Ruby

The Best Ruby Static Analysis Tools (Linters/Formatters)

We rank 71 Ruby linters, code analyzers, formatters, and more. Find and compare tools like Mega-Linter, Semgrep, SonarQube, and more. Please rate and review tools that you've used. This helps others find the best tools for their projects.

31 Ruby Tools

RuboCop

A Ruby static code analyzer, based on the community Ruby style guide.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 91% upvoted

brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 95% upvoted

Sorbet

A fast, powerful type checker designed for Ruby.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 88% upvoted

flay

Flay analyzes code for structural similarities.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

flog

Flog reports the most tortured code in an easy to read pain report. The higher the score, the more pain the code is in.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

reek

Code smell detector for Ruby.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

cane

Code quality threshold checking as part of your build.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 100% upvoted

dawnscanner

A static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

Rubrowser

Ruby classes interactive dependency graph generator.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

rubycritic

A Ruby code quality reporter.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

bundler-audit

Audit Gemfile.lock for gems with security vulnerabilities reported in Ruby Advisory Database.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

laser

Static analysis and style linter for Ruby code.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 100% upvoted

Churn

A Project to give the churn file, class, and method for a project for a given checkin. Over time the tool adds up the history of churns to give the number of times a file, class, or method is changing during the life of a project.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

ERB Lint

Lint your ERB or HTML files

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

Fasterer

Common Ruby idioms checker.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

Fukuzatsu

A tool for measuring code complexity in Ruby class files. Its analysis generates scores based on cyclomatic complexity algorithms with no added "opinions".

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

htmlbeautifier

A normaliser/beautifier for HTML that also understands embedded Ruby. Ideal for tidying up Rails templates.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedformatter
  • 0% upvoted

MetricFu

MetricFu is a set of tools to provide reports that show which parts of your code might need extra work.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

pelusa

Static analysis Lint-type tool to improve your OO Ruby code.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

quality

Runs quality checks on your code using community tools, and makes sure your numbers don't get any worse over time.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

Querly

Pattern Based Checking Tool for Ruby.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

Railroader

An open source static analysis security vulnerability scanner for Ruby on Rails applications.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

rails_best_practices

A code metric tool for Rails projects

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

Roodi

Roodi stands for Ruby Object Oriented Design Inferometer. It parses your Ruby code and warns you about design issues you have based on the checks that it has configured.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

ruby-lint

Static code analysis for Ruby.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

rufo

An opinionated ruby formatter, intended to be used via the command line as a text-editor plugin, to autoformat files on save or on demand.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedformatter
  • 0% upvoted

Saikuro

A Ruby cyclomatic complexity analyzer.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

SandiMeter

Static analysis tool for checking Ruby code for Sandi Metz' rules.

  • DeprecatedDeprecated
  • DeprecatedRuby
  • Deprecatedcli
  • Deprecatedlinter
  • 0% upvoted

Standard Ruby

Ruby Style Guide, with linter & automatic code fixer

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

Steep

Gradual Typing for Ruby.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

suture

A Ruby gem that helps you refactor your legacy code by the result of some old behavior with a new version.

  • MaintainedMaintained
  • MaintainedRuby
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

40 Multi-Language Tools

Mega-Linter

Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 68% upvoted

Semgrep

Sponsor

A fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Its rules look like the code you already write; no abstract syntax trees or regex wrestling. Supports 17+ languages.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter
  • 82% upvoted

SonarQube

SonarQube empowers development teams with a code quality and security solution that deeply integrates into your enterprise environment; enabling you to deploy clean code consistently and reliably. SonarQube provides a free and open source Community Edition.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 70% upvoted

Bearer

Sponsor

Open-Source static code analysis tool to discover, filter and prioritize security risks and vulnerabilities leading to sensitive data exposures (PII, PHI, PD). Highly configurable and easily extensible, built for security and engineering teams.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 97% upvoted

Sonatype

Reports known vulnerabilities in common dependencies and recommends updated packages to minimize breaking changes

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 77% upvoted

ThreatMapper

Vulnerability Scanner and Risk Evaluation for containers, serverless and hosts at runtime. ThreatMapper generates runtime BOMs from dependencies and operating system packages, matches against multiple threat feeds, scans for unprotected secrets, and scores issues based on severity and risk-of-exploit.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 94% upvoted

CodeScene

Sponsor

CodeScene is a quality visualization tool for software. Prioritize technical debt, detect delivery risks, and measure organizational aspects. Fully automated.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 65% upvoted

trunk

Modern repositories include many technologies, each with its own set of linters. With 30+ linters and counting, Trunk makes it dead-simple to identify, install, configure, and run the right linters, static analyzers, and formatters for all your repos.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • MaintainedlinterMaintainedformatter
  • 88% upvoted

DeepSource

In-depth static analysis to find issues in verticals of bug risks, security, anti-patterns, performance, documentation and style. Native integrations with GitHub, GitLab and Bitbucket. Less than 5% false positives.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 76% upvoted

Better Code Hub

Better Code Hub checks your GitHub codebase against 10 engineering guidelines devised by the authority in software quality, Software Improvement Group.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 77% upvoted

callGraph

Statically generates a call graph image and displays it on screen.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 83% upvoted

Codacy

Code Analysis to ship Better Code, Faster.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 68% upvoted

Codeac

Automated code review tool integrates with GitHub, Bitbucket and GitLab (even self-hosted). Available for JavaScript, TypeScript, Python, Ruby, Go, PHP, Java, Docker, and more. (open-source free)

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 89% upvoted

Checkmarx CxSAST

Commercial Static Code Analysis which doesn't require pre-compilation.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 56% upvoted

Scanmycode CE (Community Edition)

Scanmycode - Code Scanning/SAST/Linting using many tools/Scanners with One Report

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 100% upvoted

Codiga

Automated Code Reviews and Technical Debt management platform that supports 12+ languages.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 80% upvoted

trivy

A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 80% upvoted

Atom-Beautify

Beautify HTML, CSS, JavaScript, PHP, Python, Ruby, Java, C, C++, C#, Objective-C, CoffeeScript, TypeScript, Coldfusion, SQL, and more in Atom editor.

  • DeprecatedDeprecated
  • DeprecatedMulti-Language
  • Deprecatedide-plugin
  • Deprecatedlinter
  • 60% upvoted

Fortify

A commercial static analysis platform that supports the scanning of C/C++, C#, VB.NET, VB6, ABAP/BSP, ActionScript, Apex, ASP.NET, Classic ASP, VB Script, Cobol, ColdFusion, HTML, Java, JS, JSP, MXML/Flex, Objective-C, PHP, PL/SQL, T-SQL, Python (2.6, 2.7), Ruby (1.9.3), Swift, Scala, VB, and XML.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedide-plugin
  • Maintainedlinter
  • 52% upvoted

lizard

Lizard is an extensible Cyclomatic Complexity Analyzer for many programming languages including C/C++ (doesn't require all the header files or Java imports). It also does copy-paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 100% upvoted

Scrutinizer

A proprietary code quality checker that can be integrated with GitHub.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 100% upvoted

SonarCloud

SonarCloud enables your team to deliver clean code consistently and efficiently with a code review tool that easily integrates into the cloud DevOps platforms and extend your CI/CD workflow. SonarCloud is free for open source projects.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 67% upvoted

Hound CI

Comments on style violations in GitHub pull requests. Supports Coffeescript, Go, HAML, JavaScript, Ruby, SCSS and Swift.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 54% upvoted

imhotep

Comment on commits coming into your repository and check for syntactic errors and general lint warnings.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedmeta
  • 100% upvoted

Snyk Code

Snyk Code finds security vulnerabilities based on AI. Its speed of analysis allow us to analyse your code in real time and deliver results when you hit the save button in your IDE. Supported languages are Java, JavaScript, Python, PHP, C#, Go and TypeScript. Integrations with GitHub, BitBucket and Gitlab. It is free to try and part of the Snyk platform also covering SCA, containers and IaC.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 100% upvoted

ApplicationInspector

Creates reports of over 400 rule patterns for feature detection (e.g. the use of cryptography or version control in apps).

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 50% upvoted

autocorrect

A linter and formatter to help you to improve copywriting, correct spaces, words, punctuations between CJK (Chinese, Japanese, Korean).

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • MaintainedlinterMaintainedformatter
  • 0% upvoted

CodeFactor

Automated Code Analysis for repos on GitHub or BitBucket.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 50% upvoted

CodeFlow

Automated code analysis tool to deal with technical depth. Integrates with Bitbucket and Gitlab. (free for Open Source Projects)

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 50% upvoted

include-gardener

A multi-language static analyzer for C/C++/Obj-C/Python/Ruby to create a graph (in dot or graphml format) which shows all #include relations of a given set of files.

  • DeprecatedDeprecated
  • DeprecatedMulti-Language
  • Deprecatedcli
  • Deprecatedformatter
  • 0% upvoted

Semgrep Supply Chain

Quickly find and remediate high-priority security issues. Semgrep Supply Chain prioritizes the 2% of vulnerabilities that are reachable from your code.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedservice
  • Maintainedlinter
  • 0% upvoted

Sigrid

Sigrid helps you to improve your software by measuring your system's code quality, and then compares the results against a benchmark of thousands of industry systems to give you concrete advice on areas where you can improve.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter
  • 50% upvoted

SonarLint

SonarLint is a free IDE extension available for IntelliJ, VS Code, Visual Studio, and Eclipse, to find and fix coding issues in real-time, flagging issues as you code, just like a spell-checker. More than a linter, it also delivers rich contextual guidance to help developers understand why there is an issue, assess the risk, and educate them on how to fix it.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

Super-Linter

Combination of multiple linters to install as a GitHub Action.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 50% upvoted

Synopsys

A commercial static analysis platform that allows for scanning of multiple languages (C/C++, Android, C#, Java, JS, PHP, Python, Node.JS, Ruby, Fortran, and Swift).

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 50% upvoted

DevSkim

Regex-based static analysis tool for Visual Studio, VS Code, and Sublime Text - C/C++, C#, PHP, ASP, Python, Ruby, Java, and others.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedide-plugin
  • Maintainedlinter
  • 44% upvoted

graudit

Grep rough audit - source code auditing tool.

  • DeprecatedDeprecated
  • DeprecatedMulti-Language
  • Deprecatedcli
  • Deprecatedlinter
  • 40% upvoted

Pronto

Quick automated code review of your changes. Supports more than 40 runners for various languages, including Clang, Elixir, JavaScript, PHP, Ruby and more.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter
  • 0% upvoted

emerge

Emerge is a source code and dependency visualizer that can be used to gather insights about source code structure, metrics, dependencies and complexity of software projects. After scanning the source code of a project it provides you an interactive web interface to explore and analyze your project by using graph structures.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter
  • 0% upvoted

ShiftLeft Scan

Scan is a free open-source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter
  • 40% upvoted

Frequently Asked Questions

What are Ruby tools?

Ruby is an interpreted, high-level, general-purpose programming language. It was designed and developed in the mid-1990s by Yukihiro Matsumoto in Japan. Ruby is dynamically typed and uses garbage collection. It supports multiple programming paradigms, including procedural, object-oriented, and functional programming. According to the creator, Ruby was influenced by Perl, Smalltalk, Eiffel, Ada, Basic, and Lisp.

What are the best Ruby static analysis tools and linters?

The most popular Ruby tools ranked by user votes are: Mega-Linter, Semgrep, SonarQube, Bearer, Sonatype.

Which Ruby tools are free to use?

Tools with a free plan include trunk, DeepSource, Better Code Hub, Codiga. On top of that, there are also a number of open source like Mega-Linter, Semgrep, SonarQube, Bearer, Sonatype, RuboCop, ThreatMapper, trunk, brakeman, Sorbet.

Related Tags

Our Sponsors

This website is completely open source. To fund our work, we fully rely on sponsors. Thanks to them, we can keep the site free for everybody. Please check out their offers below.

  • Bearer
  • BugProve
  • CodeScene
  • semgrep
  • Offensive 360