static-analysis — independent software & tools
-
Delphi-RAG-Lint
Delphi-native, MIT-licensed RAG + linter for Delphi/Pascal source code. Symbol-exact + fuzzy + tree-sitter lint. Pure Delphi at runtime.
-
runbookproof
Continuously verify commands in documentation, runbooks, and AI-generated instructions.
-
swift-isolation-map
Static actor isolation and data-race analysis for Swift projects
-
Synaptic
Auditable code intelligence for AI agents - map dependencies, predict change impact, select the right tests, and verify refactors before they ship.
-
runar-forge
Persistent, semantically-searchable memory and a symbol-level code graph for AI coding agents. One static Rust binary — SQLite or PostgreSQL, MCP-compatible.
-
mori
Explainable, local structural similarity for Go, JavaScript, TypeScript, Python, and Rust.
-
lattice
Architecture governance for human and AI-built codebases — map dependencies, enforce boundaries, and prevent architectural drift.
-
amiss
Checks documentation against the repository tree it describes
-
open-mind
Understand any unfamiliar codebase in an afternoon — a local, deterministic, source-traceable knowledge index (glossary · graphs · code search) that never invents what isn't there.
-
mql5-codegraph
Evidence-backed static code graph intelligence for MQL5 repositories, with CLI, dashboard, reference corpus, and an experimental Codex MCP plugin.
-
ai-code-reviewer
🔍 AI-powered automated code review tool that analyzes syntax, performance bottlenecks, and security flaws in pull requests.
-
lintforge
Pluggable static analysis framework for Dart and Flutter projects.
-
sober-coding
Analyze AI-generated code to find technical debt and get actionable fixes.
-
repogent
Safe, reviewable Python repository changes with explicit approvals and deterministic validation.
-
scrut
Review your code before it leaves your machine.
-
repopilot
Local-first CLI for reviewing Git changes, security boundaries, and blast radius before merge.
-
pr-review-core
Reusable Rust engine (crate) for a self-hosted advisory AI PR reviewer — reviews GitHub, GitLab & Bitbucket PRs via OpenRouter (Claude). Line-anchored inline comments, tree-sitter structural context, OSV.dev dependency CVE scans, and /ask + /describe commands. Powers the pr-review-bot service.
-
svelte-vitals
A static code-health checker for SvelteKit — SEO, Performance, Correctness, Security, and Architecture, from source. Not a runtime Web Vitals reporter.
-
sqlike
sqlike clients — CLI + MCP (thin remote clients for the sqlike SQL analyzer)
-
sqlike
MCP server and CLI for sqlike: deterministic SQL analysis and query-equivalence checking. Tokenizes locally, so your real table names and values never leave your machine.
-
ovecc
CLI-first, deterministic architecture intelligence. Builds an offline model of your repo to answer impact, cycles, dead code, duplication and security, and enforces your architecture as a contract in CI. No LLM in the loop; usable by coding agents over MCP.
-
a-check
Cross-language hexagonal-architecture checker — deterministic, read-only, text-heuristic; shipped as a digest-pinned container image.
-
holt
Know what your agents made, and don't lose any of it — what each worktree produced, which ones collide, which are safe to delete, and a guard that stops an agent deleting work that exists nowhere else.
-
archunit-lens
ArchUnit rules as live IntelliJ inspections.
-
codegraph-rust
Deterministic tree-sitter + SQLite/FTS5 code knowledge graph for AI coding agents — symbol/call/dependency graph over a CLI and an MCP server. No AI/LLM inside; byte-stable output.
-
arcready
Open-source Arc-specific static CI quality gate and integration-pattern validator for wallets, bridges, App Kit integrations, and dApps.
-
trustabl-action
GitHub Action that runs trustabl — static reliability/safety analyzer for AI agent SDKs (Claude, OpenAI, Google ADK, MCP). Gates CI on risk + severity.
-
archunit
ArchUnit TypeScript is an architecture testing library, to specify and assert architecture rules in your TypeScript app
-
fallow
Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution
-
gitnexus
Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.
-
lopper
measure dependency waste and attack surface before it ships
-
codeindex
AI-readable codebase navigation indexes (README_AI.md) via a deterministic CLI — coding agents navigate faster, with fewer tokens. A/B-benchmarked.
-
raven
Static analyzer for R
-
py-lintro
Making linters play nice... Mostly.
-
deprecated-tracker
Find and manage deprecated code in TypeScript and JavaScript projects. Tracks declarations and every usage, with inline diagnostics, ignore rules and export.
-
xslint
XSL Linter
-
solium
Linter to identify and fix Style & Security issues in Solidity