Static Analysis Python Packages

ruff

An extremely fast Python linter and code formatter, written in Rust.

jedi

Awesome autocompletion, static analysis and refactoring library for python

pylint

It's not just a linter that annoys you!

flake8

flake8 is a python tool that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code.

astroid

A common base representation of python source code for pylint and other projects

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

radon

Various code metrics for Python code

zizmor

Static analysis for GitHub Actions

ast-grep-cli

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

apkinspector

apkInspector is a tool designed to provide detailed insights into the zip structure of APK files, offering the capability to extract content and decode the AndroidManifest.xml file.

pytype

A static type analyzer for Python code

rstcheck

Checks syntax of reStructuredText and code blocks nested within it

rstcheck-core

Core library behind rstcheck.

ast-grep-py

⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

code-review-graph

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

crosshair-tool

An analysis tool for Python that blurs the line between testing and type systems.

simple-ddl-parser

Lightweight SQL DDL parser for extracting tables, columns, and schema metadata with broad multi-dialect support (HQL, TSQL, AWS Redshift, BigQuery, Snowflake and other dialects)

pyre-check

Performant type-checking for python.

slither-analyzer

Static Analyzer for Solidity and Vyper

zuban

Python Type Checker / Language Server

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/