ShellCheck is a tool that gives warnings and suggestions for bash / sh shell scripts. It helps to clarify typical beginner's syntax issues that cause a shell to give cryptic error messages. Identifies intermediate level semantic problems that cause a shell to behave strangely and counter-intuitively. It points out corner cases and pitfalls that may cause an advanced user's otherwise working script to fail under future circumstances.

ShellCheck - A static analysis tool for shell scripts

Semgrep is a command-line tool for offline static analysis. Use pre-built or custom rules to enforce code and security standards in your codebase. Semgrep combines the convenient and iterative style of grep with the powerful features of an Abstract Syntax Tree (AST) matcher and limited dataflow. Easily find function calls, class or method definitions, and more without having to understand ASTs or wrestle with regexes.
 
It addressess OWASP Top 10 Issues and also helps to write own rules. It can hunt vulnerabilities, Eradicate classes of bugs by enforcing code guardrails.

Semgrep is a command-line tool for offline static analysis. Use pre-built or custom rules to enforce code and security standards in your codebase. Semgrep combines the convenient and iterative style of grep with the powerful features of an Abstract Syntax Tree (AST) matcher and limited dataflow. Easily find function calls, class or method definitions, and more without having to understand ASTs or wrestle with regexes.

Semgrep - Lightweight static analysis for many languages

Spoon is an open-source library to analyze, rewrite, transform, transpile Java source code. It parses source files to build a well-designed AST with powerful analysis and transformation API. It fully supports Java 8, Java 9 and Java 10. Spoon is an official Inria open-source project, and member of the OW2 open-source consortium. 

Spoon - Library to analyze, transform, rewrite, transpile Java source code (incl Java 8)

PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It supports Java, JavaScript, Salesforce.com Apex and Visualforce, PLSQL, Apache Velocity, XML, XSL.
 
Additionally it includes CPD, the copy-paste-detector. CPD finds duplicated code in Java, C, C++, C#, Groovy, PHP, Ruby, Fortran, JavaScript, PLSQL, Apache Velocity, Scala, Objective C, Matlab, Python, Go, Swift and Salesforce.com Apex and Visualforce.

PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It supports Java, JavaScript, Salesforce.com Apex and Visualforce, PLSQL, Apache Velocity, XML, XSL.

PMD - An extensible cross-language static code analyzer

cloc (Count Lines Of Code) counts, and computes differences of, comment lines, blank lines, and physical lines of source code in many programming languages.
 
Its features include: 
<ol>
<li>Exists as a single, self-contained file that requires minimal installation effort---just download the file and run it.</li>
<li>Can read language comment definitions from a file and thus potentially work with computer languages that do not yet exist.</li>
<li>Allows results from multiple runs to be summed together by language and by project.</li>
<li>Can produce results in a variety of formats: plain text, SQL, JSON, XML, YAML, comma separated values.</li>
<li>Can count code within compressed archives (tar balls, Zip files, Java .ear files).</li>
<li>Has numerous troubleshooting options.</li>
<li>Handles file and directory names with spaces and other unusual characters.</li>
<li>Has no dependencies outside the standard Perl distribution.</li>
</ol>

cloc (Count Lines Of Code) counts, and computes differences of, comment lines, blank lines, and physical lines of source code in many programming languages.

cloc - Count Lines of Code

 The Anchore Engine is an open source project that provides a centralized service for inspection, analysis and certification of container images. The Anchore engine is provided as a Docker container image that can be run standalone or on an orchestration platform such as Kubernetes, Docker Swarm, Rancher or Amazon ECS. The Anchore engine can be accessed directly through a RESTful API or via the Anchore CLI.

Anchore Engine - Centralized service for inspection, analysis and certification of container images

SpotBugs is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community.  SpotBugs is a program which uses static analysis to look for bugs in Java code. 

SpotBugs - FindBugs' successor, A tool for static analysis to look for bugs in Java code. 

PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code.PHPStan moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be checked before you run the actual line.

PHPStan - PHP Static Analysis Tool - discover bugs in your code without running it!

Catch common Java mistakes as compile-time errors

Error Prone - Catch common Java mistakes as compile-time errors

Educate and Empower software professionals in open source tools and technologies.

Projects