directory, ., --framework, secrets, --config-file, .checkov.yaml, --skip-path, .cache/pre-commit] pass_filenames: false - repo: https://github.com/hashicorp/copywrite rev: v0.25.3 hooks: - id: add-headers
-
Older tools still matter inside AI Smart Contract Review. Slither describes itself as a static-analysis framework for Solidity and Vyper, with vulnerability detectors, confidence/impact categories, CI integration, and checklist output.
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
Project mention: Fired by Google for Creating the Google Workspace CLI | news.ycombinator.com | 2026-06-23
This is clearly something done in official capacity, during working hours, with the knowledge and support of his manager, who announced the CLI.
It says "This is not an officially supported Google product" because it's a DevRel sample/experiment, just like dozens of other Google repositories made by Google employees as part of their job.
Even some other tools in github.com/google have as much: https://github.com/google/python-fire / https://github.com/google/pytype/blob/main/docs/index.md / https://github.com/google/dopamine / https://github.com/google/go-tika
-
Flake8
flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.
Project mention: How to Set Up Pre-Commit Hooks for Teams Using AI Coding Assistants | dev.to | 2026-04-19 -
ghidra-mcp
Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.
Project mention: MCP's Dark Secret: 5 Hidden Patterns Nobody Teaches You About Context Window Optimization | dev.to | 2026-04-30# Lazy-loading MCP: Only activate server when actually needed # Inspired by GhidraMCP's lazy tool loading pattern # https://github.com/bethington/ghidra-mcp class LazyMCPLoader: def __init__(self, server_registry: dict): # Server registry stores metadata, NOT active connections self.server_registry = server_registry self.active_servers = {} async def invoke(self, tool_name: str, params: dict): server_name = self._resolve_server(tool_name) # Lazy initialization — server starts only on first use if server_name not in self.active_servers: print(f"🔌 Lazy-loading MCP server: {server_name}") self.active_servers[server_name] = await self._start_server( self.server_registry[server_name] ) return await self.active_servers[server_name].invoke(tool_name, params) async def invoke_batch(self, tools: list): """Pre-warm servers for tools likely to be used together""" servers_needed = {self._resolve_server(t['tool']) for t in tools} for srv in servers_needed: if srv not in self.active_servers: self.active_servers[srv] = await self._start_server( self.server_registry[srv] ) # Now all servers are pre-warmed for parallel execution return await asyncio.gather(*[ self.active_servers[self._resolve_server(t['tool'])].invoke(t['tool'], t['params']) for t in tools ]) # Register servers — this is ALL that loads into context at startup # 500 bytes vs 50,000 bytes of tool definitions SERVER_REGISTRY = { "github": {"host": "localhost", "port": 3100, "tools": 23}, "filesystem": {"host": "localhost", "port": 3101, "tools": 8}, "ghidra": {"host": "localhost", "port": 3102, "tools": 110}, # Lazy loaded }
-
-
codechecker
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
-
Project mention: Show HN: Building the Cursor UI selector but for back end | news.ycombinator.com | 2025-10-31
Cursor 2.0 showed how now you can drag context for your agent directly from the UI, I think this is awesome way to interact with generated code, as you don' really need to understand all details for a vibe coding session.
This is why we've been building CodeBoarding - visualizing your codebase with a diagram so you can quickly understand and navigate the codebase. Now you can just copy a component and paste it as context for your agent so it knows where to work. The analysis agent for the diagram creation is open-source you can find it here: https://github.com/CodeBoarding/CodeBoarding
I would love to hear your opinion on vibe coding for larger projects, how do you navigate the context selection? Further what kind of guardlines are you using, we are thinking of adding guardrail which makes most of the files readonly so your agent (cursor, claude code, etc.) cannot delete/edit them.
Looking forward to chatting with you all,
-
-
-
-
dagda
a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
-
Awesome-LLMs-for-Vulnerability-Detection
The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.
AI-powered vulnerability detection uses ML models trained on CVE databases and CWE patterns to identify insecure code patterns in real-time during code review. Same technology, applied defensively.
-
mobsfscan
mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
-
packj
Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
Project mention: Packj flags malicious/risky open-source packages | news.ycombinator.com | 2026-05-22 -
prometeo
An experimental Python-to-C transpiler and domain specific language for embedded high-performance computing
-
privado
Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Python Static Analysis discussion
Python Static Analysis related posts
-
Reactive Python Notebooks in Jupyter
-
Catching Cloud Misconfigurations Before They Ship: SAST for Terraform with Checkov
-
Applying SAST to Infrastructure as Code: Scanning Terraform with Checkov
-
Your Infrastructure Has Bugs Too: Scanning Terraform with Checkov (IaC SAST)
-
Show HN: CLI tool for detecting non-exact code duplication with embedding models
-
Four Performance Bugs AI Coders Introduce Every Day
-
Show HN: Diplomat-agent scan Python MCP servers for unguarded tool calls
-
A note from our sponsor - SaaSHub
www.saashub.com | 7 Aug 2026
Index
What are some of the best open-source Static Analysis projects in Python? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | code-review-graph | 28,990 |
| 2 | mastg | 13,091 |
| 3 | checkov | 8,917 |
| 4 | slither | 6,330 |
| 5 | apkleaks | 6,191 |
| 6 | jedi | 6,169 |
| 7 | Pylint | 5,709 |
| 8 | pytype | 5,029 |
| 9 | Flake8 | 3,810 |
| 10 | ghidra-mcp | 3,209 |
| 11 | vulnhuntr | 2,726 |
| 12 | codechecker | 2,592 |
| 13 | CodeBoarding | 2,367 |
| 14 | pyt | 2,203 |
| 15 | CrossHair | 1,311 |
| 16 | ipyflow | 1,274 |
| 17 | dagda | 1,233 |
| 18 | Awesome-LLMs-for-Vulnerability-Detection | 1,205 |
| 19 | mobsfscan | 779 |
| 20 | packj | 689 |
| 21 | prometeo | 654 |
| 22 | privado | 651 |
| 23 | PEP 8 Speaks | 618 |
Sponsored
Monitoring that respects your time & budget
APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
www.appsignal.com