Tools

facebook/infer

A static analyzer for Java, C, C++, and Objective-C

crytic/slither

Static Analyzer for Solidity and Vyper

crytic/caracal

Static Analyzer for Starknet smart contracts

bronils/aotopsy

Static analyzer for Flutter/Dart AOT snapshots — recovers function names, class hierarchies, call graphs, and behavioral signals from libapp.so…

keensecuritylab/binabsinspector

Static binary vulnerability scanner using abstract interpretation on Ghidra Pcode. Detects CWE classes like buffer overflows, use-after-free, and…

maaaaz/androwarn

Yet another static code analyzer for malicious Android applications

tenable/terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

mohammadnassiri/yaasa

Yet Another APK Static Analyzer

trailofbits/fickling

A Python pickling decompiler and static analyzer

mhaggis/package-inferno

A Public Package Scanner for The Community

microsoft/applicationinspector

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…

gitlab-org/security-products/sast-rules

Curated Semgrep rule repository for GitLab SAST, providing static analysis patterns to detect security vulnerabilities across multiple programming…

last-emo-boy/rikune

MCP server for reverse engineering Windows executables and binary formats. Combines static triage, Ghidra-assisted function recovery, plugin-driven…

yandex/gixy

Nginx configuration static analyzer

slowql/slowql

Next-generation SQL static analyzer written in Rust. 282+ rules. Zero false positives. Security, performance, reliability, cost, compliance, quality.…

client9/libinjection

SQL / SQLI tokenizer parser analyzer

pmd/pmd

An extensible multilanguage static code analyzer.