Static Analysis Tools & Linters

What it is

The README of analysis-tools-dev/static-analysis lists static analysis tools by language, build tool and config format. Its stated focus is code quality (linters, formatters), and the analysis-tools.dev site adds rankings and comments on top. Each entry carries a one-line description and up to three markers. For a security reader, the markers and the split between active and deprecated sections matter more than the list itself.

How to read the markers

• ©️ means proprietary. Every untagged tool is open source.
• ℹ️ means the community does not recommend the tool for new projects. The icon links to a discussion issue.
• ⚠️ means no update for more than one year, or an archived repository. These entries sit under collapsed "Show Deprecated" blocks.

Entry criteria for new tools are at least six months of history, 20 GitHub stars and more than one human contributor. Passing them says nothing about detection quality.

Security tools by language

Entries in the main (non-deprecated) lists, from the part of the page that was fetched:

• C/C++: flawfinder, cppcheck, Phasar (taint and typestate), CBMC, ESBMC, Frama-C, GCC's analyzer (since version 10, SARIF output from version 13), plus commercial TrustInSoft, Polyspace, Helix QAC, LDRA and Astrée.
• C#: Puma Scan (XSS, SQLi, CSRF, deserialization in Visual Studio), SonarAnalyzer.CSharp.
• Go: gosec, govulncheck, OSV-Scanner.
• Java: Mariana Trench (Dalvik bytecode, built for very large codebases), SpotBugs, Checker Framework.
• JavaScript: NodeJSScan, retire.js.
• PHP: Psalm, PHPStan, WAP, Symfony Insight (commercial).
• Python: bandit, Dlint, pip-audit, Safety, Pysa.
• Ruby: brakeman, bundler-audit.
• Rust: cargo-audit, cargo-deny, cargo-geiger, Kani, Rudra, rust-audit.
• Others: Fixinator (ColdFusion, commercial), Stan (Haskell), zarn (Perl), pgspot (PostgreSQL extension scripts).

Tools the summary names that need a caveat

OWASP Dependency Check is tagged ⚠️ and sits under Java's deprecated block. The page does not say whether it is archived or only stale. Check its repository before adopting it. Pyre-check is described as superseded by Pyrefly, and Pysa is built on pyre-check.

Other security tools in deprecated blocks: weggli, MATE, IKOS, gokart, safesql, shisho, JSPrime, sobelow, MIRAI, CogniCrypt, steady, py-find-injection, PyT, Railroader, dawnscanner, Progpilot, Enlightn, Parse and PEST.

What to do

Pick tools per language from the main lists, not the deprecated blocks, and verify repository activity yourself, because the ⚠️ flag is a one-year staleness test. Separate source scanners (gosec, bandit, brakeman) from dependency vulnerability scanners (govulncheck, pip-audit, cargo-audit, OSV-Scanner), since the list mixes both. Per the page, govulncheck narrows results to vulnerabilities that could affect the application, and its requests to vuln.go.dev contain only module paths.

Caveats

The fetched text was cut off at 60,000 of about 150,000 characters, in the SQL section. Languages and categories after that point (for example Swift, Terraform, TypeScript, YAML, and anything else later in the alphabet) are not covered here. The page gives one-line descriptions only, with no detection benchmarks, rule counts for most tools, or comparisons. Some C/C++ entries appear twice in the fetched text.