Open source SonarCloud alternatives
Every project in the catalog is MIT, Apache or BSD licensed. 0 projects explicitly describe themselves as a SonarCloud alternative; 53 more are in the category where SonarCloud is a typical product.
Open source projects in the same category: Code Quality & Review
Category-level information: these projects are the same kind of software as SonarCloud; they have not claimed to be a one-to-one replacement.
Ruff
100astral-sh · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- In Python projects, you use a single solution instead of Flake8, isort, and Black tools.
- You fix import statements and formatting errors that are not used with the automatic error correction feature.
- Reduces analysis time in large code bases with built-in cache support.
- • High number of open issues (2,240)
- • NeutralHacker News
Ruff v0.16.0 – Significant new updates – 413 default rules up from 59
“> I really wish Ruff would introduce something similar to Nix’s stateVersion Two approaches: You can pin the version of `ruff` in `pyproject.toml`. You, to let ruff command version advance but pin the settings to a prior version: uvx [email protected] check --isolated --show-settings…”
- • NeutralHacker News
Ruff v0.16.0 – Significant new updates – 413 default rules up from 59
“> with every version introducing a bunch of new default rules which you then have to deal with immediately According to the original post > Ruff's default rule set was last modified in v0.1.0 Which was over 2 years ago.”
Verified against README · Oct 26, 2026 · source
Oxlint
100oxc-project · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You quickly analyze JavaScript and TypeScript codebases
- Perform linting operations on your project files
- With Oxfmt you format the JavaScript and TypeScript code, shrink it for production compilations with Minifier.
- • High number of open issues (1,108)
- • NeutralHacker News
Fast Type-Aware Linting in Oxlint
“Oxc js a rust toolkit made by Void0, the mob that makes vite and vitest. These are highly regarded and performant additions to the Js/Ts ecosystem. Oxlint is a alternative to eslint built on Oxc. It has suffered from not supporting the additional level of type-based linting that…”
- • NeutralGitHub Issue
Linter Product Plan and Progress
“## Product Plan Create a linter that is * zero-config * only checks for correctness errors (code that is outright wrong or useless) - definition from [Rust Clippy]( See also: [Oxlint General Availability Annoucement]( ### Plugins For plugins, the goal is to port most of the…”
Verified against README · Oct 25, 2026 · source
SwiftLint
100realm · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can automatically audit the coding standards set out in your Swift projects.
- Thanks to SwiftSyntax-based rules, you can detect inconsistencies in the code style.
- You can include it in the development process by providing integration via Xcode or command line.
- • High number of open issues (540)
- • NeutralHacker News
SwiftLint: Add `Inclusive_language` Rule
“This rule is enabled by default in the latest SwiftLint version, and triggers a linting error for using "non-inclusive" variable or class names like "masterViewController" or "blacklist".”
PHP-Parser
100nikic · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can convert PHP codes into abstract syntax tree structure by parsing them.
- By browsing the code, you can change or delete certain nodes.
- You can convert the tree structures you created or changed back to PHP code.
- • NeutralHacker News
PHP-Parser: A Native PHP Parser for Parsing and Analyzing PHP Code
“It's certainly used on its own codebase indirectly, phpstan - the static analysis tool they use - uses PHP-Parser internally:”
- • NeutralHacker News
PHP-Parser: A Native PHP Parser for Parsing and Analyzing PHP Code
“12 years later, PHP-Parser is an important part of the PHP ecosystem, particularly in code analysis and refactoring tools.”
ast-grep
100ast-grep · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can search for specific syntax structures in your codebase using patterns.
- You can automatically rewrite the blocks of code you detect.
- You can perform light-scale static analysis and code edits on your projects.
- ↑ PositiveHacker News
AST-grep(sg) is a CLI tool for code structural search, lint, and rewriting
“Hi, ast-grep author here. This is a great question and I asked this in the first place before I started the hobby project. TLDR; I designed ast-grep to be on different tracks than semgrep. Semgrep is for security and ast-grep is for development. First and foremost, I have always…”
- ↓ NegativeHacker News
AST-grep(sg) is a CLI tool for code structural search, lint, and rewriting
“Why I think semgrep is a security tool different from ast-grep: * Semgrep is security focused. It has many advanced static analysis features in its core product, such as dataflow analysis, symbolic propagation, and semantic equivalence, all of which are useful for security…”
infer
100facebook · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You perform static code analysis on C, C++, Objective-C and Java projects.
- You run the system by installing bundled versions or compiling them from source code.
- You detect empty pointer access, source leakage, and synchrony errors before the code runs.
Verified against README · Oct 25, 2026 · source
pre-commit
100pre-commit · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You manage pre-commit hooks in different programming languages from a single center.
- You integrate the code control tools suitable for the project with the configuration file.
- You run pre-commit automatic controls to maintain standards on the codebase.
analysis-tools-dev · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can list appropriate static analysis tools based on programming languages.
- You can find the linters and formaters used to improve code quality.
- You can control the current and open source status of vehicles through symbols.
- • No published release
- ↑ PositiveGitHub Issue
JSHint and JSLint are outdated
“JSHint or JSLint don't belong in a list with "awesome" in the name as they're severely out of date and pointing users towards them does a disservice. The one up to date and well-maintained linter for JS is ESLint.”
- ↓ NegativeGitHub Issue
Many links in the table of contents are not working
“Hi. Some links in the table of contents are broken, for example: * [C++]( * [.env]( * [Configuration Management]( This is because the anchor link generated for "C++" isn't "cpp" but "c-2".”
lint-staged
100lint-staged · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- Before the Git commit process, you just run the linter and formatter on the prepared files.
- By filtering according to specific file extensions, you process the entire project without scanning it.
- To maintain code quality, you implement commands that you define in an automatic order.
- • NeutralGitHub Issue
Add better support for partially staged files
“Add better support for partially staged files”
- ↓ NegativeGitHub Issue
[13.0.0] excessive output when invoked through pre-commit script
“### Description Not sure if this is a bug, but lint-staged v13.0.0 sure is chatty. :) Running `npx lint-staged` (not through a husky pre-commit script) seems to yield the expected output, though. See both examples below. ### Steps to reproduce 1. Install lint-staged 13.0.0 2.…”
phpstan
95phpstan · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You detect errors without running your code.
- You continuously analyze changing files by scanning them in the background.
- You scan for errors found through the web interface and open them in the editor.
- • High number of open issues (1,118)
- • NeutralGitHub Issue
Consider 1.0.0 for the next release number
“Since PHPStan is becoming wildly popular really quick, and a lot of people rely on its stability, it is a good idea to start versioning new majors for anything that might slightly look like a BC break. (<insert reminder that major versions can be released anytime)”
- • NeutralGitHub Issue
Do not execute tested code
“Currently PHPStan claims to be „PHP Static Analysis Tool“ but this is actually a lie, because phpstan executes the tested code which makes using the tool quite dangerous. The correct solution is to use a library such as”
ale
100dense-analysis · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- When editing text files, you can simultaneously check syntax errors in the background.
- With LSP support, you can go to definitions within the code or search for symbols.
- You can automatically format code files using command line tools.
- • High number of open issues (592)
- • NeutralGitHub Issue
E631: write_buf_line()(): write failed
“While using ale in MacVim GUI this message appears in the command line very very frequently. There are also some others I am seeing with a simple .vimrc ``` vim set nocompatible set nu set runtimepath+=~/.vim.old/neobundles/ale ``` ``` log E631: write_buf_line()(): write failed…”
- • NeutralGitHub Issue
Feature request: add general support for the Language Server Protocol
“Many languages are starting to add support for the [Language Server Protocol]( which supports (among other things) getting diagnostic errors on files from the language server. I believe ale could leverage this to get pretty reusable support across many languages, and add support…”
PHP-CS-Fixer
100PHP-CS-Fixer · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- With built-in or custom rule sets, you can automatically fix PHP code standards.
- Using configuration files, you can define team code style standards.
- With the help of automatic migration rules, you can move the codebase to newer PHP versions.
grype
100anchore · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can scan Konteyner images and local directories for known vulnerabilities.
- You can analyze packages and operating system dependencies from different programming languages.
- You can prioritize vulnerabilities using EPSS and risk scoring data.
RuboCop
100rubocop · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- By analyzing the codes in Ruby projects, you control your compliance with the community style guide.
- You quickly fix detected code errors thanks to the autocorrect feature.
- Using the built-in LSP server, you get instant feedback via your code editor.
- ↓ NegativeHacker News
RuboCop – A Ruby static code analyzer
“Is "static code analyzer" the new spelling for lint(1)? I've always been a big fan of code linters. They may not be perfect, but any bug you can catch at compile-time (or earlier) could be saving you hours of trying to track down runtime problems. In languages with a managed…”
- • NeutralHacker News
RuboCop – A Ruby static code analyzer
“RuboCop's author here. If I knew someone would ever link to the homepage I would have put some useful info in it. :-) Thanks for the kind words! P.S. There's a lot more info here”
Knip
100webpro-nl · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You identify unused dependencies, files, and exported codes in your project.
- With less code and dependency, you facilitate the maintenance processes of the project.
- You improve the performance of the project by clearing out unnecessary items in the codebase.
- • NeutralGitHub Issue
Request new plugins here
“Please add one comment per plugin (please link to website/repo/docs), which others can then upvote using reactions like 👍 (not more comments). The idea is that you can request/upvote plugins here. Contributors/me can implement them. Please make sure the plugin isn't already…”
horsicq · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can set the file types and perform a static review.
- You can run signature matching and form parsing in malware analysis and reverse engineering processes.
- With the PE intuitive engine, you can study structural and behavioral abnormalities.
- • No published release
- • NeutralGitHub Issue
current version detects non existing overlay in DOS 16 bit exe
“i built DIE from source on Linux/Tumbleweed to check the fix for (Detect-Is-Easy hash: c2ecaf7 and DIE-engine hash: 771e8b8) with my older windows release installation of DIE i get this the file used for the detection test - built with tasm 3.1 and tlink 5.1 - definitly no…”
- • NeutralGitHub Issue
Nothing happens when I click any of the three exe files...
“Am I missing something? And your quick scan telegram bot doesn't work either, nothing happens when you press the start bot button.”
stylelint
100stylelint · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- Using hundreds of built-in rules, you detect invalid or faulty CSS codes.
- You control the embedded styles in HTML, Markdown, and CSS-in-JS templates by extracting them.
- You parse CSS-like languages such as SCSS, Sass, Less, and SugarSS and apply code standards.
- • NeutralHacker News
Stylelint – A modern linter for CSS
“The only thing lacking about Stylus is the documentation really - the built-in functions page seems to list functions in random order (could be in order of addition to the language I guess!), there's no master index of the various syntax features, its usefulness varies a lot…”
- • NeutralHacker News
Stylelint – A modern linter for CSS
“If using Chrome's Stylus extension's support for using Stylelint to lint a style written in Stylus is the same as on the command line, then the only real issue I've had is that you often need to use colons to separate properties and values to prevent Stylelint giving cryptic…”
clair
80quay · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You index container images through API.
- You match images to known vulnerabilities.
- You study the security of the container infrastructure with static analysis.
- • NeutralHacker News
Clair Obscur having its Indie Game Game Of The Year award stripped due to AI use
“The real reason Clair Obscure should not have received indie game of the year in the first place is that it was developed by Sandfall interactive and published by Kepler interactive and as such is not an independent game.”
- ↑ PositiveHacker News
CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers
“CoreOS was CoreOS before I got there. I came to CoreOS because of the open source nature of the company and the awesome collection of projects such as etcd, CoreOS Linux, and their work around containers. The release of Clair proves this will continue without me. While much of…”
super-linter · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can apply consistent formatting rules in different programming languages.
- You can report errors in the source code through the console output.
- You can scan large code stores in seconds.
- ↓ NegativeGitHub Issue
Shellcheck Configuration File Ignored
“## Describe the bug Without `-x` shellcheck won't open any files that may be referenced but not explicitly passed to it on the command line. This is problematic, because super-linter invokes shellcheck once per file. ## Expected behavior I expected shellcheck not to complain…”
syft
75anchore · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You can produce SBOM for Konteyner images, archives and file systems.
- You can convert between CycloneDX, SPDX and Syft JSON formats.
- You can use it in conjunction with the Grype browser to detect vulnerabilities.
- • High number of open issues (700)