62 Ruby Static Analysis Tools
What is Ruby?
Ruby is an interpreted, high-level, general-purpose programming language. It was designed and developed in the mid-1990s by Yukihiro Matsumoto in Japan.
Ruby is dynamically typed and uses garbage collection. It supports multiple programming paradigms, including procedural, object-oriented, and functional programming. According to the creator, Ruby was influenced by Perl, Smalltalk, Eiffel, Ada, Basic, and Lisp.
What are the best Ruby analysis tools?
Mega-Linter
Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes
- ansible
- apex
- arm
- c
- ci
- clojure
- cloudformation
- coffeescript
- configfile
- configmanagement
- container
- cpp
- css
- csharp
- dart
- dockerfile
- dotenv
- dotnet
- editorconfig
- formatter
- gherkin
- go
- graphql
- groovy
- html
- java
- javascript
- json
- jsonschema
- jsx
- kotlin
- kubernetes
- latex
- lua
- lwc
- markdown
- nodejs
- perl
- php
- powershell
- protobuf
- puppet
- python
- r
- raku
- rst
- ruby
- rust
- scala
- shell
- snakemake
- sql
- terraform
- typescript
- vbnet
- vue
- writing
- xml
- yaml
Semgrep
A fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Its rules look like the code you already write; no abstract syntax trees or regex wrestling. Supports 17+ languages.
SonarQube
SonarQube is an open platform to manage code quality.
brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications.
DeepSource
In-depth static analysis to find issues in verticals of bug risks, security, anti-patterns, performance, documentation and style. Native integrations with GitHub, GitLab and Bitbucket. Less than 5% false positives.
Better Code Hub
Better Code Hub checks your GitHub codebase against 10 engineering guidelines devised by the authority in software quality, Software Improvement Group.
Codeac
Automated code review tool integrates with GitHub, Bitbucket and GitLab (even self-hosted). Available for JavaScript, TypeScript, Python, Ruby, Go, PHP, Java, Docker, and more. (open-source free)
Scanmycode CE (Community Edition)
Scanmycode - Code Scanning/SAST/Linting using many tools/Scanners with One Report
trunk
Modern repositories include many technologies, each with its own set of linters. With 30+ linters and counting, Trunk makes it dead-simple to identify, install, configure, and run the right linters, static analyzers, and formatters for all your repos.
Fortify
A commercial static analysis platform that supports the scanning of C/C++, C#, VB.NET, VB6, ABAP/BSP, ActionScript, Apex, ASP.NET, Classic ASP, VB Script, Cobol, ColdFusion, HTML, Java, JS, JSP, MXML/Flex, Objective-C, PHP, PL/SQL, T-SQL, Python (2.6, 2.7), Ruby (1.9.3), Swift, Scala, VB, and XML.
Codiga
Automated Code Reviews and Technical Debt management platform that supports 12+ languages.
dawnscanner
A static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
trivy
A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.
Atom-Beautify
Beautify HTML, CSS, JavaScript, PHP, Python, Ruby, Java, C, C++, C#, Objective-C, CoffeeScript, TypeScript, Coldfusion, SQL, and more in Atom editor.
CodeFlow
Automated code analysis tool to deal with technical depth. Integrates with Bitbucket and Gitlab. (free for Open Source Projects)
Hound CI
Comments on style violations in GitHub pull requests. Supports Coffeescript, Go, HAML, JavaScript, Ruby, SCSS and Swift.
lizard
Lizard is an extensible Cyclomatic Complexity Analyzer for many programming languages including C/C++ (doesn't require all the header files or Java imports). It also does copy-paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.
ThreatMapper
Vulnerability Scanner and Risk Evaluation for containers, serverless and hosts at runtime. ThreatMapper generates runtime BOMs from dependencies and operating system packages, matches against multiple threat feeds, scans for unprotected secrets, and scores issues based on severity and risk-of-exploit.
ApplicationInspector
Creates reports of over 400 rule patterns for feature detection (e.g. the use of cryptography or version control in apps).
bundler-audit
Audit Gemfile.lock for gems with security vulnerabilities reported in [Ruby Advisory Database](https://github.com/rubysec/ruby-advisory-db).
Fukuzatsu
A tool for measuring code complexity in Ruby class files. Its analysis generates scores based on cyclomatic complexity algorithms with no added "opinions".
imhotep
Comment on commits coming into your repository and check for syntactic errors and general lint warnings.
include-gardener
A multi-language static analyzer for C/C++/Obj-C/Python/Ruby to create a graph (in dot or graphml format) which shows all `#include` relations of a given set of files.
Pronto
Quick automated code review of your changes. Supports more than 40 runners for various languages, including Clang, Elixir, JavaScript, PHP, Ruby and more.
quality
Runs quality checks on your code using community tools, and makes sure your numbers don't get any worse over time.
Railroader
An open source static analysis security vulnerability scanner for Ruby on Rails applications.
Scrutinizer
A proprietary code quality checker that can be integrated with GitHub.
SonarCloud
Multi-language cloud-based static code analysis. History, trends, security hot-spots, pull request analysis and more. Free for open source.
Super-Linter
Combination of multiple linters to install as a GitHub Action.
APPscreener
Static code analysis for binary and source code - Java/Scala, PHP, Javascript, C#, PL/SQL, Python, T-SQL, C/C++, ObjectiveC/Swift, Visual Basic 6.0, Ruby, Delphi, ABAP, HTML5 and Solidity.
Deprecated/unmaintained tools
❤️ Sponsor this project
We are currently looking for partners who want to sponsor hosting and development of the project.
Missing an entry? Please let us know.