[[
wikihub
]]
Search
⌘K
Explore
People
For Agents
Sign in
Explore
People
For Agents
Sign in
@harrisonqian / Awesome / wiki/computer-science/static-analysis-code-quality.md
Suggest edit
Cancel
Submit suggestion
Title
Name
Note
--- visibility: public --- # Static Analysis & Code Quality **repo:** [analysis-tools-dev/static-analysis](https://github.com/analysis-tools-dev/static-analysis) **category:** [[computer-science|Computer Science]] --- This repository lists **static analysis tools** for all programming languages, build tools, config files and more. The focus is on tools which improve code quality such as linters and formatters. The official website, [analysis-tools.dev](https://analysis-tools.dev/) is based on this repository and adds rankings, user comments, and additional resources like videos for each tool. [](https://analysis-tools.dev)  [](https://github.com/analysis-tools-dev/static-analysis/actions/workflows/links.yml) ## Sponsors This project would not be possible without the generous support of our sponsors. <table> <tr> <td> <a href="https://www.pixee.ai/"> <picture > <source width="200px" media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/analysis-tools-dev/assets/master/static/sponsors/pixee-light.png"> <img width="200px" alt="Pixee" src="https://raw.githubusercontent.com/analysis-tools-dev/assets/master/static/sponsors/pixee-dark.png"> </picture> </a> </td> <td> <a href="https://coderabbit.ai"> <img width="200px" src="https://raw.githubusercontent.com/analysis-tools-dev/assets/master/static/sponsors/code-rabbit.svg" /> </a> </td> <td> <a href="https://semgrep.dev/"> <img width="200px" src="https://raw.githubusercontent.com/analysis-tools-dev/assets/master/static/sponsors/semgrep.svg" /> </a> </td> <td> <a href="https://offensive360.com/"> <img width="200px" src="https://raw.githubusercontent.com/analysis-tools-dev/assets/master/static/sponsors/offensive360.png" /> </a> </td> </tr> </table> If you also want to support this project, head over to our [Github sponsors page](https://github.com/sponsors/analysis-tools-dev). ## Meaning of Symbols: - :copyright: stands for proprietary software. All other tools are Open Source. - :information_source: indicates that the community does not recommend to use this tool for new projects anymore. The icon links to the discussion issue. - :warning: means that this tool was not updated for more than 1 year, or the repo was archived. Pull requests are very welcome! Also check out the sister project, [awesome-dynamic-analysis](https://github.com/mre/awesome-dynamic-analysis). ## Table of Contents #### [Programming Languages](#programming-languages-1) - [ABAP](#abap) - [Ada](#ada) - [Assembly](#asm) - [Awk](#awk) - [C](#c) - [C#](#csharp) - [C++](#cpp) - [Clojure](#clojure) - [CoffeeScript](#coffeescript) - [ColdFusion](#coldfusion) - [Crystal](#crystal) - [Dart](#dart) - [Delphi](#delphi) - [Dlang](#dlang) - [Elixir](#elixir) - [Elm](#elm) - [Erlang](#erlang) - [F#](#fsharp) - [Fortran](#fortran) - [Go](#go) - [Groovy](#groovy) - [Haskell](#haskell) - [Haxe](#haxe) - [Java](#java) - [JavaScript](#javascript) - [Julia](#julia) - [Kotlin](#kotlin) - [Lua](#lua) - [MATLAB](#matlab) - [Nim](#nim) - [Ocaml](#ocaml) - [PHP](#php) - [PL/SQL](#plsql) - [Perl](#perl) - [Python](#python) - [R](#r) - [Rego](#rego) - [Ruby](#ruby) - [Rust](#rust) - [SQL](#sql) - [Scala](#scala) - [Shell](#shell) - [Swift](#swift) - [Tcl](#tcl) - [TypeScript](#typescript) - [Verilog/SystemVerilog](#verilog) - [Vim Script](#vim-script) - [WebAssembly](#wasm) #### [Multiple Languages](#multiple-languages-1) #### [Other](#other-1) <details> <summary>Show Other</summary> - [.env](#dotenv) - [Ansible](#ansible) - [Archive](#archive) - [Azure Resource Manager](#arm) - [Binaries](#binary) - [Build tools](#buildtool) - [CSS/SASS/SCSS](#css) - [Config Files](#configfile) - [Configuration Management](#configmanagement) - [Containers](#container) - [Continuous Integration](#ci) - [Deno](#deno) - [Dockerfile](#dockerfile) - [Embedded](#embedded) - [Embedded [Ruby](/@harrisonqian/awesome/wiki/programming-languages/ruby) (a.k.a. ERB, eRuby)](#erb) - [Gherkin](#gherkin) - [HTML](#html) - [JSON](#json) - [Kubernetes](#kubernetes) - [LaTeX](#latex) - [Laravel](#laravel) - [Makefiles](#make) - [Markdown](#markdown) - [Metalinter](#meta) - [Mobile](#mobile) - [Nix](#nix) - [Node.js](#nodejs) - [Packages](#package) - [Prometheus](#prometheus) - [Protocol Buffers](#protobuf) - [Puppet](#puppet) - [Rails](#rails) - [Security/SAST](#security) - [Smart Contracts](#smart-contracts) - [Support](#support) - [Template-Languages](#template) - [Terraform](#terraform) - [Translation](#translation) - [Vue.js](#vue) - [Writing](#writing) - [YAML](#yaml) - [git](#git) </details> --- ## Programming Languages <a name="abap" /> <h2>ABAP</h2> - [abaplint](https://abaplint.org) — Linter for ABAP, written in TypeScript. - [abapOpenChecks](https://docs.abapopenchecks.org) — Enhances the SAP Code Inspector with new and customizable checks. <a name="ada" /> <h2>Ada</h2> - [Polyspace for Ada](https://www.mathworks.com/products/polyspace-ada.html) :copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in source code. - [SPARK](https://www.adacore.com/about-spark) :copyright: — Static analysis and formal verification toolset for Ada. <a name="asm" /> <h2>Assembly</h2> - **STOKE** :warning: — A programming-language agnostic stochastic optimizer for the x86_64 instruction set. It uses random search to explore the extremely high-dimensional space of all possible program transformations. <a name="awk" /> <h2>Awk</h2> - [gawk --lint](https://www.gnu.org/software/gawk/manual/html_node/Options.html) — Warns about constructs that are dubious or nonportable to other awk implementations. <a name="c" /> <h2>C</h2> - [Astrée](https://www.absint.com/astree/index.htm) :copyright: — Astrée automatically proves the absence of runtime errors and invalid concurrent behavior in C/C++ applications. It is sound for floating-point computations, very fast, and exceptionally precise. The analyzer also checks for MISRA/CERT/CWE/Adaptive Autosar coding rules and supports qualification for ISO 26262, DO-178C level A, and other safety [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards). Jenkins and Eclipse plugins are available. - [CBMC](http://www.cprover.org/cbmc) — Bounded model-checker for C programs, user-defined assertions, standard assertions, several coverage metric analyses. - [clang-tidy](https://clang.llvm.org/extra/clang-tidy) — Clang-based C++ linter tool with the (limited) ability to fix issues, too. - [clazy](https://github.com/KDE/clazy) — Qt-oriented static code analyzer based on the Clang framework. clazy is a compiler plugin which allows clang to understand Qt semantics. You get more than 50 Qt related compiler warnings, ranging from unneeded memory allocations to misusage of API, including fix-its for automatic refactoring. - [CMetrics](https://github.com/MetricsGrimoire/CMetrics) — Measures size and complexity for C files. - [CPAchecker](https://cpachecker.sosy-lab.org) — A tool for configurable software verification of C programs. The name CPAchecker was chosen to reflect that the tool is based on the CPA concepts and is used for checking software programs. - [cppcheck](https://cppcheck.sourceforge.io) — Static analysis of C/C++ code. - [CppDepend](https://www.cppdepend.com) :copyright: — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity. - [cpplint](https://github.com/cpplint/cpplint) — Automated C++ checker that follows Google's style guide. - [cqmetrics](https://github.com/dspinellis/cqmetrics) — Quality metrics for C code. - [CScout](https://www.spinellis.gr/cscout) — Complexity and quality metrics for C and C preprocessor code. - **ENRE-cpp** :warning: — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-cpp is a ENtity Relationship Extractor for C/C++ based on @eclipse/CDT. (Under development) - [ESBMC](http://esbmc.org) — ESBMC is an open source, permissively licensed, context-bounded model checker based on satisfiability modulo theories for the verification of single- and multi-threaded C/C++ programs. - **flawfinder** :warning: — Finds possible [security](/@harrisonqian/awesome/wiki/security/security) weaknesses. - **flint++** :warning: — [Cross-platform](/@harrisonqian/awesome/wiki/platforms/cross-platform), zero-dependency port of flint, a lint program for C++ developed and used at Facebook. - [Frama-C](https://www.frama-c.com) — A sound and extensible static analyzer for C code. - [GCC](https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html) — The GCC compiler has static analysis capabilities since version 10. This option is only available if GCC was configured with analyzer support enabled. It can also output its diagnostics to a [JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) file in the SARIF format (from v13). - [Goblint](https://goblint.in.tum.de) — A static analyzer for the analysis of multi-threaded C programs. Its primary focus is the detection of data races, but it also reports other runtime errors, such as buffer overflows and null-pointer dereferences. - [Helix QAC](https://www.perforce.com/products/helix-qac) :copyright: — Enterprise-grade static analysis for embedded software. Supports MISRA, CERT, and AUTOSAR coding [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards). - [IKOS](https://github.com/nasa-sw-vnv/ikos) — A sound static analyzer for C/C++ code based on LLVM. - [KLEE](http://klee.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/) — A dynamic symbolic execution engine built on top of the LLVM compiler infrastructure. It can auto-generate test cases for programs such that the test cases exercise as much of the program as possible. - [LDRA](https://ldra.com) :copyright: — A tool suite including static analysis (TBVISION) to various [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards) including MISRA C & C++, JSF++ AV, CWE, CERT C, CERT C++ & Custom Rules. - **MATE** :warning: — A suite of tools for interactive program analysis with a focus on hunting for bugs in C and C++ code. MATE unifies application-specific and low-level vulnerability analysis using code property graphs (CPGs), enabling the discovery of highly application-specific vulnerabilities that depend on both implementation details and the high-level semantics of target C/C++ programs. - [PC-lint](https://pclintplus.com/) :copyright: — Static analysis for C/C++. Runs natively under [Windows](/@harrisonqian/awesome/wiki/platforms/windows)/[Linux](/@harrisonqian/awesome/wiki/platforms/linux)/MacOS. Analyzes code for virtually any platform, supporting C11/C18 and C++17. - [Phasar](https://phasar.org) — A LLVM-based static analysis framework which comes with a taint and type state analysis. - [Polyspace Bug Finder](https://www.mathworks.com/products/polyspace-bug-finder.html) :copyright: — Identifies run-time errors, concurrency issues, [security](/@harrisonqian/awesome/wiki/security/security) vulnerabilities, and other defects in C and C++ embedded software. - [Polyspace Code Prover](https://www.mathworks.com/products/polyspace-code-prover.html) :copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in C and C++ source code. - [scan-build](https://clang-analyzer.llvm.org/scan-build.html) — Frontend to drive the Clang Static Analyzer built into Clang via a regular build. - [splint](http://splint.org) — Annotation-assisted static program checker. - [SVF](https://svf-tools.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/SVF) — A static tool that enables scalable and precise interprocedural dependence analysis for C and C++ programs. - [TrustInSoft Analyzer](https://trust-in-soft.com) :copyright: — Exhaustive detection of coding errors and their associated [security](/@harrisonqian/awesome/wiki/security/security) vulnerabilities. This encompasses a sound undefined behavior detection (buffer overflows, out-of-bounds array accesses, null-pointer dereferences, use-after-free, divide-by-zeros, uninitialized memory accesses, signed overflows, invalid pointer arithmetic, etc.), data flow and control flow verification as well as full functional verification of formal specifications. All versions of C up to C18 and C++ up to C++20 are supported. TrustInSoft Analyzer will acquire ISO 26262 qualification in Q2'2023 (TCL3). A MISRA C checker is also bundled. - **vera++** :warning: — Vera++ is a programmable tool for verification, analysis and transformation of C++ source code. <a name="csharp" /> <h2>C#</h2> - [.NET Analyzers](https://github.com/DotNetAnalyzers) — An organization for the development of analyzers (diagnostics and code fixes) using the .NET Compiler Platform. - [ArchUnitNET](https://github.com/TNG/ArchUnitNET) — A C# architecture test library to specify and assert architecture rules in C# for automated [testing](/@harrisonqian/awesome/wiki/testing/testing). - [code-cracker](https://code-cracker.[github](/@harrisonqian/awesome/wiki/development-environment/github).io) — An analyzer library for C# and VB that uses [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn) to produce refactorings, code analysis, and other niceties. - **CSharpEssentials** :warning: — C# Essentials is a collection of [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn) diagnostic analyzers, code fixes and refactorings that make it easy to work with C# 6 language features. - [Designite](http://www.designite-tools.com) :copyright: — Designite supports detection of various architecture, design, and implementation smells, computation of various code quality metrics, and trend analysis. - [Gendarme](https://www.mono-project.com/docs/tools+libraries/tools/gendarme) — Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET). - **Infer#** :warning: — InferSharp (also referred to as Infer#) is an interprocedural and scalable static code analyzer for C#. Via the capabilities of Facebook's Infer, this tool detects null pointer dereferences and resource leaks. - [Meziantou.Analyzer](https://github.com/meziantou/Meziantou.Analyzer) — A [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn) analyzer to enforce some good practices in C# in terms of design, usage, [security](/@harrisonqian/awesome/wiki/security/security), performance, and style. - [NDepend](http://www.ndepend.com) :copyright: — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity. - [Puma Scan](https://pumasecurity.io) — Puma Scan provides real time secure code analysis for common vulnerabilities (XSS, SQLi, CSRF, LDAPi, crypto, deserialization, etc.) as development teams write code in Visual Studio. - [Roslynator](https://github.com/JosefPihrt/Roslynator) — A collection of 190+ analyzers and 190+ refactorings for C#, powered by [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn). - [SonarAnalyzer.CSharp](https://github.com/SonarSource/sonar-dotnet) — These [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn) analyzers allow you to produce Clean Code that is safe, reliable, and maintainable by helping you find and correct bugs, vulnerabilities, and code smells in your codebase. - **VSDiagnostics** :warning: — A collection of static analyzers based on [Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn) that integrates with VS. - [Wintellect.Analyzers](https://github.com/Wintellect/Wintellect.Analyzers) — .NET Compiler Platform ("[Roslyn](/@harrisonqian/awesome/wiki/platforms/roslyn)") diagnostic analyzers and code fixes. <a name="cpp" /> <h2>C++</h2> - [Astrée](https://www.absint.com/astree/index.htm) :copyright: — Astrée automatically proves the absence of runtime errors and invalid concurrent behavior in C/C++ applications. It is sound for floating-point computations, very fast, and exceptionally precise. The analyzer also checks for MISRA/CERT/CWE/Adaptive Autosar coding rules and supports qualification for ISO 26262, DO-178C level A, and other safety [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards). Jenkins and Eclipse plugins are available. - [CBMC](http://www.cprover.org/cbmc) — Bounded model-checker for C programs, user-defined assertions, standard assertions, several coverage metric analyses. - [clang-tidy](https://clang.llvm.org/extra/clang-tidy) — Clang-based C++ linter tool with the (limited) ability to fix issues, too. - [clazy](https://github.com/KDE/clazy) — Qt-oriented static code analyzer based on the Clang framework. clazy is a compiler plugin which allows clang to understand Qt semantics. You get more than 50 Qt related compiler warnings, ranging from unneeded memory allocations to misusage of API, including fix-its for automatic refactoring. - [CMetrics](https://github.com/MetricsGrimoire/CMetrics) — Measures size and complexity for C files. - [cppcheck](https://cppcheck.sourceforge.io) — Static analysis of C/C++ code. - [CppDepend](https://www.cppdepend.com) :copyright: — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity. - [cpplint](https://github.com/cpplint/cpplint) — Automated C++ checker that follows Google's style guide. - [cqmetrics](https://github.com/dspinellis/cqmetrics) — Quality metrics for C code. - [CScout](https://www.spinellis.gr/cscout) — Complexity and quality metrics for C and C preprocessor code. - **ENRE-cpp** :warning: — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-cpp is a ENtity Relationship Extractor for C/C++ based on @eclipse/CDT. (Under development) - [ESBMC](http://esbmc.org) — ESBMC is an open source, permissively licensed, context-bounded model checker based on satisfiability modulo theories for the verification of single- and multi-threaded C/C++ programs. - **flawfinder** :warning: — Finds possible [security](/@harrisonqian/awesome/wiki/security/security) weaknesses. - **flint++** :warning: — [Cross-platform](/@harrisonqian/awesome/wiki/platforms/cross-platform), zero-dependency port of flint, a lint program for C++ developed and used at Facebook. - [GCC](https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html) — The GCC compiler has static analysis capabilities since version 10. This option is only available if GCC was configured with analyzer support enabled. It can also output its diagnostics to a [JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) file in the SARIF format (from v13). - [Helix QAC](https://www.perforce.com/products/helix-qac) :copyright: — Enterprise-grade static analysis for embedded software. Supports MISRA, CERT, and AUTOSAR coding [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards). - [IKOS](https://github.com/nasa-sw-vnv/ikos) — A sound static analyzer for C/C++ code based on LLVM. - [KLEE](http://klee.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/) — A dynamic symbolic execution engine built on top of the LLVM compiler infrastructure. It can auto-generate test cases for programs such that the test cases exercise as much of the program as possible. - [LDRA](https://ldra.com) :copyright: — A tool suite including static analysis (TBVISION) to various [standards](/@harrisonqian/awesome/wiki/miscellaneous/standards) including MISRA C & C++, JSF++ AV, CWE, CERT C, CERT C++ & Custom Rules. - **MATE** :warning: — A suite of tools for interactive program analysis with a focus on hunting for bugs in C and C++ code. MATE unifies application-specific and low-level vulnerability analysis using code property graphs (CPGs), enabling the discovery of highly application-specific vulnerabilities that depend on both implementation details and the high-level semantics of target C/C++ programs. - [PC-lint](https://pclintplus.com/) :copyright: — Static analysis for C/C++. Runs natively under Windows/Linux/MacOS. Analyzes code for virtually any platform, supporting C11/C18 and C++17. - [Phasar](https://phasar.org) — A LLVM-based static analysis framework which comes with a taint and type state analysis. - [Polyspace Bug Finder](https://www.mathworks.com/products/polyspace-bug-finder.html) :copyright: — Identifies run-time errors, concurrency issues, [security](/@harrisonqian/awesome/wiki/security/security) vulnerabilities, and other defects in C and C++ embedded software. - [Polyspace Code Prover](https://www.mathworks.com/products/polyspace-code-prover.html) :copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in C and C++ source code. - [scan-build](https://clang-analyzer.llvm.org/scan-build.html) — Frontend to drive the Clang Static Analyzer built into Clang via a regular build. - [splint](http://splint.org) — Annotation-assisted static program checker. - [SVF](https://svf-tools.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/SVF) — A static tool that enables scalable and precise interprocedural dependence analysis for C and C++ programs. - [TrustInSoft Analyzer](https://trust-in-soft.com) :copyright: — Exhaustive detection of coding errors and their associated [security](/@harrisonqian/awesome/wiki/security/security) vulnerabilities. This encompasses a sound undefined behavior detection (buffer overflows, out-of-bounds array accesses, null-pointer dereferences, use-after-free, divide-by-zeros, uninitialized memory accesses, signed overflows, invalid pointer arithmetic, etc.), data flow and control flow verification as well as full functional verification of formal specifications. All versions of C up to C18 and C++ up to C++20 are supported. TrustInSoft Analyzer will acquire ISO 26262 qualification in Q2'2023 (TCL3). A MISRA C checker is also bundled. - **vera++** :warning: — Vera++ is a programmable tool for verification, analysis and transformation of C++ source code. <a name="clojure" /> <h2>Clojure</h2> - [clj-kondo](https://github.com/borkdude/clj-kondo) — A linter for [Clojure](/@harrisonqian/awesome/wiki/programming-languages/clojure) code that sparks joy. It informs you about potential errors while you are [typing](/@harrisonqian/awesome/wiki/programming-languages/typing). <a name="coffeescript" /> <h2>CoffeeScript</h2> - **coffeelint** :warning: — A style checker that helps keep CoffeeScript code clean and consistent. <a name="coldfusion" /> <h2>ColdFusion</h2> - [Fixinator](https://fixinator.app) :copyright: — Static [security](/@harrisonqian/awesome/wiki/security/security) code analysis for [ColdFusion](/@harrisonqian/awesome/wiki/programming-languages/coldfusion) or CFML code. Designed to work within a CI pipeline or from the developers terminal. <a name="crystal" /> <h2>Crystal</h2> - [ameba](https://crystal-ameba.[github](/@harrisonqian/awesome/wiki/development-environment/github).io) — A static code analysis tool for [Crystal](/@harrisonqian/awesome/wiki/programming-languages/crystal). - [crystal](https://crystal-lang.org) — The [Crystal](/@harrisonqian/awesome/wiki/programming-languages/crystal) compiler has built-in linting functionality. <a name="dart" /> <h2>Dart</h2> - **[Dart](/@harrisonqian/awesome/wiki/programming-languages/dart) Code Metrics** :warning: — Additional linter for Dart. Reports code metrics, checks for anti-patterns and provides additional rules for Dart analyzer. - [effective_dart](https://pub.dev/packages/effective_dart) — Linter rules corresponding to the guidelines in Effective [Dart](/@harrisonqian/awesome/wiki/programming-languages/dart) - **lint** :warning: — An opinionated, community-driven set of lint rules for [Dart](/@harrisonqian/awesome/wiki/programming-languages/dart) and [Flutter](/@harrisonqian/awesome/wiki/platforms/flutter) projects. Like pedantic but stricter - **Linter for [dart](/@harrisonqian/awesome/wiki/programming-languages/dart)** :warning: — Style linter for Dart. <a name="delphi" /> <h2>Delphi</h2> - [DelphiLint](https://github.com/integrated-application-development/delphilint) — A Delphi IDE package providing on-the-fly code analysis and linting, powered by SonarDelphi. - [Fix Insight](https://www.tmssoftware.com/site/fixinsight.asp) :copyright: — A free IDE Plugin for static code analysis. A _Pro_ edition includes a command line tool for automation purposes. - [Pascal Analyzer](https://peganza.com/products_pal.html) :copyright: — A static code analysis tool with numerous reports. A free _Lite_ version is available with limited reporting. - [Pascal Expert](https://peganza.com/products_pex.html) :copyright: — IDE plugin for code analysis. Includes a subset of [Pascal](/@harrisonqian/awesome/wiki/programming-languages/pascal) Analyzer reporting capabilities and is available for Delphi versions 2007 and later. - [SonarDelphi](https://github.com/integrated-application-development/sonar-delphi) — Delphi static analyzer for the SonarQube code quality platform. <a name="dlang" /> <h2>Dlang</h2> - [D-scanner](https://github.com/dlang-community/D-Scanner) — D-Scanner is a tool for analyzing D source code. <a name="elixir" /> <h2>Elixir</h2> - [credo](https://github.com/rrrene/credo) — A static code analysis tool with a focus on code consistency and teaching. - [dialyxir](https://github.com/jeremyjh/dialyxir) — Mix tasks to simplify use of Dialyzer in [Elixir](/@harrisonqian/awesome/wiki/programming-languages/elixir) projects. - [sobelow](https://github.com/nccgroup/sobelow) — [Security](/@harrisonqian/awesome/wiki/security/security)-focused static analysis for the Phoenix Framework. <a name="elm" /> <h2>Elm</h2> - **elm-analyse** :warning: — A tool that allows you to analyse your Elm code, identify deficiencies and apply best practices. - [elm-review](https://package.elm-lang.org/packages/jfmengels/elm-review/latest) — Analyzes whole Elm projects, with a focus on shareable and custom rules written in Elm that add guarantees the Elm compiler doesn't give you. <a name="erlang" /> <h2>Erlang</h2> - [dialyzer](https://www.[erlang](/@harrisonqian/awesome/wiki/programming-languages/erlang).org/doc/man/dialyzer.html) — The DIALYZER, a DIscrepancy AnaLYZer for [ERlang](/@harrisonqian/awesome/wiki/programming-languages/erlang) programs. Dialyzer is a static analysis tool that identifies software discrepancies, such as definite type errors, code that has become dead or unreachable because of programming error, and unnecessary tests, in single Erlang modules or entire (sets of) applications. Dialyzer starts its analysis from either debug-compiled BEAM bytecode or from Erlang source code. The file and line number of a discrepancy is reported along with an indication of what the discrepancy is about. Dialyzer bases its analysis on the concept of success typings, which allows for sound warnings (no false positives). - [elvis](https://github.com/inaka/elvis) — [Erlang](/@harrisonqian/awesome/wiki/programming-languages/erlang) Style Reviewer. - **Primitive [Erlang](/@harrisonqian/awesome/wiki/programming-languages/erlang) [Security](/@harrisonqian/awesome/wiki/security/security) Tool (PEST)** :warning: — A tool to do a basic scan of Erlang source code and report any function calls that may cause Erlang source code to be insecure. <a name="fsharp" /> <h2>F#</h2> - [fantomas](https://fsprojects.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/fantomas/) — F# source code formatter. - [FSharpLint](https://github.com/fsprojects/FSharpLint) — Lint tool for F#. - [ionide-analyzers](https://ionide.io/ionide-analyzers/) — A collection of F# analyzers, built with the FSharp.Analyzers.SDK. <a name="fortran" /> <h2>Fortran</h2> - [Fortitude](https://fortitude.readthedocs.io) — [Fortran](/@harrisonqian/awesome/wiki/programming-languages/fortran) linter, inspired by (and built on) Ruff, and based on community best practices. Supports latest [Fortran](/@harrisonqian/awesome/wiki/programming-languages/fortran) (2023) standard. - [fprettify](https://pypi.[python](/@harrisonqian/awesome/wiki/programming-languages/python).org/pypi/fprettify) — Auto-formatter for modern [fortran](/@harrisonqian/awesome/wiki/programming-languages/fortran) source code, written in [Python](/@harrisonqian/awesome/wiki/programming-languages/python). Fprettify is a tool that provides consistent whitespace, indentation, and delimiter alignment in code, including the ability to change letter case and handle preprocessor directives, all while preserving revision history and tested for editor integration. - **i-Code CNES for [Fortran](/@harrisonqian/awesome/wiki/programming-languages/fortran)** :warning: — An open source static code analysis tool for Fortran 77, Fortran 90 and [Shell](/@harrisonqian/awesome/wiki/development-environment/shell). <a name="go" /> <h2>Go</h2> - [aligncheck](https://gitlab.com/opennota/check) — Find inefficiently packed structs. - [bodyclose](https://github.com/timakin/bodyclose) — Checks whether HTTP response body is closed. - [deadcode](https://github.com/tsenart/deadcode) — Finds unused code. - **dingo-hunter** :warning: — Static analyser for finding deadlocks in Go. - [dogsled](https://github.com/alexkohler/dogsled) — Finds assignments/declarations with too many blank identifiers. - [dupl](https://github.com/mibk/dupl) — Reports potentially duplicated code. - [errcheck](https://github.com/kisielk/errcheck) — Check that error return values are used. - **errwrap** :warning: — Wrap and fix Go errors with the new %w verb directive. This tool analyzes fmt.Errorf() calls and reports calls that contain a verb directive that is different than the new %w verb directive introduced in Go v1.13. It's also capable of rewriting calls to use the new %w wrap verb directive. - [flen](https://github.com/lafolle/flen) — Get info on length of functions in a Go package. - **Go Meta Linter** :warning: — Concurrently run Go lint tools and normalise their output. Use `golangci-lint` for new projects. - [go tool vet --shadow](https://golang.org/cmd/vet#hdr-Shadowed_variables) — Reports variables that may have been unintentionally shadowed. - [go vet](https://golang.org/cmd/vet) — Examines Go source code and reports suspicious. - **go-consistent** :warning: — Analyzer that helps you to make your Go programs more consistent. - [go-critic](https://github.com/go-critic/go-critic) — Go source code linter that maintains checks which are currently not implemented in other linters. - [go/ast](https://golang.org/pkg/go/ast) — Package ast declares the types used to represent syntax trees for Go packages. - [goast](https://github.com/m-mizutani/goast) — Go AST (Abstract Syntax Tree) based static analysis tool with Rego. - **gochecknoglobals** :warning: — Checks that no globals are present. - [goconst](https://github.com/jgautheron/goconst) — Finds repeated strings that could be replaced by a constant. - [gocyclo](https://github.com/fzipp/gocyclo) — Calculate cyclomatic complexities of functions in Go source code. - [gofmt -s](https://golang.org/cmd/gofmt) — Checks if the code is properly formatted and could not be further simplified. - [gofumpt](https://github.com/mvdan/gofumpt) — Enforce a stricter format than `gofmt`, while being backwards-compatible. That is, `gofumpt` is happy with a subset of the formats that `gofmt` is happy with. The tool is a fork of `gofmt` as of Go 1.19, and requires Go 1.18 or later. It can be used as a drop-in replacement to format your Go code, and running gofmt after gofumpt should produce no changes. `gofumpt` will never add rules which disagree with `gofmt` formatting. So we extend `gofmt` rather than compete with it. - [goimports](https://pkg.go.dev/golang.org/x/tools/cmd/goimports) — Checks missing or unreferenced package imports. - [gokart](https://github.com/praetorian-inc/gokart) — Golang [security](/@harrisonqian/awesome/wiki/security/security) analysis with a focus on minimizing false positives. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe. - [GolangCI-Lint](https://golangci-lint.run) — Alternative to `Go Meta Linter`: GolangCI-Lint is a linters aggregator. - [golint](https://github.com/golang/lint) — Prints out coding style mistakes in Go source code. - [goreporter](https://github.com/360EntSecGroup-Skylar/goreporter) — Concurrently runs many linters and normalises their output to a report. - [goroutine-inspect](https://github.com/linuxerwang/goroutine-inspect) — An interactive tool to analyze Golang goroutine dump. - [gosec (gas)](https://securego.io) — Inspects source code for [security](/@harrisonqian/awesome/wiki/security/security) problems by scanning the Go AST. - [gotype](https://pkg.go.dev/golang.org/x/tools/cmd/gotype) — Syntactic and semantic analysis similar to the Go compiler. - [govulncheck](https://go.dev/blog/vuln) — Govulncheck reports known vulnerabilities that affect Go code. It uses static analysis of source code or a binary's symbol table to narrow down reports to only those that could affect the application. --- *truncated — [full list on GitHub](https://github.com/analysis-tools-dev/static-analysis)*