Data / Repositories / Static analysis
Static analysis repositories on GitHub: 28 ranked by stars
28 public repositories tagged Static analysis are on GitHub, with 393,181 stars between them; 22 had a push in the last 30 days. Most are written in Rust (10), Python (7), TypeScript (4). The most starred: morluto/rea (234,843), astral-sh/ruff (49,986), tirth8205/code-review-graph (32,145).
SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.
Every repository, most starred first
| Repository | What it is | Language | Stars | Forks | License | Last push | Read |
|---|---|---|---|---|---|---|---|
| morluto/rea | Reverse engineer anything with agents, from app behavior down to native binaries. | TypeScript | 234,843 | 58,626 | MIT | Oct 14 | Oct 14 |
| astral-sh/ruff | An extremely fast Python linter and code formatter, written in Rust. | Rust | 49,986 | 2,497 | MIT | Oct 11 | Oct 11 |
| tirth8205/code-review-graph | Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on… | Python | 32,145 | 2,943 | MIT | Oct 6 | Oct 14 |
| ast-grep/ast-grep | A CLI tool for code structural search, lint and rewriting. Written in Rust | Rust | 16,188 | 471 | MIT | Oct 11 | Oct 11 |
| analysis-tools-dev/static-analysis | A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality. | Rust | 14,830 | 1,515 | MIT | Oct 9 | Oct 11 |
| horsicq/Detect-It-Easy | Program for determining types of files for Windows, Linux and MacOS. | JavaScript | 11,665 | 969 | MIT | Oct 10 | Oct 11 |
| kucherenko/jscpd | Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents. | Rust | 6,392 | 269 | MIT | Oct 14 | Oct 14 |
| pylint-dev/pylint | It's not just a linter that annoys you! | Python | 5,735 | 1,381 | GPL-2.0 | Oct 10 | Oct 11 |
| bethington/ghidra-mcp | Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server… | Java | 5,608 | 321 | Apache-2.0 | Oct 14 | Oct 14 |
| willcrichton/flowistry | Flowistry is an IDE plugin for Rust that helps you focus on relevant code. | Rust | 3,073 | 65 | MIT | May 22 | Oct 11 |
| mtshiba/pylyzer | A fast, feature-rich static code analyzer & language server for Python | Rust | 2,857 | 42 | MIT | May 10, 2025 | Oct 11 |
| redhat-et/ripwire | The ripgrep of AI context: a zero-dependency C++23 CLI + MCP server for coding agents. Find what you want without reading the repo, then check you built what you meant — blast… | C++ | 2,433 | 151 | Apache-2.0 | Oct 11 | Oct 11 |
| jakzal/phpqa | Docker image that provides static analysis tools for PHP | Dockerfile | 1,321 | 67 | MIT | Oct 5 | Oct 11 |
| mongodb/kingfisher | Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python. | Rust | 1,260 | 123 | Apache-2.0 | Oct 7 | Oct 11 |
| caramelomartins/awesome-linters | A community-driven list of awesome linters. | 1,103 | 113 | Unlicense | Aug 7, 2024 | Oct 11 | |
| morluto/awesome-reverse-engineering | Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols. | Python | 1,052 | 239 | CC0-1.0 | Oct 20 | Oct 21 |
| bartolli/codanna | Local code intelligence MCP server and CLI for AI coding agents | Rust | 755 | 70 | Apache-2.0 | Oct 11 | Oct 14 |
| openqodex/openqodex | Open source code review that runs in your coding agent before you push. Scanners plus a separate AI reviewer, on your own login, no key. | TypeScript | 709 | 56 | Apache-2.0 | Oct 15 | Oct 15 |
| SonarSource/sonarqube-mcp-server | Official SonarQube MCP Server for code quality and security in AI agents | Java | 664 | 103 | Oct 14 | Oct 14 | |
| Aletheore/Aletheore | Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs. | Python | 243 | 22 | Oct 14 | Oct 14 | |
| qcri/codebadger | codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code… | Python | 174 | 23 | GPL-3.0 | Aug 31 | Oct 14 |
| kuberstar/qartez-mcp | Semantic code intelligence MCP server for Claude Code - project maps, symbol search, impact analysis, and more | Rust | 73 | 5 | Jul 28 | Oct 14 | |
| ashfordeOU/grasp | GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking, git change impact, graph schema v3.… | HTML | 28 | 3 | Sep 7 | Oct 14 | |
| MykytaStel/repopilot | Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server, and coding-agent plugins. | Rust | 24 | 1 | Apache-2.0 | Oct 12 | Oct 14 |
| MohammadHijjawi97/since-cutoff | Find which APIs of your pinned Python dependencies changed after your coding model's training cutoff, and give the agent short AGENTS.md / CLAUDE.md notes from a static API diff.… | Python | 8 | 5 | MIT | Oct 11 | Oct 14 |
| eltociear/skill-audit-mcp | Static security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, calibrated to a 1% false-positive rate over 196 public MCP servers. In… | Python | 5 | 1 | MIT | Sep 30 | Oct 14 |
| subodhkc/mcp-tenant-isolation | Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server… | TypeScript | 4 | 2 | MIT | Oct 8 | Oct 14 |
| vasikmansuri/agentconfig-doctor | MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers in Claude Code, Cursor and VS Code… | TypeScript | 3 | 0 | MIT | Oct 14 | Oct 14 |
By language
- Rust 10
- Python 7
- TypeScript 4
Related topics
- MCP 14
- MCP server 12
- Rust 9
- AI agents 8
- Claude Code 8
- Linter 8
- Security 8
- Agent skills 7
- Developer tools 7
- Python 6
- Code quality 6
- Coding agents 6
Read from GitHub by SpecStream between October 11, 2026 and October 21, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.