⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

• UpdatedDec 16, 2025
• Rust

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

• UpdatedDec 17, 2025
• OCaml

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

• UpdatedNov 20, 2025
• Go

nodejsscan is a static security code scanner for Node.js applications.

• UpdatedOct 10, 2025
• CSS

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

• UpdatedDec 16, 2025
• Go

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

• UpdatedNov 21, 2023

Security risk analysis for Kubernetes resources

• UpdatedDec 15, 2025
• Go

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。​让安全不再昂贵，让审计不再复杂。

• UpdatedDec 17, 2025
• Python

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

• UpdatedDec 16, 2025
• Go

IDEA静态代码安全审计及漏洞一键修复插件

• UpdatedMar 10, 2022
• Java

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

• UpdatedJan 17, 2025
• Go

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

• UpdatedSep 1, 2023
• Python

Plugin for JADX to integrate MCP server

• UpdatedDec 16, 2025
• Java

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

• UpdatedJan 31, 2025
• Python

基于pytorch的ocr算法库，包括 psenet, pan, dbnet, sast , crnn

• UpdatedMay 19, 2021
• C++

AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing & Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and a marketplace of security tools.

• UpdatedNov 16, 2025
• Python

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Ful…

• UpdatedApr 10, 2022
• Go

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

• UpdatedNov 11, 2025
• Python

Antidote to VibeCoding

• UpdatedDec 17, 2025
• Python

Globstar is a fast, feature-rich, and open-source static analysis toolkit for writing and running code checkers. Based on tree-sitter.

• UpdatedJul 3, 2025
• Go