InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now. Learn more →
Top 23 Python Static Analysis Projects
-
owasp-mastg
The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).
The OWASP Mobile Application Security (MAS) flagship project provides a robust security standard for mobile apps, known as the OWASP MASVS, along with a comprehensive testing guide (OWASP MASTG). These resources cover the processes, techniques, and tools used during a mobile app security test, ensuring consistent and complete results.
-
InfluxDB
InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.
-
checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Project mention: DevOps in 2025: the future is automated, git-ified, and kinda scary but fun. | dev.to | 2025-05-09Checkov infrastructure-as-code misconfig detection
-
-
-
I noticed this issue only after running a linter. Sometimes we’re not familiar with the tricky edge cases or conventions of a particular language. A convenient way to catch and fix such issues — including formatting, styling, and even some security problems — is to use linters. For example, you can use golangci-lint for Go, ESLint for JavaScript, and Pylint for Python. In fact, almost every widely used programming language has its own linter or code quality tool. Linters are especially helpful when generating code with AI — they help keep your code clean and safe, at least to some degree.
-
-
pytype is based in part upon byterun https://github.com/google/pytype/blob/main/docs/developers/i...
I learnt a lot about bytecode interpreters from working on it, and it helped me understand the cpython source code a lot more easily from having played with a python translation of it first.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
Flake8
flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.
Flake8: This tool checks for style errors and simple programming mistakes.
-
codechecker
CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
Project mention: PVS\-Studio 7\.34: support for Apple Silicon ARM64, \.NET 9, taint analysis in Java analyzer, and more | dev.to | 2024-12-18Starting with the CodeChecker 6.25.0 release, users can upload PVS-Studio reports directly into the web interface for a streamlined review of code analysis results. For more details on this integration, please consult the documentation.
-
-
Project mention: [Let's Have LLMs Read OSS Too!] Creating a Code Reading Agent Is Great | dev.to | 2025-05-01
-
Project mention: Ipyflow: A reactive Python kernel for Jupyter notebooks | news.ycombinator.com | 2024-12-13
-
dagda
a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
-
Project mention: CrossHair: Analysis [Python] that blurs the line between testing and [types] | news.ycombinator.com | 2024-12-24
-
betterscan
Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan
-
packj
Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
Project mention: A Study of Malware Prevention in Linux Distributions | news.ycombinator.com | 2024-11-21Good to see Packj[1] as one of the malware scanners used.
1. https://github.com/ossillate-inc/packj
Packj detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).
-
mobsfscan
mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
-
prometeo
An experimental Python-to-C transpiler and domain specific language for embedded high-performance computing
-
-
astroid
A common base representation of python source code for pylint and other projects (by pylint-dev)
-
privado
Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.
-
-
tryceratops
A linter to prevent exception handling antipatterns in Python (limited only for those who like dinosaurs).
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Python Static Analysis discussion
Python Static Analysis related posts
-
[Let's Have LLMs Read OSS Too!] Creating a Code Reading Agent Is Great
-
CrossHair: Analysis [Python] that blurs the line between testing and [types]
-
Symbolic Execution by Overloading __bool__
-
PVS\-Studio 7\.34: support for Apple Silicon ARM64, \.NET 9, taint analysis in Java analyzer, and more
-
Ipyflow: A reactive Python kernel for Jupyter notebooks
-
CodeChecker - code quality control using PVS-Studio
-
Contracts for C++ (DbC) [pdf]
-
A note from our sponsor - InfluxDB
www.influxdata.com | 23 May 2025
Index
What are some of the best open-source Static Analysis projects in Python? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | owasp-mastg | 12,218 |
| 2 | checkov | 7,562 |
| 3 | jedi | 5,940 |
| 4 | slither | 5,688 |
| 5 | Pylint | 5,467 |
| 6 | apkleaks | 5,279 |
| 7 | pytype | 4,890 |
| 8 | Flake8 | 3,607 |
| 9 | codechecker | 2,393 |
| 10 | pyt | 2,186 |
| 11 | vulnhuntr | 1,780 |
| 12 | ipyflow | 1,221 |
| 13 | dagda | 1,184 |
| 14 | CrossHair | 1,152 |
| 15 | betterscan | 860 |
| 16 | packj | 662 |
| 17 | mobsfscan | 660 |
| 18 | prometeo | 635 |
| 19 | PEP 8 Speaks | 615 |
| 20 | astroid | 544 |
| 21 | privado | 532 |
| 22 | aura | 493 |
| 23 | tryceratops | 443 |
Sponsored
InfluxDB – Built for High-Performance Time Series Workloads
InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.
www.influxdata.com