A maintainer-curated catalog of PHP static analysis, code quality, coding standards, metrics, refactoring, and hosted analysis tools.
Open the searchable catalog · Submit a tool · Report incorrect data
A small, manually approved set of practical starting points. Selection considers present-day PHP relevance, maintenance, documentation, adoption, and a distinct use case; it is not an automatic stars ranking.
Tools that inspect PHP code without running it to identify type errors, defects, dependency problems, and potential vulnerabilities.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| PHPStan ⭐ 14,070 |
PHP applications that need configurable type-safety checks and a broad extension ecosystem | Rule levels, baselines, and framework extensions support both gradual adoption and deep type analysis. |
| psalm ⭐ 5,881 |
Projects needing advanced type modelling, taint analysis, and security checks | An expressive type system and taint engine cover correctness and application-security problems. |
Linters and rule-enforcement tools for formatting, naming, documentation, and project-specific coding conventions.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| PHP_CodeSniffer ⭐ 1,545 |
Teams enforcing published PHP standards or detailed project-specific coding rules | Its extensible sniff API supports mature community standards and precise custom rules. |
Ready-to-use tools that enforce dependency boundaries and architectural constraints in an application.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| Deptrac ⭐ 2,989 |
Layered applications and modular monoliths that enforce dependency boundaries in CI | Dependency rules convert intended architecture boundaries into repeatable CI checks. |
Parsers, reflection libraries, and control-flow components for developers building custom analysis rules or tools.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| PHP Parser ⭐ 17,450 |
Developers building analyzers, refactoring tools, formatters, or source transformations | A mature AST, traversal API, and code builder underpin many PHP analysis and transformation tools. |
Tools that automatically correct coding-standard violations, upgrade PHP syntax, or refactor existing code.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| PHP CS Fixer ⭐ 13,547 |
Projects that want automatic formatting and coding-standard fixes | A broad fixer catalog and custom rule sets make formatting changes deterministic and automatable. |
| Rector ⭐ 10,400 |
Teams automating PHP upgrades, framework migrations, or repeatable refactoring | AST-based rules turn upgrades and refactoring recipes into reviewable project-wide code changes. |
| Laravel Pint ⭐ 3,148 |
Laravel projects that want a low-configuration, framework-oriented formatter | Laravel-maintained presets deliver practical PHP-CS-Fixer defaults with very little setup. |
Wrappers, baseliners, multi-language engines, and focused analysis tools that do not fit the primary categories.
| Tool | Recommended for | Why it stands out |
|---|---|---|
| Semgrep ⭐ 16,206 |
Security teams writing custom checks for PHP and polyglot repositories | Source-like patterns make custom bug and security checks accessible across multiple languages. |
Repository tables are sorted by activity, then GitHub stars. Activity is evidence, not an editorial recommendation. Hosted services are sorted alphabetically.
Links: 
Activity: The first badge shows the last commit date. Its color indicates repository activity: green = within 90 days; yellow = 90–182 days; orange = 183–364 days; light grey = older or unavailable repository data. The second badge shows the last release date when available. Repository inactivity alone does not retire a stable tool; In Memoriam is an explicit editorial product-status decision.
Tools that inspect PHP code without running it to identify type errors, defects, dependency problems, and potential vulnerabilities.
| Tool | Best for | Status | Links |
|---|---|---|---|
| PHPStan 🥇 ⭐ 14,070 |
Bug Detection, Type Analysis — PHP Static Analysis Tool - discover bugs in your code… |   2.2.8 |
|
| jscpd 🥈 ⭐ 5,999 |
Duplication — Copy/paste detector for programming source code, supports 223 formats… |  v4.3.0 |
|
| psalm 🥉 ⭐ 5,881 |
Bug Detection, Type Analysis, Security, Taint Analysis — A PHP static analysis tool… |   6.16.1 |
|
| Phan ⭐ 5,622 |
Bug Detection, Type Analysis — Phan is a static analyzer for PHP. Phan prefers to… |   6.0.7 |
|
| mago ⭐ 3,375 |
Bug Detection, Type Analysis, Code Style — Mago is a toolchain for PHP that aims to… |  1.46.0 |
|
| PHP Mess Detector ⭐ 2,444 |
Maintainability, Complexity — PHPMD is a spin-off project of PHP Depend and aims to be… |   2.15.0 |
|
| PHP Compatibility ⭐ 2,299 |
PHP Version Compatibility — PHP Compatibility check for PHP_CodeSniffer |  9.3.5 |
|
| PHP Inspections (EA Extended) ⭐ 1,485 |
Deep PHP code inspections directly in JetBrains IDEs |  |
|
| PHPStan Symfony ⭐ 793 |
Symfony applications that need PHPStan to understand containers, console commands… |   2.0.20 |
|
| PHPStan Strict Rules ⭐ 704 |
Teams that have adopted PHPStan and want stronger correctness constraints than the… |  2.0.12 |
|
| composer-dependency-analyser ⭐ 626 |
Dependency Analysis — 🚀 Fast detection of composer dependency issues (unused… |  1.8.4 |
|
| Skylos ⭐ 536 |
Local pull-request scanning for dead code and security issues |  v4.33.2 |
|
| ShipMonk Dead Code Detector ⭐ 502 |
Large PHP applications that need framework-aware dead-code detection and optional… |   1.3.3 |
|
| PHPStan Deprecation Rules ⭐ 458 |
Applications and libraries preventing new deprecated API usage during upgrades. |  2.0.5 |
|
| SonarQube PHP ⭐ 430 |
PHP quality and security analysis in the SonarQube ecosystem |  3.60.0.16641 |
|
| php-compat-info ⭐ 380 |
PHP Version Compatibility, Dependency Analysis — Library that find out the minimum… |   7.2.6 |
|
| PHP-Parallel-Lint (maintained) ⭐ 356 |
Syntax — This tool check syntax of PHP files faster than serial check with fancier… |   v1.4.0 |
|
| phpstan-dba ⭐ 297 |
PHP applications that want SQL errors and database access-layer type problems caught… |  0.4.10 |
|
| phanalist ⭐ 161 |
Bug Detection — Performant static analyzer for PHP, which is extremely easy to use. It… |  v1.1.10 |
|
| PHPDoctor ⭐ 53 |
Documentation, Type Analysis — 🏥 PHPDoctor: Check files, full directories or strings… |   0.8.0 |
|
| name-collision-detector ⭐ 35 |
Namespace Collisions — Fast & simple tool to find class duplicates in your projects. |   2.1.1 |
|
| Composer-Unused ⭐ 1,684 |
Dependency Analysis — Show unused composer dependencies by scanning your code |   0.9.6 |
|
| PHP Magic Number Detector ⭐ 586 |
Maintainability — PHP Magic Number Detector |   v3.6.1 |
|
| PHP Analysis ⭐ 29 |
Language Analysis — PHP language analyses in Rascal |   v1.1.0 |
|
| PHP Static Type Checker | Type Analysis — Static type checker for PHP relying on the php-ast PECL extension… |  |
|
| noverify ⭐ 688 |
Bug Detection, Type Analysis — Pretty fast linter (code static analysis utility) for PHP |   v0.5.5 |
|
| Progpilot ⭐ 365 |
Security, Taint Analysis — A static analysis tool for security |   v1.3.0 |
|
Linters and rule-enforcement tools for formatting, naming, documentation, and project-specific coding conventions.
| Tool | Best for | Status | Links |
|---|---|---|---|
| WordPress Coding Standards 🥇 ⭐ 2,822 |
WordPress core, plugin, and theme projects enforcing ecosystem conventions in CI. |  3.4.1 |
|
| EasyCodingStandard 🥈 ⭐ 1,620 |
Code Style, Autofix — ECS runs PHP-CS-Fixer and PHP_CodeSniffer as a single, parallel… |  13.2.15 |
|
| PHP_CodeSniffer 🥉 ⭐ 1,545 |
Code Style — PHP_CodeSniffer tokenizes PHP files and detects violations of a defined… |   4.0.4 |
|
| Slevomat Coding Standard ⭐ 1,480 |
Teams building a strict, project-specific PHPCS standard with many automatically… |   8.31.1 |
|
| composer-normalize ⭐ 1,117 |
Manifest Style — 🎵 Provides a composer plugin for normalizing composer.json. |  2.52.0 |
|
| editorconfig-checker ⭐ 75 |
Code Style — A tool to verify that your files are in harmony with your .editorconfig |  10.7.0 |
|
| TLint ⭐ 526 |
Code Style — Tighten linter for Laravel conventions. |   v9.6.1 |
|
| PHP Doc Check ⭐ 43 |
Documentation — Uses complexity metrics to determine which functions need documentation. |   v0.4.1 |
|
Ready-to-use tools that enforce dependency boundaries and architectural constraints in an application.
| Tool | Best for | Status | Links |
|---|---|---|---|
| Deptrac 🥇 ⭐ 2,989 |
Architecture, Dependency Analysis — Keep your architecture clean. |   4.7.1 |
|
| PHP Architecture Tester 🥈 ⭐ 1,274 |
Architecture — ✔️ PHP Architecture Tester - Easy architecture testing for PHP |  0.12.4 |
|
| PHPArkitect 🥉 ⭐ 924 |
Architecture — Put your architectural rules under test! | 1.3.0 |
|
Parsers, reflection libraries, and control-flow components for developers building custom analysis rules or tools.
| Tool | Best for | Status | Links |
|---|---|---|---|
| PHP Parser 🥇 ⭐ 17,450 |
Parsing, Ast — A PHP parser written in PHP |   v5.8.0 |
|
| PHPStan PHPDoc Parser 🥈 ⭐ 1,532 |
Analyzer and documentation-tool authors who need a maintained PHPDoc AST. |  2.3.3 |
|
| Better Reflection 🥉 ⭐ 1,246 |
Source Reflection — 🔮 Better Reflection is a reflection API that aims to… | 6.72.0 |
|
| php-ast ⭐ 982 |
Analyzer authors who need the engine AST; Phan is a prominent consumer. |   v1.1.3 |
|
| PHP-cfg ⭐ 246 |
Control Flow Analysis — A Control Flow Graph implementation in PHP |  V0.8.1 |
|
| Reflection ⭐ 125 |
Source Reflection, Type Resolution — Reflection library to do Static Analysis for PHP… |  7.0.0 |
|
Tools that automatically correct coding-standard violations, upgrade PHP syntax, or refactor existing code.
| Tool | Best for | Status | Links |
|---|---|---|---|
| PHP CS Fixer 🥇 ⭐ 13,547 |
Code Style, Autofix — A tool to automatically fix PHP Coding Standards issues |  v3.95.18 |
|
| Rector 🥈 ⭐ 10,400 |
Refactoring, Upgrade, Autofix — Instant Upgrades and Automated Refactoring of any PHP… | 2.6.2 |
|
| Laravel Pint 🥉 ⭐ 3,148 |
Laravel projects that want a low-configuration formatter with framework-oriented… |  v1.30.5 |
|
| Phpactor ⭐ 1,912 |
Refactoring, Editor Assistance — Mainly a PHP Language Server with more features than… | 2026.07.22.0 |
|
| php-scoper ⭐ 806 |
Namespace Isolation — 🔨 Prefixes all PHP namespaces in a file/directory to isolate the… |   0.18.19 |
|
| PHP Weaver ⭐ 85 |
Runtime Analysis, Type Analysis — A combined runtime/static code-analysis tool, that… |  |
|
Tools that measure complexity, coupling, dependencies, maintainability, churn, and other structural properties.
| Tool | Best for | Status | Links |
|---|---|---|---|
| PHPInsights 🥇 ⭐ 5,629 |
Code Quality, Metrics, Architecture — 🔰 Instant PHP quality checks from your console |   v2.14.2 |
|
| PHP Metrics 🥈 ⭐ 2,608 |
Metrics, Complexity, Architecture — Beautiful and understandable static analysis tool… | v2.11.0 |
|
| PDepend 🥉 ⭐ 958 |
Measuring PHP design quality and dependency structure |   2.16.2 |
|
| AST Metrics ⭐ 152 |
Multi-language architecture, dependency, complexity, and code-structure metrics. | v0.42.0 |
|
| PhpCodeArcheology ⭐ 87 |
Metrics, Dependency Analysis, Churn — PHP static analysis for architecture &… |  v2.11.2 |
|
| churn-php ⭐ 1,376 |
Churn, Complexity — Discover files in need of refactoring. |   1.7.3 |
|
| dePHPend ⭐ 532 |
Dependency Analysis, Architecture — Detect flaws in your architecture, before they… |  0.9.0 |
|
| php-class-dependencies-analyzer ⭐ 21 |
Dependency Analysis, Architecture — This tool allows you to monitor the dependencies… |  |
|
Wrappers, baseliners, multi-language engines, and focused analysis tools that do not fit the primary categories.
| Tool | Best for | Status | Links |
|---|---|---|---|
| Semgrep 🥇 ⭐ 16,206 |
Security, Custom Rules — Lightweight static analysis for many languages. Find bug… | v1.173.0 |
|
| Larastan 🥈 ⭐ 6,483 |
Type Analysis, Bug Detection — ⚗️ Adds code analysis to Laravel improving developer… | v3.10.0 |
|
| GrumPHP 🥉 ⭐ 4,308 |
Running a project’s PHP quality tools before code is committed | v2.23.0 |
|
| Qlty ⭐ 3,118 |
Polyglot teams that want one local and CI workflow around PHPStan, PHPCS… | v0.641.0 |
|
| Opengrep ⭐ 2,938 |
Security, Custom Rules — 🔎 Static code analysis engine to find security issues in code. | v1.27.0 |
|
| jakzal/phpqa ⭐ 1,319 |
Running a ready-made PHP analysis toolchain in Docker | v1.124.1 |
|
| Composer Require Checker ⭐ 1,009 |
Dependency Analysis — A CLI tool to check whether a specific composer package uses… |  4.24.0 |
|
| Roave Backward Compatibility Check ⭐ 601 |
Library maintainers enforcing semantic-versioning compatibility in CI. | 8.21.0 |
|
| Glayzzle PHP Parser (Node.js) ⭐ 563 |
JavaScript and Node.js tooling that needs to parse PHP without running PHP. |  v3.7.0 |
|
| aislop ⭐ 549 |
Detecting AI-code mistakes and quality regressions before merge |  v0.14.1 |
|
| Static Analysis Results Baseliner ⭐ 165 |
Baseline Management — Static Analysis Results Baseliner |   1.11.0 |
|
| Coverage Guard ⭐ 56 |
Adjacent test-quality gating for critical methods and newly changed PHP code. |   1.1.0 |
|
| PHPQA ⭐ 564 |
Quality Gates — Analyze PHP code with one command |   v1.27.2 |
|
| PHP Semantic Versioning Checker ⭐ 436 |
Detecting source-level API compatibility changes before publishing a PHP package… |   v0.17.0 |
|
Web-based services that analyze repositories through hosted scans, dashboards, or CI integrations.
| Service | Best for | Delivery | Link |
|---|---|---|---|
| Checkmarx | Security, Sast — Checkmarx scans PHP source code for security vulnerabilities and… | Hosted service | |
| Codacy | Continuous code quality and security checks across repositories | Hosted dashboard with SCM and CI integrations | |
| DeepSource | Continuous PHP static analysis, SAST, and coverage reporting | Hosted repository analysis with pull-request integrations | |
| Laravelshift | Upgrade, Refactoring — the automated way to upgrade Laravel applications. Upgrade… | Hosted service | |
| Qodana for PHP | PhpStorm-grade PHP inspections and quality gates in CI | Cloud reports with native or Docker-based PHP linters | |
| Snyk Code | Security-focused PHP static application security testing | Hosted dashboard with SCM, CLI, IDE, and CI integrations | |
| SonarQube Cloud | Hosted PHP quality gates, maintainability checks, and security analysis | Hosted dashboard with repository and CI integrations | |
| SymfonyInsight | Continuous PHP and Symfony quality, security, performance, and upgrade reports. | Hosted service | |
These projects are no longer actively maintained, but their ideas, code, and communities made a lasting contribution to the PHP ecosystem. We preserve them here with gratitude and respect.
| Project | Contribution | Category | Last activity | Legacy resources |
|---|---|---|---|---|
| Code Climate | Historical Code Climate Quality service, succeeded by Qlty Software and the Qlty CLI. | Hosted analysis services | Unknown | |
| Coverage Checker | Allows old code to use new standards | Specialized tools | Jun 25, 2024 | |
| Exakat | Legacy repository for the Exakat PHP static-analysis engine, superseded by exakat-ce. | Bug finders | Mar 24, 2022 | |
| Fixtro | A QA static analysis code, with a different approach | Specialized tools | Mar 2, 2019 | |
| FunctionFQNReplacer | provides a way to replace relative references of functions in function calls with absolute references | Fixers and refactoring | Jul 5, 2017 | |
| HHVM | A virtual machine for executing programs written in Hack. | Specialized tools | Aug 13, 2026 | |
| Pahout | A pair programming partner for writing better PHP. Pahout means PHP mahout 🐘 | Coding standards | Jun 26, 2020 | |
| Pfff | Tools for code analysis, visualizations, or style-preserving source transformation. | Bug finders | Mar 27, 2019 | |
| PHP Assumption | Tool to detect assumptions | Bug finders | Mar 22, 2025 | |
| PHP BackSlasher | [Git hook] Tool to add all PHP internal functions and constants to its namespace by adding backslash to them. | Fixers and refactoring | Apr 21, 2020 | |
| PHP formatter | PHP Formatter is a PHP developer friendly set of tools | Coding standards | Jun 24, 2021 | |
| PHP Manipulator | Library for Analyzing and Modifying PHP Source Code | Specialized tools | Sep 27, 2014 | |
| PHP SA | Smart/Static Analyzer(sis) for PHP   |
Bug finders | Feb 27, 2019 | |
| PHP testability | Analyses and reports testability issues of a php codebase | Bug finders | Jan 27, 2022 | |
| PHP-malware-finder | Detect potentially malicious PHP files | Bug finders | Feb 22, 2022 | |
| PHP-Parallel-Lint (legacy repository) | This tool check syntax of PHP files faster than serial check with fancier output. | Bug finders | Mar 13, 2021 | |
| php-refactoring-browser | A command line refactoring tool for PHP | Fixers and refactoring | Nov 15, 2017 | |
| php7mar | PHP 7 Migration Assistant Report (MAR) | Bug finders | May 28, 2019 | |
| PHP_CodeSniffer (legacy repository) | PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. | Coding standards | Apr 1, 2024 | |
| PhpCodeAnalyzer | Really, it's "php extensions usage analyzer". It scans codebase and analyzes which non-built-in php… | Bug finders | Jan 17, 2023 | |
| PHPCodeFixer | Analyzer of PHP code to search issues with deprecated functionality in newer interpreter versions. | Bug finders | Feb 14, 2024 | |
| PHPCPD | Copy/Paste Detector (CPD) for PHP code. | Bug finders | Jan 10, 2023 | |
| PhpDependencyAnalysis | Static code analysis to find violations in a dependency graph | Metrics and architecture | Dec 3, 2023 | |
| phpdoc to typehint | Add scalar type hints and return types to existing PHP projects using PHPDoc annotations | Fixers and refactoring | Dec 28, 2020 | |
| PHPLOC | A tool for quickly measuring the size of a PHP project. | Metrics and architecture | Apr 12, 2025 | |
| psecio:parse | Parse: A Static Security Scanner | Bug finders | Aug 7, 2018 | |
| Quality Analyzer | Tool helping us to analyze software projects | Metrics and architecture | Dec 6, 2019 | |
| RIPS | Historical PHP security analyzer acquired by SonarSource in 2020 and integrated into SonarQube. | Hosted analysis services | Unknown | |
| Scrutinizer | The retired Scrutinizer service provided continuous inspection for automated code-quality and bug detection. | Hosted analysis services | Jan 5, 2017 | |
| SideCI | Retired continuous-integration service for automated code review and static analysis. | Hosted analysis services | Unknown | |
| Transphpile | PHP 7 to PHP 5.6 Transpiler | Fixers and refactoring | Sep 2, 2017 | |
Repository code is available under the MIT License. Catalog records, generated catalog exports and tables, and original editorial documentation are available under CC BY 4.0, including for commercial reuse with attribution.
Inspired by the pioneering PHP Static Analysis Tools catalog by Exakat and its contributors.
Catalog metadata comes from common/catalog/*.yaml; Editors' Choice membership and copy come from common/editor-choice.yaml and common/editor-choice-copy.yaml; manually maintained pros and cons come from common/pros-cons.yaml. Machine-readable exports are published in exports/. Run python scripts/full_workflow.py to refresh metadata, validate the source records, and regenerate derived files.