Topics / #static-code-analysis

Static-code-analysis projects on GitHub

Linters and analyzers that inspect code without running it.

As of October 17, 2026, the most-starred Static-code-analysis projects on GitHub are ruff (50.1K stars), shellcheck (40.2K stars) and standard (29.4K stars). GitHub.Locker tracks 18 Static-code-analysis repositories with 370.1K stars combined. The fastest-growing on October 16 was fallow, with +54 stars in a day.

18Projects

370.1KStars in total

+140Stars in a day

Browse in the catalog →github.com/topics/static-code-analysis ↗

Hot right now

Most stars gained in a day · Oct 16

+54

fallow

fallow-rs/fallow · ★ 5.1K

Fallow is a Rust-based codebase intelligence tool for TypeScript/JavaScript that builds one dependency graph of a repository and reports unused code, circular dependencies, duplication, complexity hotspots, architecture boundary violations, and design-system styling drift.

+26

ruff

astral-sh/ruff · ★ 50.1K

Ruff is an extremely fast Python linter and code formatter written in Rust, built to replace tools like Flake8, Black, isort, pydocstyle, pyupgrade, and autoflake with a single command-line tool.

+15

semgrep

semgrep/semgrep · ★ 17.1K

Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

+11

ast-grep

ast-grep/ast-grep · ★ 16.3K

ast-grep (sg) is a CLI tool for structural search, linting and rewriting of source code — like grep, but matching the abstract syntax tree instead of raw text.

The all-time top

18 projects · by stars

#1 · astral-sh/ruff
ruff
Ruff is an extremely fast Python linter and code formatter written in Rust, built to replace tools like Flake8, Black, isort, pydocstyle, pyupgrade, and autoflake with a single command-line tool.
50.1K
#2 · koalaman/shellcheck
shellcheck
ShellCheck is a free static analysis tool for shell scripts: it reads your bash/sh code and reports warnings and suggestions for problems in it.
40.2K
#3 · standard/standard
standard
JavaScript Standard Style — a zero-configuration style guide, linter and automatic code fixer for JavaScript. It enforces one consistent style and catches programmer errors early, with nothing to set up.
29.4K

4
eslint
27.6Keslint/eslint · JavaScript
ESLint is a linter for JavaScript: a tool that identifies and reports on patterns found in ECMAScript/JavaScript code, so problems get caught before they ship.
5
biome
26Kbiomejs/biome · Rust
Biome is a toolchain for web projects: one fast tool that both formats and lints JavaScript, TypeScript, JSX, JSON, CSS and GraphQL, run from the CLI or your editor via LSP.
6
mypy
20.7Kpython/mypy · Python
Mypy is a static type checker for Python: you add type hints (PEP 484) to your code and it warns you when you use those types incorrectly, catching bugs without even running the program.
7
jstraining
20Kruanyf/jstraining
Training materials for a JavaScript full-stack bootcamp: they teach the basics needed to build both the front end and back end of a simple web application.
8
PHP-Parser
17.5Knikic/PHP-Parser · PHP
A parser written in PHP that turns PHP code into an abstract syntax tree (AST). Its purpose is to simplify static code analysis and manipulation of PHP code.
9
semgrep
17.1Ksemgrep/semgrep · C
Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.
10
typescript-eslint
16.4Ktypescript-eslint/typescript-eslint · TypeScript
typescript-eslint is the monorepo that provides the tooling enabling ESLint to understand and lint TypeScript code, including the parser and plugin rules.
11
ast-grep
16.3Kast-grep/ast-grep · Rust
ast-grep (sg) is a CLI tool for structural search, linting and rewriting of source code — like grep, but matching the abstract syntax tree instead of raw text.
12
infer
15.7Kfacebook/infer · OCaml
Infer is a static analysis tool that finds bugs in Java, C, C++, and Objective-C code by analyzing it without running it. It lives under Facebook's GitHub and is written in OCaml.
13
pyright
15.7Kmicrosoft/pyright · Python
Pyright is a full-featured, standards-based static type checker for Python, built by Microsoft for speed on large codebases.
14
static-analysis
14.8Kanalysis-tools-dev/static-analysis · Rust
A curated list of static analysis (SAST) tools, linters and formatters for all programming languages, config files and build tools, focused on tools that improve code quality.
15
phpstan
14.1Kphpstan/phpstan · PHP
PHPStan is a static analysis tool for PHP that finds bugs in your code without actually running it, catching whole classes of errors before you even write tests.
16
rubocop
12.9Krubocop/rubocop · Ruby
RuboCop is a static code analyzer (linter) and code formatter for Ruby that enforces the community Ruby Style Guide out of the box, and it is also configurable to enforce your own style.
17
rector
10.4Krectorphp/rector · PHP
Rector is a PHP tool that instantly upgrades and refactors PHP codebases: it automates upgrades from PHP 5.3 up to 8.5 plus framework migrations, and can keep code quality high continuously via CI.
18
fallow
5.1Kfallow-rs/fallow · Rust
Fallow is a Rust-based codebase intelligence tool for TypeScript/JavaScript that builds one dependency graph of a repository and reports unused code, circular dependencies, duplication, complexity hotspots, architecture boundary violations, and design-system styling drift.