Analysis tools logo

69 Ruby Static Analysis Tools

Type:
Any

What is Ruby?

Ruby is an interpreted, high-level, general-purpose programming language. It was designed and developed in the mid-1990s by Yukihiro Matsumoto in Japan.

Ruby is dynamically typed and uses garbage collection. It supports multiple programming paradigms, including procedural, object-oriented, and functional programming. According to the creator, Ruby was influenced by Perl, Smalltalk, Eiffel, Ada, Basic, and Lisp.

(More info)

What are the best Ruby analysis tools?

113

Mega-Linter

  • Type: cli
955

Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes

69

Semgrep

  • Type: cli
  • Type: service
7445

A fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Its rules look like the code you already write; no abstract syntax trees or regex wrestling. Supports 17+ languages.

49
48

Sonatype

  • Type: service

Reports known vulnerabilities in common dependencies and recommends updated packages to minimize breaking changes

43

RuboCop

  • Type: cli
12058

A Ruby static code analyzer, based on the community Ruby style guide.

25

ThreatMapper

  • Type: service
  • Type: web
2468

Vulnerability Scanner and Risk Evaluation for containers, serverless and hosts at runtime. ThreatMapper generates runtime BOMs from dependencies and operating system packages, matches against multiple threat feeds, scans for unprotected secrets, and scores issues based on severity and risk-of-exploit.

24

CodeScene

  • Type: service

CodeScene is a quality visualization tool for software. Prioritize technical debt, detect delivery risks, and measure organizational aspects. Fully automated.

17

brakeman

  • Type: cli
6534

A static analysis security vulnerability scanner for Ruby on Rails applications.

16

DeepSource

  • Type: service

In-depth static analysis to find issues in verticals of bug risks, security, anti-patterns, performance, documentation and style. Native integrations with GitHub, GitLab and Bitbucket. Less than 5% false positives.

14

Better Code Hub

  • Type: service

Better Code Hub checks your GitHub codebase against 10 engineering guidelines devised by the authority in software quality, Software Improvement Group.

13

Sorbet

  • Type: cli
3325

A fast, powerful type checker designed for Ruby.

10

trunk

  • Type: cli

Modern repositories include many technologies, each with its own set of linters. With 30+ linters and counting, Trunk makes it dead-simple to identify, install, configure, and run the right linters, static analyzers, and formatters for all your repos.

6

Codeac

  • Type: service

Automated code review tool integrates with GitHub, Bitbucket and GitLab (even self-hosted). Available for JavaScript, TypeScript, Python, Ruby, Go, PHP, Java, Docker, and more. (open-source free)

5

flay

  • Type: cli
675

Flay analyzes code for structural similarities.

5

Scanmycode CE (Community Edition)

  • Type: service
337

Scanmycode - Code Scanning/SAST/Linting using many tools/Scanners with One Report

4

flog

  • Type: cli
798

Flog reports the most tortured code in an easy to read pain report. The higher the score, the more pain the code is in.

4

reek

  • Type: cli
3845

Code smell detector for Ruby.

4

Sider

  • Type: service

An automated code reviewing tool. Improving developers' productivity.

3

Fortify

  • Type: ide-plugin

A commercial static analysis platform that supports the scanning of C/C++, C#, VB.NET, VB6, ABAP/BSP, ActionScript, Apex, ASP.NET, Classic ASP, VB Script, Cobol, ColdFusion, HTML, Java, JS, JSP, MXML/Flex, Objective-C, PHP, PL/SQL, T-SQL, Python (2.6, 2.7), Ruby (1.9.3), Swift, Scala, VB, and XML.

2

cane

  • Type: cli
1326

Code quality threshold checking as part of your build.

2

dawnscanner

  • Type: cli
673

A static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

2

rubycritic

  • Type: cli
3075

A Ruby code quality reporter.

2

trivy

  • Type: cli
15082

A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.

2

Codiga

  • Type: service

Automated Code Reviews and Technical Debt management platform that supports 12+ languages.

1

ApplicationInspector

  • Type: cli
4012

Creates reports of over 400 rule patterns for feature detection (e.g. the use of cryptography or version control in apps).

1

Atom-Beautify

  • Type: ide-plugin
1505

Beautify HTML, CSS, JavaScript, PHP, Python, Ruby, Java, C, C++, C#, Objective-C, CoffeeScript, TypeScript, Coldfusion, SQL, and more in Atom editor.

1

bundler-audit

  • Type: cli
2505

Audit Gemfile.lock for gems with security vulnerabilities reported in [Ruby Advisory Database](https://github.com/rubysec/ruby-advisory-db).

1

CodeFlow

  • Type: service

Automated code analysis tool to deal with technical depth. Integrates with Bitbucket and Gitlab. (free for Open Source Projects)

1

Hound CI

  • Type: cli
1918

Comments on style violations in GitHub pull requests. Supports Coffeescript, Go, HAML, JavaScript, Ruby, SCSS and Swift.

1

imhotep

  • Type: cli
221

Comment on commits coming into your repository and check for syntactic errors and general lint warnings.

1

lizard

  • Type: cli
1476

Lizard is an extensible Cyclomatic Complexity Analyzer for many programming languages including C/C++ (doesn't require all the header files or Java imports). It also does copy-paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.

1

Rubrowser

  • Type: cli
589

Ruby classes interactive dependency graph generator.

0

Churn

  • Type: cli
388

A Project to give the churn file, class, and method for a project for a given checkin. Over time the tool adds up the history of churns to give the number of times a file, class, or method is changing during the life of a project.

0

ERB Lint

  • Type: cli
427

Lint your ERB or HTML files

0

Fasterer

  • Type: cli
1609

Common Ruby idioms checker.

0

Fukuzatsu

  • Type: cli
28

A tool for measuring code complexity in Ruby class files. Its analysis generates scores based on cyclomatic complexity algorithms with no added "opinions".

0

graudit

  • Type: cli
1167

Grep rough audit - source code auditing tool.

0

htmlbeautifier

  • Type: cli
266

A normaliser/beautifier for HTML that also understands embedded Ruby. Ideal for tidying up Rails templates.

0

include-gardener

  • Type: cli
68

A multi-language static analyzer for C/C++/Obj-C/Python/Ruby to create a graph (in dot or graphml format) which shows all `#include` relations of a given set of files.

0

MetricFu

  • Type: cli
610

MetricFu is a set of tools to provide reports that show which parts of your code might need extra work.

0

pelusa

  • Type: cli
445

Static analysis Lint-type tool to improve your OO Ruby code.

0

Pronto

  • Type: cli
2522

Quick automated code review of your changes. Supports more than 40 runners for various languages, including Clang, Elixir, JavaScript, PHP, Ruby and more.

0

quality

  • Type: cli
153

Runs quality checks on your code using community tools, and makes sure your numbers don't get any worse over time.

0

Querly

  • Type: cli
241

Pattern Based Checking Tool for Ruby.

0

Railroader

  • Type: cli
44

An open source static analysis security vulnerability scanner for Ruby on Rails applications.

0

rails_best_practices

  • Type: cli
4065

A code metric tool for Rails projects

0

Roodi

  • Type: cli
281

Roodi stands for Ruby Object Oriented Design Inferometer. It parses your Ruby code and warns you about design issues you have based on the checks that it has configured.

0

rufo

  • Type: cli
787

An opinionated ruby formatter, intended to be used via the command line as a text-editor plugin, to autoformat files on save or on demand.

0

Saikuro

  • Type: cli
36

A Ruby cyclomatic complexity analyzer.

0

Scrutinizer

  • Type: service

A proprietary code quality checker that can be integrated with GitHub.

0

Semgrep Supply Chain

  • Type: service

Quickly find and remediate high-priority security issues. Semgrep Supply Chain prioritizes the 2% of vulnerabilities that are reachable from your code.

0

Sigrid

  • Type: cli
  • Type: service

Sigrid helps you to improve your software by measuring your system's code quality, and then compares the results against a benchmark of thousands of industry systems to give you concrete advice on areas where you can improve.

0

Snyk Code

  • Type: service

Snyk Code finds security vulnerabilities based on AI. Its speed of analysis allow us to analyse your code in real time and deliver results when you hit the save button in your IDE. Supported languages are Java, JavaScript, Python, PHP, C#, Go and TypeScript. Integrations with GitHub, BitBucket and Gitlab. It is free to try and part of the Snyk platform also covering SCA, containers and IaC.

0

SonarCloud

  • Type: service

Multi-language cloud-based static code analysis. History, trends, security hot-spots, pull request analysis and more. Free for open source.

0

Standard Ruby

  • Type: cli
2069

Ruby Style Guide, with linter & automatic code fixer

0

Steep

  • Type: cli
1094

Gradual Typing for Ruby.

0

Synopsys

  • Type: cli

A commercial static analysis platform that allows for scanning of multiple languages (C/C++, Android, C#, Java, JS, PHP, Python, Node.JS, Ruby, Fortran, and Swift).

-1

APPscreener

  • Type: cli

Static code analysis for binary and source code - Java/Scala, PHP, Javascript, C#, PL/SQL, Python, T-SQL, C/C++, ObjectiveC/Swift, Visual Basic 6.0, Ruby, Delphi, ABAP, HTML5 and Solidity.

-1

emerge

  • Type: cli
  • Type: web
386

Emerge is a source code and dependency visualizer that can be used to gather insights about source code structure, metrics, dependencies and complexity of software projects. After scanning the source code of a project it provides you an interactive web interface to explore and analyze your project by using graph structures.

-2

DevSkim

  • Type: ide-plugin
759

Regex-based static analysis tool for Visual Studio, VS Code, and Sublime Text - C/C++, C#, PHP, ASP, Python, Ruby, Java, and others.

-3

ShiftLeft Scan

  • Type: cli
  • Type: service
548

Scan is a free open-source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines.

Deprecated/unmaintained tools

1

laser

  • Type: cli
391

Static analysis and style linter for Ruby code.

0

ruby-lint

  • Type: cli

Static code analysis for Ruby.

0

SandiMeter

  • Type: cli
756

Static analysis tool for checking Ruby code for Sandi Metz' rules.

❤️ Sponsor this project

We are currently looking for partners who want to sponsor hosting and development of the project.

Check out our Github Sponsors page here

Missing an entry? Please let us know.