Sphinx AutoAPI is a Sphinx extension that automatically generates API documentation by statically analyzing Python source code using the astroid library, without importing or executing the documented code. It reads Python files and .pyi stubs, builds an internal object model (modules, classes, functions, etc.), applies configurable filtering options (e.g., private members, inherited members), and renders the documentation as RST via Jinja templates. The extension also provides autodoc-style directives (e.g., autoapifunction, autoapimethod) that allow manual documentation entries backed by the same static analysis, and supports inheritance diagrams, type annotation rendering, PEP-695 type parameters, overloaded signatures, and integration with Sphinx's viewcode. Its architecture separates parsing (astroid-based), mapping (object creation and option evaluation), and output (template rendering), making the core logic reusable in other static analysis tools.
This repository is the `eslint-plugin-react` package, a widely-used ESLint plugin that provides over 100 lint rules for React and JSX codebases. It is not a standalone application but a library consumed by ESLint to enforce best practices, prevent common errors, and maintain code style in React projects. The plugin supports both legacy `.eslintrc` and modern flat config (`eslint.config.js`) formats, and works with multiple parsers including babel-eslint and TypeScript-ESLint. The architecture is modular: each rule is a self-contained module in `lib/rules/`, sharing common utilities from `lib/util/` for component detection, AST traversal, version checking, and error reporting. The codebase is well-tested with a comprehensive test suite that runs across parser versions and ESLint versions. It is actively maintained with frequent releases and community contributions.
Flog is a Ruby code complexity analyzer that calculates an ABC (assignments, branches, conditionals) complexity metric with Ruby-specific enhancements. It processes Ruby source files to identify complex/tortured code that is difficult to test and maintain. The system consists of a core Flog library that performs the analysis, a CLI interface for command-line usage, a Rake task for integration with build systems, and a plugin system for extensibility. The architecture cleanly separates concerns: the Flog class handles AST processing and scoring, FlogCLI manages option parsing and file discovery, and FlogTask provides Rake integration. Recent versions have switched to using the prism parser for improved performance while maintaining backward compatibility with a --legacy flag for RubyParser.
ESBMC (Efficient SMT-based Bounded Model Checker) is a mature, open-source formal verification tool that automatically detects or proves the absence of runtime errors in C, C++, Python, Java/Kotlin (via Jimple), CHERI, and Solidity programs. It parses source code using language-specific frontends (Clang for C/C++, CPython parser for Python, Soot for Java), converts programs into a common GOTO intermediate representation, and performs bounded symbolic execution with SMT solving (Z3, Bitwuzla, CVC5, Yices, etc.). The tool checks for assertions, memory safety (buffer overflows, null pointers, use-after-free), arithmetic overflows, concurrency races, and user-defined contracts (requires/ensures/assigns). It supports advanced verification techniques including k-induction, loop invariant synthesis, incremental BMC, and quantifier reasoning. The architecture is modular: frontends produce GOTO programs, which are then processed by a series of analysis passes (pointer analysis, value-set analysis, loop unrolling, contract enforcement) before being encoded into SMT formulas. The solver backend is pluggable, with support for interactive solvers and experimental one-shot solvers (Mallob, NeuroSym). The repository includes an extensive regression test suite with thousands of small, self-contained test cases organized by language and feature, many with paired passing/failing variants to ensure soundness. Operational models for C standard library functions, C++ STL, Python standard library (including numpy), and SystemC are bundled as source code for SMT translation. Key entry points include the main ESBMC binary (built from `src/esbmc/`), the Clang C/C++ frontend (`src/clang-c-frontend/`), the Python frontend (`src/python-frontend/`), and the solver interfaces (`src/solvers/`). The tool is actively used in research and industry, has won 43 awards at SV-COMP and Test-Comp, and is supported by multiple funding agencies. External dependencies include Boost (program_options, filesystem), Clang/LLVM, and several SMT solvers.
Chiasmus is a neurosymbolic verification engine packaged as a TypeScript library and Model Context Protocol (MCP) server. It bridges LLMs with formal solvers — Z3 (SMT) and SWI-Prolog (WASM) — by translating natural-language problems into template-based formal specifications that are verified with mathematical certainty. It also performs static code analysis: tree-sitter-based extraction of call graphs for TypeScript/JavaScript, Python, Go, Rust, Clojure, Scheme, Racket, and Common Lisp, followed by 16 analyses (reachability, dead code, impact, cycles, layer violations, community detection, hubs, bridges, diffs). Architecturally, the repo is a modular ESM library with an MCP server entry point (src/mcp-server.ts) exposing 11 tools over stdio (chiasmus_graph, chiasmus_map, chiasmus_formalize, chiasmus_verify, chiasmus_search, chiasmus_review, chiasmus_learn, etc.). Core subsystems: graph extraction with per-file content-hash caching and snapshot diffing; a formalization engine that selects from 8 built-in skill templates via BM25/embedding retrieval and runs an LLM-driven correction loop against the solvers; a SQLite-backed skill library that learns new templates from verified solutions; and pluggable LLM adapters (Anthropic, OpenAI-compatible, Azure, local via node-llama-cpp). Data flows: source files are parsed by tree-sitter into a CodeGraph, which can be emitted as Prolog facts for symbolic queries or analyzed natively with O(V+E) algorithms (Tarjan SCC, BFS). For verification, a problem statement is embedded, matched to a template, slot-filled by an LLM, linted, and iteratively corrected until the Z3/Prolog solver confirms the property or finds a counterexample. The benchmark suite compares Chiasmus against traditional implementations across RBAC, dependency resolution, taint analysis, workflow validation, and validation consistency. Maintenance is active (v0.1.28, CI on Node 22/24, 70+ test files covering graph extraction, solvers, MCP tools, search, and skills). The codebase is well-engineered with several genuinely reusable components — native graph algorithms, an LRU extraction cache, a BM25 index, and a tsconfig alias resolver — though some coupling exists between the extractor and the TypeScript type environment, and the vendored WASM grammars require periodic upstream syncs.
A PHP library that provides a type-safe, static analysis-friendly way to narrow down mixed or union types at runtime. The core is a `Type` class (entry point via `type()` helper) that offers methods like `asString()`, `asInt()`, `as(ClassName::class)`, etc., each performing a runtime assertion and returning the narrowed type. It leverages PHPStan/Psalm's `@phpstan-assert-if-true` annotations to allow static analyzers to infer the narrowed type, preserving generic type information (e.g., `Collection<int, User>`). The library includes a `Not` class for negation checks (e.g., `type($x)->not()->null()`). It is part of the Pinkary Project, requires PHP 8.2+, and has zero runtime dependencies. The source is meticulously crafted with full test coverage, type-strict coding, and continuous integration enforcing linting, static analysis, and type coverage. It is a model example of how to expose runtime assertion functions with first-class static analysis support.
Plugin Inspector is a CLI tool and library for offline static and runtime analysis of OpenClaw plugins. It validates plugin structure, SDK imports, hook registrations, and manifest contracts without requiring a live OpenClaw host. The tool generates rich compatibility reports in JSON, Markdown, SARIF, and JUnit formats, integrates with CI pipelines (GitHub Actions, GitLab, CircleCI), and supports batch analysis across plugin corpora. Its architecture is modular: a core inspection engine (src/inspector.js) performs static analysis using AST parsing (acorn, eslint-scope) and regex-based detection; an optional runtime capture subsystem (src/capture-api.js, src/synthetic-probes.js) executes plugin entrypoints with a dynamically generated mock SDK (src/sdk-mock.js) to verify registration behavior and hook handling. The tool also includes a CI policy engine, workspace planning, platform probes, and profiling/diffing utilities. While tightly coupled to OpenClaw internals, the codebase demonstrates strong engineering practices with extensive test coverage, reusable components, and a well-defined public API surface.
jadx is a production-grade Android DEX/APK to Java source decompiler, providing both a command-line tool (jadx-cli) and a feature-rich Swing GUI (jadx-gui). The architecture is a multi-module Gradle project with a plugin system for input formats (DEX, Java class files, Smali, AAB, XAPK), decompilation passes, resource handling, and deobfuscation. The core decompilation pipeline uses a visitor pattern over a custom intermediate representation (IR) with type inference, SSA construction, region-based control flow, finally block extraction, and code generation. The codebase is actively maintained with a large test suite, but exhibits technical drift through deprecated APIs, complex state machines, and some unmaintained code paths. The plugin system and zip reader module are well-isolated and potentially reusable.
Checkov is a static analysis tool for Infrastructure as Code (IaC) security and compliance. It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and many other IaC frameworks against thousands of built-in policies covering AWS, Azure, GCP, and other cloud providers. The tool operates as a CLI application and can also be used as a Python library or integrated into CI/CD pipelines. Its architecture is modular, with separate runners per framework, a graph-based analysis engine for cross-resource checks, and a pluggable check registry system. Checkov also includes software composition analysis (SCA) for container images and packages, secrets detection, and integration with the Bridgecrew/Prisma Cloud platform for policy management and reporting.
This repository is the source for the C++ Core Guidelines, an evolving set of rules for writing modern C++ safely and effectively. The primary artifact is a large Markdown document (CppCoreGuidelines.md) that is rendered to HTML via Jekyll and published to isocpp.github.io. The repo also contains supporting tooling: a Python style checker that lints C++ code snippets embedded in the Markdown, a script that splits Markdown into prose and code blocks for validation, a Hunspell dictionary for spell-checking the document, and Node.js-based remark configuration for Markdown linting. CI is provided through GitHub Actions, with a legacy Travis configuration still present.
C2Rust is a compiler toolchain that translates C99 code into unsafe Rust, then applies static analysis and refactoring to produce safer, more idiomatic Rust. The pipeline consists of four main stages: transpilation (c2rust-transpile) using a Clang-based AST exporter to produce initial Rust code; static analysis (c2rust-analyze) that infers pointer permissions and rewrites raw pointers to safe references using a Polonius-based borrow checker; refactoring (c2rust-refactor) which applies dozens of AST transformations (e.g., ownership splitting, macro collapsing, control flow reconstruction) to improve code quality; and postprocessing (c2rust-postprocess) that leverages large language models to transfer C comments and align definitions. The project also includes a cross-checking framework that instruments both C and Rust code to compare runtime behavior via hashing, a program dependence graph (PDG) builder for memory safety analysis, and dynamic instrumentation for event logging. It is primarily a CLI tool (c2rust) that orchestrates these components, with extensive integration tests on real-world C projects (nginx, curl, sqlite, ruby, python2, libxml2, zstd, lua). The codebase is substantial and actively maintained, but relies heavily on unstable rustc internal APIs and LLVM/Clang, introducing maintenance risk. Several components exhibit high craftsmanship and are reusable in isolation.
A Visual Studio extension (VSIX) that integrates SonarQube/SonarCloud static analysis into the IDE. It provides real-time code quality and security analysis for C#, VB.NET, C/C++, JavaScript/TypeScript, CSS, and other languages via an embedded SLCore backend (Java process) and a separate Roslyn analyzer server for .NET. The extension supports both standalone analysis and 'connected mode' that binds to SonarQube/SonarCloud servers, including project binding, credential management, issue visualization with flows and locations, security hotspots, taint vulnerabilities, dependency risks, quick fixes, rule education (HTML-to-XAML rendering), and telemetry. The architecture is modular, heavily relying on MEF for dependency injection, with distinct assemblies for core abstractions, VS integration, connected mode UI, issue visualization, security-specific features, and education. The codebase is well-tested with extensive unit tests and some integration tests, but shows signs of ongoing migration from legacy binding models to a modern SLCore-based protocol, resulting in some technical debt and backward-compatibility code.
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
This repository provides a comprehensive VHDL language toolchain written in Rust, centered around a Language Server Protocol (LSP) implementation. It includes a lossless concrete syntax tree (CST) parser (`vhdl_syntax`), a semantic analysis library (`vhdl_lang`) with name resolution, type checking, and overload resolution, a standalone linter (`vhdl-lint`) with rule selection and auto-fix, a formatter, and a CLI for AST dumping. The architecture is modular, with separate crates for parsing, analysis, linting, and the LSP server, enabling reuse of components like the CST framework and diagnostic system. The codebase demonstrates high craftsmanship with extensive test coverage (including fuzzing and snapshot tests), code generation from a grammar model, and careful handling of VHDL's Latin-1 encoding and source positions. However, it suffers from a dual-parser architecture (the older hand-written parser in `vhdl_lang` coexists with the newer CST parser in `vhdl_syntax`), which introduces duplication and potential drift. Some VHDL-2019 features are partially supported, and the project tracks the latest Rust stable, imposing a high maintenance burden. Overall, it is a production-quality tool for VHDL developers, with several reusable components that could be extracted for other VHDL tooling projects.
rnsec is a zero-configuration static analysis security scanner for React Native and Expo applications. It scans JavaScript/TypeScript, XML, plist, and JSON files for over 85 security rules covering storage, network, authentication, cryptography, logging, Android/iOS platform issues, and supply chain risks. The tool uses Babel AST parsing and regex pattern matching to detect hardcoded secrets, insecure configurations, and common vulnerabilities. It generates HTML, JSON, and Markdown reports, supports CI/CD integration with changed-files scanning, and can post results as GitHub PR comments. The architecture is a monolith CLI application built with Commander, with a modular rule engine that registers scanner groups. The codebase is well-structured, TypeScript strict, and includes comprehensive tests for all rules.
recheck is a monorepo for a ReDoS (Regular expression Denial of Service) vulnerability checker, written in Scala 3 and cross-compiled to JVM and JavaScript via Scala.js. The system parses regular expression patterns, builds an execution model, and detects catastrophic backtracking vulnerabilities. It exposes multiple interfaces: a core library (`recheck-core`) with a high-level `ReDoS.check` API, a CLI (`recheck-cli`) with `check` and `batch` subcommands (the latter using JSON-RPC over stdio), JavaScript bindings (`recheck-js`) for browser/Node usage, and an ESLint plugin (`eslint-plugin-redos`) for CI integration. The architecture is a multi-module sbt build with Lerna/pnpm for JS workspace management, featuring clean separation between parsing, execution, unicode data, and platform-specific adapters.
This repository is a GitHub template for bootstrapping Kotlin Android projects with a modern, opinionated build setup. It provides a multi-module structure (app, library-android, library-kotlin, library-compose) with pre-configured static analysis via detekt, CI/CD via GitHub Actions, and publishing to Maven Central. The codebase demonstrates best practices for Gradle Kotlin DSL, version catalogs, and precompiled script plugins. The sample modules include a simple factorial calculator to illustrate cross-module dependencies and testing patterns (unit, instrumentation, and Compose UI tests). While the template is not a production application itself, it serves as a solid foundation for new Android projects, emphasizing code quality and automation from the start.
pycdc/pycdas is a C++11 command-line toolchain for reverse engineering CPython bytecode. pycdc decompiles compiled .pyc files back into human-readable Python source; pycdas emits a detailed bytecode disassembly (with options like --show-caches and --pycode-extra). Version coverage spans Python 1.0 (1994) through 3.13, with the correct opcode semantics selected from the .pyc magic number at load time. The entry points are pycdc.cpp and pycdas.cpp, which are thin CLIs over the pycxx static library that owns marshal-format parsing (pyc_object.cpp, pyc_numeric.cpp, pyc_string.cpp, pyc_sequence.cpp), code-object extraction (pyc_code.cpp), and interpreter version detection (pyc_module.cpp). It also supports decompiling raw marshalled code objects via -c -v <version>. Decompilation loads the code object and interprets its bytecode on a virtual stack machine (FastStack with history snapshots) inside ASTree.cpp, reconstructing structured control flow (loops, try/except, comprehensions, with-blocks) and lowering it into an ASTNode tree for source emission. Opcode semantics are maintained as an X-macro include (bytecode_ops.inl) with explicit version ranges, and per-version opcode-name maps live in bytes/python_*_*.cpp. The module boundaries cleanly separate binary I/O (endian-aware PycBuffer/PycFile streams), object marshalling, disassembly, AST construction, and printing - although the decompiler core itself is a dense, version-conditional megafile. QA is the project's strongest asset. Roughly 200 .pyc fixtures spanning every Python major release (plus an xfail set for known-unfixed cases) are checked by tests/run_tests.py, which compares decompiler output to expected output as token streams rather than exact text - tolerating cosmetic whitespace differences while still catching semantic regressions. Linux and Windows CI run the suite, and scripts/pymultic, Dockerfile.pybuild, and a collection of Autoconf modernization patches make it possible to rebuild ancient CPython releases to regenerate those fixtures. Recent commits cover Python 3.13 opcode support, and the repository is actively maintained. Caveats: the 25-year version matrix forces heavily conditional decompilation logic, some mutable global state exists in ASTree, and unknown or future-modified opcodes degrade to partial output with an 'Unsupported opcode' warning. For its niche, it is the most complete open-source CPython decompiler available.
This repository is a PHPStan extension that detects banned code patterns in PHP projects. It provides two main rules: BannedNodesRule to forbid specific function calls and language constructs (like var_dump, exit, echo), and BannedUseTestRule to prevent the use of test namespaces in non-test files. The extension is configured via PHPStan's neon configuration and integrates seamlessly into the PHPStan analysis process. The architecture is straightforward, with each rule implemented as a separate class that processes AST nodes and reports violations. The project demonstrates good practices in PHPStan extension development, including configurable rules, proper error building with non-ignorable options, and thorough unit testing.
Globstar is a static analysis toolkit that enables developers to write custom checkers in YAML or Go and run them via a single portable binary. It uses tree-sitter for AST-based analysis, supporting multiple languages (Go, Java, JavaScript, Python, Ruby, etc.). The tool is designed to be fast, dependency-free, and CI-friendly, with a focus on enforcing learned patterns such as security vulnerabilities and code quality issues. The architecture consists of a CLI layer, an analysis engine for parsing and scope resolution, and a checker system with built-in and custom checker support.