Open source SonarCloud alternatives

Every project in the catalog is MIT, Apache or BSD licensed. 0 projects explicitly describe themselves as a SonarCloud alternative; 53 more are in the category where SonarCloud is a typical product.

Open source projects in the same category: Code Quality & Review

Category-level information: these projects are the same kind of software as SonarCloud; they have not claimed to be a one-to-one replacement.

RU

Ruff

100

astral-sh · Code Quality & Review

STARS50.4K
FORKS2.6K
COMMITS—
CONTRIBUTORS880
VERSIONv0.4.9
UPDATEDtoday
pythonLinterformattingrustMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • In Python projects, you use a single solution instead of Flake8, isort, and Black tools.
  • You fix import statements and formatting errors that are not used with the automatic error correction feature.
  • Reduces analysis time in large code bases with built-in cache support.
Heads up
  • • High number of open issues (2,240)
User reviews
  • • NeutralHacker News

    Ruff v0.16.0 – Significant new updates – 413 default rules up from 59

    “> I really wish Ruff would introduce something similar to Nix’s stateVersion Two approaches: You can pin the version of `ruff` in `pyproject.toml`. You, to let ruff command version advance but pin the settings to a prior version: uvx [email protected] check --isolated --show-settings…”

  • • NeutralHacker News

    Ruff v0.16.0 – Significant new updates – 413 default rules up from 59

    “> with every version introducing a bunch of new default rules which you then have to deal with immediately According to the original post > Ruff's default rule set was last modified in v0.1.0 Which was over 2 years ago.”

Verified against README · Oct 26, 2026 · source

OX

oxc-project · Code Quality & Review

STARS23.3K
FORKS1.4K
COMMITS—
CONTRIBUTORS394
VERSIONv0.1.1
UPDATEDtoday
LinterjavascriptrusttypescriptMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You quickly analyze JavaScript and TypeScript codebases
  • Perform linting operations on your project files
  • With Oxfmt you format the JavaScript and TypeScript code, shrink it for production compilations with Minifier.
Heads up
  • • High number of open issues (1,108)
User reviews
  • • NeutralHacker News

    Fast Type-Aware Linting in Oxlint

    “Oxc js a rust toolkit made by Void0, the mob that makes vite and vitest. These are highly regarded and performant additions to the Js/Ts ecosystem. Oxlint is a alternative to eslint built on Oxc. It has suffered from not supporting the additional level of type-based linting that…”

  • • NeutralGitHub Issue

    Linter Product Plan and Progress

    “## Product Plan Create a linter that is * zero-config * only checks for correctness errors (code that is outright wrong or useless) - definition from [Rust Clippy]( See also: [Oxlint General Availability Annoucement]( ### Plugins For plugins, the goal is to port most of the…”

Verified against README · Oct 25, 2026 · source

SW

realm · Code Quality & Review

STARS19.8K
FORKS2.3K
COMMITS7.6K
CONTRIBUTORS393
VERSION0.65.1
UPDATED14 days ago
SwiftCode AnalysisLinterDeveloper ToolsMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can automatically audit the coding standards set out in your Swift projects.
  • Thanks to SwiftSyntax-based rules, you can detect inconsistencies in the code style.
  • You can include it in the development process by providing integration via Xcode or command line.
Heads up
  • • High number of open issues (540)
User reviews
  • • NeutralHacker News

    SwiftLint: Add `Inclusive_language` Rule

    “This rule is enabled by default in the latest SwiftLint version, and triggers a linting error for using "non-inclusive" variable or class names like "masterViewController" or "blacklist".”

PH

nikic · Code Quality & Review

STARS17.5K
FORKS1.1K
COMMITS1.8K
CONTRIBUTORS139
VERSIONv5.8.0
UPDATED3 days ago
PHPStatic AnalysisASTKod AyrıştırmaBSD-3-Clause

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can convert PHP codes into abstract syntax tree structure by parsing them.
  • By browsing the code, you can change or delete certain nodes.
  • You can convert the tree structures you created or changed back to PHP code.
User reviews
  • • NeutralHacker News

    PHP-Parser: A Native PHP Parser for Parsing and Analyzing PHP Code

    “It's certainly used on its own codebase indirectly, phpstan - the static analysis tool they use - uses PHP-Parser internally:”

  • • NeutralHacker News

    PHP-Parser: A Native PHP Parser for Parsing and Analyzing PHP Code

    “12 years later, PHP-Parser is an important part of the PHP ecosystem, particularly in code analysis and refactoring tools.”

AS

ast-grep · Code Quality & Review

STARS16.4K
FORKS488
COMMITS4.4K
CONTRIBUTORS91
VERSION0.45.3
UPDATEDtoday
RustStatic AnalysisASTKod DüzenlemeMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can search for specific syntax structures in your codebase using patterns.
  • You can automatically rewrite the blocks of code you detect.
  • You can perform light-scale static analysis and code edits on your projects.
User reviews
  • ↑ PositiveHacker News

    AST-grep(sg) is a CLI tool for code structural search, lint, and rewriting

    “Hi, ast-grep author here. This is a great question and I asked this in the first place before I started the hobby project. TLDR; I designed ast-grep to be on different tracks than semgrep. Semgrep is for security and ast-grep is for development. First and foremost, I have always…”

  • ↓ NegativeHacker News

    AST-grep(sg) is a CLI tool for code structural search, lint, and rewriting

    “Why I think semgrep is a security tool different from ast-grep: * Semgrep is security focused. It has many advanced static analysis features in its core product, such as dataflow analysis, symbolic propagation, and semantic equivalence, all of which are useful for security…”

IN

facebook · Code Quality & Review

STARS15.7K
FORKS2.1K
COMMITS16.2K
CONTRIBUTORS166
VERSIONv1.3.0
UPDATED4 days ago
OCamlStatic AnalysisCode QualityC++MIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You perform static code analysis on C, C++, Objective-C and Java projects.
  • You run the system by installing bundled versions or compiling them from source code.
  • You detect empty pointer access, source leakage, and synchrony errors before the code runs.

Verified against README · Oct 25, 2026 · source

PR

pre-commit · Code Quality & Review

STARS15.7K
FORKS1.0K
COMMITS2.9K
CONTRIBUTORS134
VERSIONv4.6.2
UPDATED10 days ago
PythonGitKancaCode QualityMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You manage pre-commit hooks in different programming languages from a single center.
  • You integrate the code control tools suitable for the project with the configuration file.
  • You run pre-commit automatic controls to maintain standards on the codebase.
ST

analysis-tools-dev · Code Quality & Review

STARS14.9K
FORKS1.5K
COMMITS9.3K
CONTRIBUTORS344
VERSION—
UPDATED2 days ago
Static AnalysisSASTCode QualityLinterMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can list appropriate static analysis tools based on programming languages.
  • You can find the linters and formaters used to improve code quality.
  • You can control the current and open source status of vehicles through symbols.
Heads up
  • • No published release
User reviews
  • ↑ PositiveGitHub Issue

    JSHint and JSLint are outdated

    “JSHint or JSLint don't belong in a list with "awesome" in the name as they're severely out of date and pointing users towards them does a disservice. The one up to date and well-maintained linter for JS is ESLint.”

  • ↓ NegativeGitHub Issue

    Many links in the table of contents are not working

    “Hi. Some links in the table of contents are broken, for example: * [C++]( * [.env]( * [Configuration Management]( This is because the anchor link generated for "C++" isn't "cpp" but "c-2".”

LI

lint-staged · Code Quality & Review

STARS14.8K
FORKS478
COMMITS1.6K
CONTRIBUTORS157
VERSIONv17.5.1
UPDATEDtoday
JavaScriptGit HooksCode QualityAutomationMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • Before the Git commit process, you just run the linter and formatter on the prepared files.
  • By filtering according to specific file extensions, you process the entire project without scanning it.
  • To maintain code quality, you implement commands that you define in an automatic order.
User reviews
  • • NeutralGitHub Issue

    Add better support for partially staged files

    “Add better support for partially staged files”

  • ↓ NegativeGitHub Issue

    [13.0.0] excessive output when invoked through pre-commit script

    “### Description Not sure if this is a bug, but lint-staged v13.0.0 sure is chatty. :) Running `npx lint-staged` (not through a husky pre-commit script) seems to yield the expected output, though. See both examples below. ### Steps to reproduce 1. Install lint-staged 13.0.0 2.…”

PH

phpstan · Code Quality & Review

STARS14.1K
FORKS970
COMMITS15.3K
CONTRIBUTORS280
VERSION2.2.14
UPDATEDtoday
PHPStatic AnalysisHata TespitiCode QualityMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You detect errors without running your code.
  • You continuously analyze changing files by scanning them in the background.
  • You scan for errors found through the web interface and open them in the editor.
Heads up
  • • High number of open issues (1,118)
User reviews
  • • NeutralGitHub Issue

    Consider 1.0.0 for the next release number

    “Since PHPStan is becoming wildly popular really quick, and a lot of people rely on its stability, it is a good idea to start versioning new majors for anything that might slightly look like a BC break. (<insert reminder that major versions can be released anytime)”

  • • NeutralGitHub Issue

    Do not execute tested code

    “Currently PHPStan claims to be „PHP Static Analysis Tool“ but this is actually a lie, because phpstan executes the tested code which makes using the tool quite dangerous. The correct solution is to use a library such as”

AL

ale

100

dense-analysis · Code Quality & Review

STARS14.0K
FORKS1.5K
COMMITS4.7K
CONTRIBUTORS397
VERSIONv4.0.0
UPDATED11 days ago
Vim ScriptLSPLinterCode AnalysisBSD-2-Clause

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • When editing text files, you can simultaneously check syntax errors in the background.
  • With LSP support, you can go to definitions within the code or search for symbols.
  • You can automatically format code files using command line tools.
Heads up
  • • High number of open issues (592)
User reviews
  • • NeutralGitHub Issue

    E631: write_buf_line()(): write failed

    “While using ale in MacVim GUI this message appears in the command line very very frequently. There are also some others I am seeing with a simple .vimrc ``` vim set nocompatible set nu set runtimepath+=~/.vim.old/neobundles/ale ``` ``` log E631: write_buf_line()(): write failed…”

  • • NeutralGitHub Issue

    Feature request: add general support for the Language Server Protocol

    “Many languages are starting to add support for the [Language Server Protocol]( which supports (among other things) getting diagnostic errors on files from the language server. I believe ale could leverage this to get pretty reusable support across many languages, and add support…”

PH

PHP-CS-Fixer · Code Quality & Review

STARS13.6K
FORKS1.7K
COMMITS11.2K
CONTRIBUTORS388
VERSIONv3.95.25
UPDATEDtoday
PHPCode QualityLinterKod StiliMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • With built-in or custom rule sets, you can automatically fix PHP code standards.
  • Using configuration files, you can define team code style standards.
  • With the help of automatic migration rules, you can move the codebase to newer PHP versions.
GR

anchore · Code Quality & Review

STARS13.1K
FORKS929
COMMITS2.4K
CONTRIBUTORS146
VERSIONv0.118.0
UPDATEDtoday
GoGüvenlik TaramasıContainerSBOMApache-2.0

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can scan Konteyner images and local directories for known vulnerabilities.
  • You can analyze packages and operating system dependencies from different programming languages.
  • You can prioritize vulnerabilities using EPSS and risk scoring data.
RU

rubocop · Code Quality & Review

STARS12.9K
FORKS3.2K
COMMITS—
CONTRIBUTORS1.1K
VERSIONv1.9.1
UPDATEDtoday
rubyLinterStatic AnalysisstyleMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • By analyzing the codes in Ruby projects, you control your compliance with the community style guide.
  • You quickly fix detected code errors thanks to the autocorrect feature.
  • Using the built-in LSP server, you get instant feedback via your code editor.
User reviews
  • ↓ NegativeHacker News

    RuboCop – A Ruby static code analyzer

    “Is "static code analyzer" the new spelling for lint(1)? I've always been a big fan of code linters. They may not be perfect, but any bug you can catch at compile-time (or earlier) could be saving you hours of trying to track down runtime problems. In languages with a managed…”

  • • NeutralHacker News

    RuboCop – A Ruby static code analyzer

    “RuboCop's author here. If I knew someone would ever link to the homepage I would have put some useful info in it. :-) Thanks for the kind words! P.S. There's a lot more info here”

KN

Knip

100

webpro-nl · Code Quality & Review

STARS12.6K
FORKS544
COMMITS—
CONTRIBUTORS250
UPDATEDtoday
Code Qualitytypescriptdead-codeBSD / ISC

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You identify unused dependencies, files, and exported codes in your project.
  • With less code and dependency, you facilitate the maintenance processes of the project.
  • You improve the performance of the project by clearing out unnecessary items in the codebase.
User reviews
  • • NeutralGitHub Issue

    Request new plugins here

    “Please add one comment per plugin (please link to website/repo/docs), which others can then upvote using reactions like 👍 (not more comments). The idea is that you can request/upvote plugins here. Contributors/me can implement them. Please make sure the plugin isn't already…”

DE

horsicq · Code Quality & Review

STARS11.8K
FORKS990
COMMITS5.3K
CONTRIBUTORS60
VERSION—
UPDATEDtoday
JavaScriptTersine MühendislikDosya AnaliziPlatformlar ArasıMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can set the file types and perform a static review.
  • You can run signature matching and form parsing in malware analysis and reverse engineering processes.
  • With the PE intuitive engine, you can study structural and behavioral abnormalities.
Heads up
  • • No published release
User reviews
  • • NeutralGitHub Issue

    current version detects non existing overlay in DOS 16 bit exe

    “i built DIE from source on Linux/Tumbleweed to check the fix for (Detect-Is-Easy hash: c2ecaf7 and DIE-engine hash: 771e8b8) with my older windows release installation of DIE i get this the file used for the detection test - built with tasm 3.1 and tlink 5.1 - definitly no…”

  • • NeutralGitHub Issue

    Nothing happens when I click any of the three exe files...

    “Am I missing something? And your quick scan telegram bot doesn't work either, nothing happens when you press the start bot button.”

ST

stylelint · Code Quality & Review

STARS11.5K
FORKS1.0K
COMMITS8.0K
CONTRIBUTORS427
VERSION17.15.0
UPDATED2 days ago
JavaScriptCSS LinterCode QualityStatic AnalysisMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • Using hundreds of built-in rules, you detect invalid or faulty CSS codes.
  • You control the embedded styles in HTML, Markdown, and CSS-in-JS templates by extracting them.
  • You parse CSS-like languages such as SCSS, Sass, Less, and SugarSS and apply code standards.
User reviews
  • • NeutralHacker News

    Stylelint – A modern linter for CSS

    “The only thing lacking about Stylus is the documentation really - the built-in functions page seems to list functions in random order (could be in order of addition to the language I guess!), there's no master index of the various syntax features, its usefulness varies a lot…”

  • • NeutralHacker News

    Stylelint – A modern linter for CSS

    “If using Chrome's Stylus extension's support for using Stylelint to lint a style written in Stylus is the same as on the command line, then the only real issue I've had is that you often need to use colons to separate properties and values to prevent Stylelint giving cryptic…”

CL

quay · Code Quality & Review

STARS11.1K
FORKS1.2K
COMMITS0
CONTRIBUTORS0
VERSIONv4.9.0
UPDATEDtoday
GoContainer SecurityStatic AnalysisVulnerabilitiesApache-2.0

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You index container images through API.
  • You match images to known vulnerabilities.
  • You study the security of the container infrastructure with static analysis.
User reviews
  • • NeutralHacker News

    Clair Obscur having its Indie Game Game Of The Year award stripped due to AI use

    “The real reason Clair Obscure should not have received indie game of the year in the first place is that it was developed by Sandfall interactive and published by Kepler interactive and as such is not an independent game.”

  • ↑ PositiveHacker News

    CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers

    “CoreOS was CoreOS before I got there. I came to CoreOS because of the open source nature of the company and the awesome collection of projects such as etcd, CoreOS Linux, and their work around containers. The release of Clair proves this will continue without me. While much of…”

SU

super-linter · Code Quality & Review

STARS10.6K
FORKS1.1K
COMMITS0
CONTRIBUTORS0
VERSIONv8.7.0
UPDATEDtoday
ShellGitHub ActionsLinterCode AnalysisMIT

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can apply consistent formatting rules in different programming languages.
  • You can report errors in the source code through the console output.
  • You can scan large code stores in seconds.
User reviews
  • ↓ NegativeGitHub Issue

    Shellcheck Configuration File Ignored

    “## Describe the bug Without `-x` shellcheck won't open any files that may be referenced but not explicitly passed to it on the command line. This is problematic, because super-linter invokes shellcheck once per file. ## Expected behavior I expected shellcheck not to complain…”

SY

anchore · Code Quality & Review

STARS9.8K
FORKS1.0K
COMMITS0
CONTRIBUTORS0
VERSIONv1.52.0
UPDATEDtoday
GoSBOMContainerCLIApache-2.0

Common commercial products in this category: SonarCloud, Codacy, DeepSource

What can it do?
  • You can produce SBOM for Konteyner images, archives and file systems.
  • You can convert between CycloneDX, SPDX and Syft JSON formats.
  • You can use it in conjunction with the Grype browser to detect vulnerabilities.
Heads up
  • • High number of open issues (700)