Skip to content
Get packs

Guide · Open source

How to use static-analysis: browse the list of code quality tools

Updated · written with AI from the project's own documentation and checked against our catalogue data

static-analysis is not a program you run. It is an open-source, MIT-licensed list of static analysis tools and linters, which check source code for bugs, style problems and quality issues without running it. This guide shows you how to browse the list, read its symbols, and use it to shortlist tools for a language or project.

Analysis Toolsanalysis-tools-dev/static-analysis · ★ 14.9k · MIT

Quick start

  1. 1Clone the repository. Run the git clone command from the README to get a local copy of the list.
  2. 2Open the table of contents. Find your language, build tool or config file in the Programming Languages, Multiple Languages or Other sections.
  3. 3Read each tool's description. Compare the one-line descriptions to the kind of checks you need, such as bugs, style or security.
  4. 4Check the symbols. Note :copyright: for proprietary tools, :information_source: for tools not recommended for new projects, and :warning: for tools not updated in over a year or archived.
  5. 5Visit the tool's project. Follow the link to the tool's own site or repository to find its installation and usage instructions.
  6. 6Shortlist and test. Pick two or three candidates and evaluate them on your own code, since the list does not rank them.

What static-analysis is and what it is not

The repository is a curated directory. Its README says it lists static analysis tools for all programming languages, build tools, config files and more, with the focus on tools that improve code quality such as linters and formatters.

Because it is a list, there is nothing to install from it. The README gives no install steps for the tools themselves; each entry links to the tool's own project.

  • It is a list, not an installable program.
  • It does not rank tools. The README only lists them.
  • The companion website analysis-tools.dev is built from this repository and adds rankings, user comments and videos.

Clone the repository to browse it locally

If you prefer to read the list offline or search it with your own tools, clone the repository. The README gives this as the only command for working with it.

git clone https://github.com/analysis-tools-dev/static-analysis

Find tools by language, build tool or config file

The README groups entries under Programming Languages, Multiple Languages and Other. The Other section is collapsed under a 'Show Other' toggle and includes categories such as Build tools, Config Files, Dockerfile, Terraform, Markdown, Security/SAST and Continuous Integration.

Start from the category that matches your code. For example, the C section lists tools such as clang-tidy, cppcheck and Frama-C, each with a one-line description. Read the description to see whether it matches the kind of problem you want to catch.

  • Pick the language or file type you work with from the table of contents.
  • Read the one-line description under each tool name.
  • Follow the link to the tool's own site or repository for installation and usage.

Read the symbols before you choose a tool

Each entry can carry a symbol. The README defines three of them, and they matter when you decide what to adopt.

  • :copyright: marks proprietary software. All other tools are open source.
  • :information_source: means the community does not recommend the tool for new projects. The icon links to the discussion issue.
  • :warning: means the tool was not updated for more than one year, or its repository was archived.
  • Deprecated tools are often grouped under a collapsed 'Show Deprecated' section inside their category.

Suggest a tool for the list

The README asks contributors to submit only tools that already meet its contribution criteria, and says not to submit tools before they qualify. The stated criteria are at least six months of history, 20 GitHub stars, and more than one human contributor.

Pull requests with verified criteria failures are closed, but you can resubmit once the criteria are met. Check CONTRIBUTING.md in the repository before you open a pull request.

  • Confirm the tool meets all three criteria listed in the README.
  • Read CONTRIBUTING.md.
  • Do not submit tools that do not yet qualify.

What people use it for

  • Finding a linter for a specific language such as Python, Go or Rust
  • Comparing C/C++ analyzers before choosing one for a team
  • Checking whether a tool is proprietary, deprecated or archived before adopting it
  • Learning which categories of code quality tools exist, from linters to formatters
  • Proposing a new tool for the list once it meets the stated criteria

Frequently asked questions

Is static-analysis free?

The repository is MIT licensed, according to its listing. The tools it lists have their own licences; the README marks proprietary ones with a :copyright: symbol and says all others are open source.

How do I install static-analysis?

You do not install it as a program. The README's only command is git clone https://github.com/analysis-tools-dev/static-analysis, which gives you a local copy of the list to read.

What are the requirements for static-analysis?

The README lists no prerequisites. You need git only if you want to clone the repository locally.

Does static-analysis rank the best tools?

No. The README only lists tools and does not rank them. The companion website analysis-tools.dev adds rankings and comments, which are separate from the repository.

What does the warning symbol mean in the list?

The :warning: symbol means the tool was not updated for more than one year, or its repository was archived. The list includes such entries, so check this symbol before using a tool in an active project.

How is static-analysis different from awesome-security?

static-analysis focuses on static analysis and code quality tools, while awesome-security is a comparable list in a related area. The README names awesome-dynamic-analysis as the sister project for dynamic analysis.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use static-analysis if you want a organized starting point for finding linters and analyzers for a specific language, build tool or config file, or to compare options before choosing. Skip it if you want a ranked recommendation or a program to install, since it only lists tools and includes deprecated entries you will need to filter out yourself.

Install options & downloads