License Type
More Resources
You Can Contribute!
You can help to improve this list by voting for your favorite tools or adding new ones on Github 
Latest from our Blog
Sat May 25 2024
As developers, maintaining secure, high-quality code is challenging. Security vulnerabilities, performance issues, and code quality concerns can accumulate. Enter Pixeebot, a tool by Pixee that automates security and code improvements, letting developers focus on essential tasks.
Sun Nov 19 2023
I have never been a huge fan of IoT devices. Granted, they make our life easier, but they also open the door to a lot of security issues. Most IoT devices are black boxes. I don't know what's inside and I don't know what they connect to.
Thu Apr 06 2023
As a developer, I have faced my fair share of security mishaps. I recall times when I accidentally exposed sensitive data in logs or sent a network request over a non-encrypted HTTP channel when HTTPS was available. I'm sure many of you can relate to these situations. We may not be security experts, but that doesn't mean we shouldn't take measures to protect our applications. This is where Bearer, a new security tool for Ruby and JavaScript apps (Java coming soon), comes into play.
Wed Mar 29 2023
We are happy to announce that we completely rebuilt analysis-tools.dev from scratch with more features and a new design!This is a major milestone for us, as it marks the first time we sat down to reinvision what the project should become in the next few years.
Tue Jan 26 2021
This project started as a way to scratch my own itch:Years later, many people still seem to have the same problem. There are more than 500 static analysis (SAST) tools out there; how can you possibly find the "best" one?
Wed Aug 19 2020
Static analysis is great! It helps improve code quality by inspecting source code without even running it. There are hundreds of great tools to choose from — many are free or open-source. Unfortunately, many projects still don’t make use of static analysis tools for various reasons.
Thu Jul 16 2020
We found that static code analysis is a topic that is attracting a lot of engineers, which care about code-quality and solid engineering standards. Our goal is to create an open community for developers that want to take their code and skill set to the next level.
Thu Jul 16 2020
Today we welcome DeepCode as our first sponsor.It makes us incredibly happy to see the backing of our community project from such a forward-thinking company. Just like us, DeepCode thinks that the space of analysis tools could be vastly improved to increase code quality and foster best practices within organizations of any size.
Stay Informed
Sign up to our newsletter and always stay up to date with the latest tools and trends in development
bashate
MaintainedCode style enforcement for bash programs. The output format aims to follow pycodestyle (pep8) default output format.
Tutorials / Guides
5 Alternatives for bashate
i-Code CNES for Shell
An open source static code analysis tool for Shell and Fortran (77 and 90).
shellcheck
ShellCheck, a static analysis tool that gives warnings and suggestions for bash/sh shell scripts.
shellharden
A syntax highlighter and a tool to semi-automate the rewriting of scripts to ShellCheck conformance, mainly focused on quoting.
12 Multi-Language Tools
autocorrect
A linter and formatter to help you to improve copywriting, correct spaces, words, punctuations between CJK (Chinese, Japanese, Korean).
csharp
go
javascript
jsx
python
ruby
rust
scala
BlockWatch
A language-agnostic linter that keeps code, documentation, and configuration in sync and enforces strict formatting and validation rules.
c
cpp
java
kotlin
awk
dart
fortran
julia
luaDepWarden
Free, anonymous SCA + SAST scanner. SCA: scans npm, PyPI, Maven, Go, Cargo, Ruby, NuGet dependencies for CVEs (OSV/KEV/EPSS), typosquats and supply-chain risk. SAST: pattern + taint analysis for 15 languages, 300+ rules. No account, no source upload. Available as a web tool, zero-install CLI and GitHub Action.
dotnet
php
Kimün
Code health metrics from the terminal. Grades a project from A++ to F-- on cognitive complexity, duplication, indentation, Halstead effort and file size, and lists the files to look at first. Separate commands report cyclomatic and cognitive complexity per function, duplicates, code smells and the Maintainability Index. From git history it finds hotspots, code ownership and temporal coupling, and measures which files a diff reaches. A CI gate fails when a changed file gets worse.
clojure
elixir
erlang
fsharpMega-Linter
Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes
apex
coffeescriptShiftLeft Scan
Scan is a free open-source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines. Note: ShiftLeft rebranded to Qwiet AI in 2023, which was subsequently acquired by Harness in September 2025. This open-source project is no longer maintained.
groovy
jsp
plsql
delphiStaticReviewer
Static Reviewer executes code checks according to the most relevant Secure Coding Standards, OWASP, CWE, CVE, CVSS, MISRA, CERT, for 40+ programming languages, using 1000+ built-in validation rules for Security, Deadcode & Best Practices Available a module for Software Composition Analysis (SCA) to find vulnerabilities in open source and third party libraries.
abap
actionscript
asp
aspnet
perl
typescriptthailint
Multi-language linter targeting anti-patterns that appear disproportionately in AI-generated code: duplicated blocks across files, excessive nesting, magic numbers, Single Responsibility violations, and linter suppressions added without justification. Covers Python, TypeScript, JavaScript and Rust from one configuration, ships a pre-commit hook per rule, and emits text, JSON or SARIF for CI.
ai-generated-code
terraform
yamlHelp make this list better
Suggest Tools
