License Type
More Resources
You Can Contribute!
You can help to improve this list by voting for your favorite tools or adding new ones on Github
Suggest a tool
Latest from our Blog
Mon Mar 13 2023
We are happy to announce that we completely rebuilt analysis-tools.dev from scratch with more features and a new design!This is a major milestone for us, as it marks the first time we sat down to reinvision what the project should become in the next few years.
Tue Jan 26 2021
This project started as a way to scratch my own itch:Years later, many people still seem to have the same problem. There are more than 500 static analysis (SAST) tools out there; how can you possibly find the "best" one?
Wed Aug 19 2020
Static analysis is great! It helps improve code quality by inspecting source code without even running it. There are hundreds of great tools to choose from — many are free or open-source. Unfortunately, many projects still don’t make use of static analysis tools for various reasons.
Thu Jul 16 2020
We found that static code analysis is a topic that is attracting a lot of engineers, which care about code-quality and solid engineering standards. Our goal is to create an open community for developers that want to take their code and skill set to the next level.
Thu Jul 16 2020
Today we welcome DeepCode as our first sponsor.It makes us incredibly happy to see the backing of our community project from such a forward-thinking company. Just like us, DeepCode thinks that the space of analysis tools could be vastly improved to increase code quality and foster best practices within organizations of any size.
Stay Informed
Sign up to our newsletter and always stay up to date with the latest tools and trends in development
Semgrep Supply Chain
Quickly find and remediate high-priority security issues. Semgrep Supply Chain prioritizes the 2% of vulnerabilities that are reachable from your code.
Help make this list better
Suggest Tools
13 Multi-Language Tools
Better Code Hub
Better Code Hub checks your GitHub codebase against 10 engineering guidelines devised by the authority in software quality, Software Improvement Group.
- csharp
- cpp
- go
- groovy
- java
- javascript
- kotlin
- objectivec
- perl
- php
- python
- ruby
- scala
- shell
- swift
- typescript
- smart-contracts
Codeac
Automated code review tool integrates with GitHub, Bitbucket and GitLab (even self-hosted). Available for JavaScript, TypeScript, Python, Ruby, Go, PHP, Java, Docker, and more. (open-source free)
emerge
Emerge is a source code and dependency visualizer that can be used to gather insights about source code structure, metrics, dependencies and complexity of software projects. After scanning the source code of a project it provides you an interactive web interface to explore and analyze your project by using graph structures.
Semgrep
A fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Its rules look like the code you already write; no abstract syntax trees or regex wrestling. Supports 17+ languages.
- c
- csharp
- go
- java
- javascript
- jsx
- ocaml
- php
- python
- ruby
- typescript
- configmanagement
- ci
- dockerfile
- json
- kubernetes
- nodejs
- rails
- security
- terraform
- yaml
Sigrid
Sigrid helps you to improve your software by measuring your system's code quality, and then compares the results against a benchmark of thousands of industry systems to give you concrete advice on areas where you can improve.
- c
- csharp
- cpp
- delphi
- go
- groovy
- java
- javascript
- kotlin
- lua
- objectivec
- perl
- php
- plsql
- powershell
- python
- r
- ruby
- rust
- scala
- shell
- sql
- swift
- typescript
- vbnet
- nodejs
- vue
Snyk Code
Snyk Code finds security vulnerabilities based on AI. Its speed of analysis allow us to analyse your code in real time and deliver results when you hit the save button in your IDE. Supported languages are Java, JavaScript, Python, PHP, C#, Go and TypeScript. Integrations with GitHub, BitBucket and Gitlab. It is free to try and part of the Snyk platform also covering SCA, containers and IaC.
SonarCloud
Multi-language cloud-based static code analysis. History, trends, security hot-spots, pull request analysis and more. Free for open source.
Help make this list better
Suggest Tools
