SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Static Analysis Open-Source Projects
-
-
AppSignal
Monitoring that respects your time & budget. APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
-
ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
Project mention: ImHex: Visualizing Hex Editor for Reverse Engineers, Programmers | news.ycombinator.com | 2026-08-02 -
$ python forget_newest.py state.json astral-sh/ruff astral-sh/ruff: forgot release id 396061666 and the saved ETag $ python release_watch.py repos.txt state.json # run 3 run at 2026-09-27T13:14:09Z pallets/flask HTTP 304 not modified (rate limit left: 43) psf/black HTTP 304 not modified (rate limit left: 42) astral-sh/ruff HTTP 200 1 new release(s) (rate limit left: 41) NEW 0.16.9 published 2026-09-24T20:38:52Z https://github.com/astral-sh/ruff/releases/tag/0.16.9 python/cpython HTTP 304 not modified (rate limit left: 40)
-
Whilst I agree that Bash makes it far too easy to do it wrong, it's not too tricky to write scripts that don't have those issues.
Possibly the most important tip is to use ShellCheck (https://www.shellcheck.net/) as a linter on your scripts and work through the various warnings to eliminate them. For the rare times that ShellCheck is overly cautious, you can remove a specific warning with a comment before the offending line such as
# shellcheck disable=SC1091 -
code-review-graph
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Project mention: Put code-review-graph Behind a Read-Only MCP Boundary Before Connecting Your Repository | dev.to | 2026-07-21code-review-graph is trending because it promises a useful trade: build a persistent local map of a codebase so an AI reviewer reads relevant context instead of ingesting the whole repository. The repository is MIT-licensed and exposes MCP and CLI interfaces.
-
Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
src/Patch/PatchGenerator.php takes a validated MutationRequest and produces a PatchSet of PatchEntry objects. For PHP files, it uses nikic/php-parser via PhpFileBuilder to round-trip through an AST. That means the patch is syntactically valid by construction. You cannot generate a patch that breaks parsing because the patch itself is a parsed tree that gets printed back out.
-
semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Project mention: Defending your codebase from AI slop: guardrails that keep you in control | dev.to | 2026-10-08dependency-cruiser tells you which files talk to each other. It can't tell you what the code inside a file is doing. That's what Semgrep is for.
-
The previous post covered how we structured the codebase: Effect conventions, ast-grep enforcement, Drift, and CLAUDE.md to collaborate with Claude Code. You describe what you want, review the output, iterate. That works well. This post is about what happens when you step away entirely: giving the agent a list of issues and letting it work through them while you do something else. In autonomous mode, there's no mid-session correction. Anything the enforcement layer doesn't catch compounds across commits which is why clean issue tracking, issue review and end-of-session QA matter more, not less.
-
Project mention: A rogue AI led to a serious security incident at Meta | news.ycombinator.com | 2026-03-20
-
bytecode-viewer
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
-
static-analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
-
-
Project mention: Clean code didn't get less important in the AI age — it got more important | dev.to | 2026-09-13
For static analysis there's PHPStan for PHP and mypy for Python. For formatting, Prettier and gofmt are the cheapest guardrail there is, with zero excuse not to run one. For security, Semgrep covers the same principle at higher stakes.
-
One of the tools you can use for formatting your PHP code is PHP CS Fixer. It's an incredibly popular tool and, at the time of writing, has over 214 million downloads on Packagist.
-
mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
-
-
Representative tools: Trivy and Grype both scan lockfiles and dependency manifests for vulnerabilities, open-source and fast. For fixing — not just finding — Dependabot (GitHub-native) and Renovate (works everywhere, including GitLab) open automated PRs that bump vulnerable packages.
-
-
Project mention: Show HN: Digging up 40 years of tracker/chiptune formats (audio.1.sg) | news.ycombinator.com | 2026-06-18
-
Representative tools: Trivy again (it does both SCA and image scanning, which is why it's so widely deployed), Grype, and Clair, which underpins several registries' built-in scanning.
-
Automated analysis tools: SonarQube, CodeClimate, and Codacy detect code-level debt automatically: cyclomatic complexity, code duplication, dependency staleness, and coverage gaps. These tools supplement but don't replace the architectural and business-logic debt that requires human judgment to identify and document.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Static Analysis discussion
Static Analysis related posts
-
AI Cloned Your App Overnight. Now What?
-
Build a 100-line checker that catches chained-skill approval hijacks
-
Detectar vulnerabilidades en Go con gosec
-
How I would start a security audit of a Solidity contract (as someone new to this)
-
7 Best Code Review Tools for 2026
-
An injection that moved is not an injection that was fixed
-
ImpactGate: A merge gate that scores the structural decay AI adds
-
A note from our sponsor - SaaSHub
www.saashub.com | 14 Oct 2026
Index
What are some of the best open-source Static Analysis projects? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | rea | 166,726 |
| 2 | ImHex | 55,051 |
| 3 | ruff | 49,981 |
| 4 | ShellCheck | 40,164 |
| 5 | code-review-graph | 31,991 |
| 6 | Mobile-Security-Framework-MobSF | 21,901 |
| 7 | SwiftLint | 19,754 |
| 8 | PHP Parser | 17,463 |
| 9 | semgrep | 16,960 |
| 10 | ast-grep | 16,165 |
| 11 | infer | 15,716 |
| 12 | bytecode-viewer | 15,664 |
| 13 | static-analysis | 14,832 |
| 14 | awesome-malware-analysis | 14,178 |
| 15 | PHPStan | 14,125 |
| 16 | PHP CS Fixer | 13,561 |
| 17 | mastg | 13,237 |
| 18 | cmake-examples | 13,076 |
| 19 | grype | 13,008 |
| 20 | hadolint | 12,467 |
| 21 | Detect-It-Easy | 11,651 |
| 22 | clair | 11,072 |
| 23 | SonarQube | 11,061 |
Sponsored
Monitoring that respects your time & budget
APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
www.appsignal.com