Awesome List Updates on Aug 28, 2026

11 awesome lists updated today.

🏠 Home · 🔍 Search · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor

1. Awesome Testing

Software / UI & End-to-End Testing

• Waterfall AI Test (⭐4) - Open-source visual workbench for Playwright Test Agents that turns requirements into editable plans and verified Playwright tests with human review, repair workflows, version history, and execution evidence.

Software / Accessibility & Usability Testing

• Site Punchlist - Crawls a whole site with axe-core and groups repeated findings by the shared component causing them, so one fix covers every page it appears on. Publishes which WCAG 2.2 criteria automation can and cannot reach. Free five-page scan, no account.

2. Awesome Embedded Rust

Tools / Paid and commercially available materials

• mint (⭐3) A CLI tool for firmware parametrisation. Combines data (xlsx/json) and layouts (toml) to generate static binary files (hex/mot) with support for multiple ABIs, schema fingerprinting, checksums, header generation and more.

Peripheral Access Crates / STMicroelectronics

• stm32h5 -

Peripheral Access Crates / Vorago

• va108xx -

• va416xx -

HAL implementation crates / Vorago

• va108xx-hal -
  • Blogpost

• va416xx-hal -
  • HAL implementation for VA416XX microcontrollers

Driver crates / Other

• epdsi - SPI - E-Paper Display driver framework (SSD1680/1681/1677, UC8253, JD79661, ED2208, Pervasive Displays) - examples (⭐0) -

no-std crates / WIP

• guillotine: A resource-efficient, allocation-free GUI framework built on embedded-graphics.

• metrology_insight: Embedded-first electrical metrology & power quality DSP library (IEC 61000-4-30 Class S, IEC 62053-21) -

Firmware projects / WIP

• YBLINK (⭐10): Pure Rust CMSIS-DAP v2 debugger firmware and product for the HPM5301, with USB HS SWD/JTAG and a CDC ACM UART bridge.

3. Awesome Go

Third-party APIs

• manus-ai-go (⭐19) - Go client for Manus AI API v2 with task automation, file management, webhooks, and type-safe models.

4. Awesome Bitcoin

Blockchain dump

• nodsig (⭐0) - Turns your node's blocks into sealed local artifacts: chain questions become offline lookups, and every answer carries a fingerprint anyone can recompute. Python stdlib only.

5. Awesome Gemini Cli

Agent Orchestration & CLI Tools

• godmode (⭐26) - Discipline layer for AI coding agents: 135 skills and 7 subagents that wrap Gemini CLI (and Claude Code, Codex, Cursor, OpenCode, Amp, and pi) in a measure → modify → verify → keep/revert loop with automatic rollback of failed changes. MIT.

6. Awesome Rust

Applications / System tools

• vyrti/cleaner (⭐52) - Fastest disk space usage analyzer and cleaner for Windows, macOS, Linux, and FreeBSD.

Applications / Video

• vuiodev/vuio (⭐150) - DLNA media server with support for Linux, macOS, Windows, and Docker

7. Awesome Mac

Developer Tools / Network Analysis

• Tracexy - Open-source, session-based network intelligence for capturing live traffic and investigating PCAP/PCAPNG files locally.

Utilities / Productivity

• Metrune - Local-first focus workspace that brings tasks, AI coding, GitHub activity, device events, badges, and reports into the MacBook notch.

8. Awesome Dev Fun

Golang

• termagitchi (⭐12) - A gacha machine bolted to git status: every coding-agent session hatches its own ASCII creature, and the creature gets visibly sadder the longer you leave things uncommitted.

9. Free for Dev

Forms

• Formboost.app - Developer-first form backend with simple HTTP endpoints, 500 free submissions/month, spam protection, email notifications, and built-in Slack, Discord & Telegram integrations. No backend required.

10. Awesome Neovim

Code Runner / Quickfix

• bytehound-labs/nvim-flow (⭐7) - File-scoped command runner with YAML configuration, command preview, debug integration, and traceback quickfix.

11. Static Analysis

Meaning of symbols

• ©️ stands for proprietary software. All other tools are open source.

• ℹ️ indicates that the community does not recommend the tool for new projects. The icon links to the discussion issue.

• ⚠️ means that the tool was not updated for more than one year, or its repository was archived.

Programming Languages / Other

• STOKE (⭐873) — A programming-language agnostic stochastic optimizer for the x86_64 instruction set. It uses random search to explore the extremely high-dimensional space of all possible program transformations.

• CMetrics ⚠️ — Measures size and complexity for C files.

• cqmetrics ⚠️ — Quality metrics for C code.

• IKOS ⚠️ — A sound static analyzer for C/C++ code based on LLVM.

• code-cracker ⚠️ — An analyzer library for C# and VB that uses Roslyn to produce refactorings, code analysis, and other niceties.

• Gendarme ⚠️ — Gendarme inspects programs and libraries that contain code in ECMA CIL format (Mono and .NET).

• VSDiagnostics (⭐67) — A collection of static analyzers based on Roslyn that integrates with VS.

• effective_dart ⚠️ — Linter rules corresponding to the guidelines in Effective Dart

• Primitive Erlang Security Tool (PEST) (⭐104) — A tool to do a basic scan of Erlang source code and report any function calls that may cause Erlang source code to be insecure.

• deadcode ⚠️ — Finds unused code.

• dogsled ⚠️ — Finds assignments/declarations with too many blank identifiers.

• golint ⚠️ — Prints out coding style mistakes in Go source code.

• goroutine-inspect ⚠️ — An interactive tool to analyze Golang goroutine dump.

• ineffassign ⚠️ — Detect ineffectual assignments in Go code.

• lll ⚠️ — Report long lines.

• misspell ⚠️ — Finds commonly misspelled English words.

• nargs ⚠️ — Finds unused arguments in function declarations.

• safesql (⭐558) — Static analysis tool for Golang that protects against SQL injections.

• unconvert (⭐387) — Detect redundant type conversions.

• ckjm ⚠️ — Calculates Chidamber and Kemerer object-oriented metrics by processing the bytecode of compiled Java files.

• escomplex ⚠️ — Software complexity analysis of JavaScript-family abstract syntax trees.

• jshint ℹ️ (⭐15k) ⚠️ — Detect errors and potential problems in JavaScript code and enforce your team's coding conventions.

• RSLint — A (WIP) JavaScript linter written in Rust designed to be as fast as possible, customizable, and easy to use.

• TypL — With TypL, you just write completely standard JS, and the tool figures out your types via powerful inferencing.

• lualint ⚠️ — lualint performs luac-based static analysis of global variable usage in Lua source code.

• CakeFuzzer ⚠️ — Web application security testing tool for CakePHP-based web applications. CakeFuzzer employs a predefined set of attacks that are randomly modified before execution. Leveraging its deep understanding of the Cake PHP framework, Cake Fuzzer launches attacks on all potential application entry points.

• deprecation-detector ⚠️ — Finds usages of deprecated (Symfony) code.

• DesignPatternDetector ⚠️ — Detection of design patterns in PHP code.

• Parse ⚠️ — A Static Security Scanner.

• PHP Assumptions ⚠️ — Checks for weak assumptions.

• PHP Refactoring Browser ⚠️ — Refactoring helper.

• php-speller ⚠️ — PHP spell check library.

• phpqa - jmolivas ⚠️ — PHPQA all-in-one Analyzer CLI tool.

• Progpilot (⭐367) — A static analysis tool for security purposes.

• Qafoo Quality Analyzer (⭐490) — Visualizes metrics and source code.

• Perl::Analyzer ⚠️ — Perl-Analyzer is a set of programs and modules that allow users to analyze and visualize Perl codebases by providing information about namespaces and their relations, dependencies, inheritance, and methods implemented, inherited, and redefined in packages, as well as calls to methods from parent packages via SUPER.

• bellybutton ⚠️ — A linting engine supporting custom project-specific rules.

• Bowler ⚠️ — Safe code refactoring for modern Python. Bowler is a refactoring tool for manipulating Python at the syntax tree level. It enables safe, large scale code modifications while guaranteeing that the resulting code compiles and runs. It provides both a simple command line interface and a fluent API in Python for generating complex code modifications in code.

• Dodgy ⚠️ — Dodgy is a very basic tool to run against your codebase to search for "dodgy" looking values. It is a series of simple regular expressions designed to detect things such as accidental SCM diff checkins, or passwords or secret keys hard coded into files.

• linty fresh ⚠️ — Parse lint errors and report them to Github as comments on a pull request.

• mccabe — Check McCabe complexity.

• pydocstyle — Check compliance with Python docstring conventions.

• pylyzers — A static code analyzer / language server for Python, written in Rust, focused on type checking and readable output.

• pyscn — Intelligent Python code quality analyzer with CFG-based cyclomatic complexity analysis, dead code detection, clone detection (Type 1-4), and coupling metrics. Uses tree-sitter for parsing. Written in Go.

• radon — A Python tool that computes various metrics from the source code.

• xenon — Monitor code complexity using radon.

• yapf (⭐14k) — A formatter for Python files created by Google YAPF follows a distinctive methodology, originating from the 'clang-format' tool created by Daniel Jasper. Essentially, the program reframes the code to the most suitable formatting that abides by the style guide, even if the original code already follows the style guide. This concept is similar to the Go programming language's 'gofmt' tool, which aims to put an end to debates about formatting by having the entire codebase of a project pass through YAPF whenever changes are made, thereby maintaining a consistent style throughout the project and eliminating the need to argue about style in every code review.

• cyclocomp ⚠️ — Quantifies the cyclomatic complexity of R functions / expressions.

• Fasterer ⚠️ — Common Ruby idioms checker.

• Fukuzatsu ⚠️ — A tool for measuring code complexity in Ruby class files. Its analysis generates scores based on cyclomatic complexity algorithms with no added "opinions".

• pelusa ⚠️ — Static analysis Lint-type tool to improve your OO Ruby code.

• Querly (⭐252) — Pattern Based Checking Tool for Ruby.

• Railroader — An open source static analysis security vulnerability scanner for Ruby on Rails applications.

• Saikuro — A Ruby cyclomatic complexity analyzer.

• cargo-breaking ⚠️ — cargo-breaking compares a crate's public API between two different branches, shows what changed, and suggests the next version according to semver.

• cargo-call-stack ⚠️ — Whole program static stack analysis The tool produces the full call graph of a program as a dot file.

• prae (⭐136) — Provides a convenient macro that allows you to generate type wrappers that promise to always uphold arbitrary invariants that you specified.

• Prusti — A static verifier for Rust, based on the Viper verification infrastructure. By default Prusti verifies absence of panics by proving that statements such as unreachable!() and panic!() are unreachable.

• Rust Language Server (⭐3.5k) — Supports functionality such as 'goto definition', symbol search, reformatting, and code completion, and enables renaming and refactorings.

• warnalyzer (⭐166) — Show unused code from multi-crate Rust projects

• Bytebase — Database DevSecOps platform with a built-in SQL Review engine that lints schema migrations and queries against 100+ configurable rules — naming conventions, anti-patterns, and safety checks — across MySQL, PostgreSQL, Oracle, SQL Server, Snowflake, and more.

• sleek (⭐280) — Sleek is a CLI tool for formatting SQL. It helps you maintain a consistent style across your SQL code, enhancing readability and productivity. The heavy lifting is done by the sqlformat crate.

• sqlcheck (⭐2.5k) — Automatically identify anti-patterns in SQL queries.

• tsqllint (⭐230) — T-SQL-specific linter.

• TSqlRules (⭐29) — TSQL Static Code Analysis Rules for SQL Server.

• bashate ⚠️ — Code style enforcement for bash programs. The output format aims to follow pycodestyle (pep8) default output format.

• kmdr ⚠️ — CLI tool for learning commands from your terminal. kmdr delivers a break down of commands with every attribute explained.

• stc — Speedy TypeScript type checker written in Rust

• verible-linter-action (⭐38) — Automatic SystemVerilog linting in github actions with the help of Verible Used to lint Verilog and SystemVerilog source files and comment erroneous lines of code in Pull Requests automatically.

• vint (⭐707) — Fast and Highly Extensible Vim script Language Lint implemented by Python.

Other / Other

• gokart ⚠️ — Golang security analysis with a focus on minimizing false positives. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe.

• goreporter ⚠️ — Concurrently runs many linters and normalises their output to a report.

• shisho (⭐385) — A lightweight static code analyzer designed for developers and security teams. It allows you to analyze and transform source code with an intuitive DSL similar to sed, but for code.

• squirrelscan — squirrelscan is a website QA tool built for coding agents such as Claude Code and Cursor. Its squirrel CLI crawls a live site and runs 260+ audit rules across SEO, performance, security, accessibility, structured data and agent experience, then returns exact source-mapped fixes. Runs from the terminal, CI, the cloud, or over MCP.

• standard — An npm module that checks for Javascript Styleguide issues.

• exakat ⚠️ — An automated code reviewing engine for PHP.

• flakeheaven ⚠️ — flakeheaven is a python linter built around flake8 to enable inheritable and complex toml configuration.

• dawnscanner ⚠️ — A static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

• ERB::Formatter ⚠️ — Format ERB files with speed and precision.

• htmlbeautifier ⚠️ — A normaliser/beautifier for HTML that also understands embedded Ruby. Ideal for tidying up Rails templates.

• quality (⭐156) — Runs quality checks on your code using community tools, and makes sure your numbers don't get any worse over time.

• Traceroute (⭐904) — A Rake task gem that helps you find the unused routes and controller actions for your Rails 3+ app.

• thailint — Multi-language linter targeting anti-patterns that appear disproportionately in AI-generated code: duplicated blocks across files, excessive nesting, magic numbers, Single Responsibility violations, and linter suppressions added without justification. Covers Python, TypeScript, JavaScript and Rust from one configuration, ships a pre-commit hook per rule, and emits text, JSON or SARIF for CI.

• pure (⭐268) — Pure is a static analysis file format checker that checks ZIP files for dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping headers, overflow, underflow, sparseness, accidental buffer bleeds etc.

• AzSK ⚠️ — Secure DevOps kit for Azure (AzSK) provides security IntelliSense, Security Verification Tests (SVTs), CICD scan vulnerabilities, compliance issues, and infrastructure misconfiguration in your infrastructure-as-code. Supports Azure via ARM.

• binbloom ⚠️ — Analyzes a raw binary firmware and determines features like endianness or the loading address. The tool is compatible with all architectures. Loading address: binbloom can parse a raw binary firmware and determine its loading address. Endianness: binbloom can use heuristics to determine the endianness of a firmware. UDS Database: binbloom can parse a raw binary firmware and check if it contains an array containing UDS command IDs.

• Jakstab ⚠️ — Jakstab is an Abstract Interpretation-based, integrated disassembly and static analysis framework for designing analyses on executables and recovering reliable control flow graphs.

• CSS Stats ⚠️ — Potentially interesting stats on stylesheets.

• CSScomb ⚠️ — A coding style formatter for CSS. Supports own configurations to make style sheets beautiful and consistent.

• CSSLint ⚠️ — Does basic syntax checking and finds problematic patterns or signs of inefficiency.

• GraphMyCSS.com ⚠️ — CSS Specificity Graph Generator.

• gixy ⚠️ — A tool to analyze Nginx configuration. The main goal is to prevent misconfiguration and automate flaw detection.

• cfn_nag ⚠️ — A linter for AWS CloudFormation templates.

• foodcritic ⚠️ — A lint tool that checks Chef cookbooks for common problems.

• Puppet Lint (⭐829) — Check that your Puppet manifests conform to the style guide.

• anchore ⚠️ — Discover, analyze, and certify container images. A service that analyzes Docker images and applies user-defined acceptance policies to allow automated container image validation and certification

• krane (⭐743) — Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its definition.

• trentclaw — Security assessment for your OpenClaw agent environment. Flags misconfigurations and risky skills — prompt injection, permission escalation, data exfiltration — and the chained attack paths between them, across gateway config, tool permissions, MCP servers, and plugins.

• zizmor — Static analysis for GitHub Actions workflows, detecting insecure CI/CD patterns such as excessive token permissions, template injection risks, credential persistence, and unsafe workflow references.

• gherkin-lint ⚠️ — A linter for the Gherkin-Syntax written in Javascript.

• HTML Tidy ⚠️ — Corrects and cleans up HTML and XML documents by fixing markup errors and upgrading legacy code to modern standards.

• jsonlint ⚠️ — A JSON parser and validator with a CLI. Standalone version of jsonlint.com

• Datree ⚠️ — A CLI tool to prevent Kubernetes misconfigurations by ensuring that manifests and Helm charts follow best practices as well as your organization’s policies

• klint ⚠️ — A tool that listens to changes in Kubernetes resources and runs linting rules against them. Identify and debug erroneous objects and nudge objects in line with the policies as both change over time. Klint helps us encode checks and proactively alert teams when they need to take action.

• kube-lint ⚠️ — A linter for Kubernetes resources with a customizable rule set. You define a list of rules that you would like to validate against your resources and kube-lint will evaluate those rules against them.

• qark (⭐3.4k) — Tool to look for several security related Android application vulnerabilities.

• njsscan — A static application testing (SAST) tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep.

• Credential Digger ⚠️ — Credential Digger is a GitHub scanning tool that identifies hardcoded credentials (Passwords, API Keys, Secret Keys, Tokens, personal information, etc), and filtering the false positive data through a machine learning model called Password Model. This scanner is able to detect passwords and non structured tokens with a low false positive rate.

• HasMySecretLeaked ©️ — HasMySecretLeaked is a project from GitGuardian that aims to help individual users and organizations search across 20 million exposed secrets to verify if their developer secrets have leaked on public repositories, gists, and issues on GitHub projects.

• mythril ⚠️ — A symbolic execution framework with batteries included, can be used to find and exploit vulnerabilities in smart contracts automatically.

• LibVCS4j ⚠️ — A Java library that allows existing tools to analyse the evolution of software systems by providing a common API for different version control systems and issue trackers.

• ember-template-lint ⚠️ — Linter for Ember or Handlebars templates.

• Vetur — Vue tooling for VS Code, powered by vls (vue language server). Vetur has support for formatting embedded HTML, CSS, SCSS, JS, TypeScript, and more. Vetur only has a "whole document formatter" and cannot format arbitrary ranges.

• write-good (⭐5.1k) — A linter with a focus on eliminating "weasel words".

• vastlint ©️ — Validator and linter for VAST XML ad tags. Checks wrappers and inline tags against the IAB VAST 2.0-4.3 specification and can auto-fix deterministic issues.

Multiple languages / Other

• AST Metrics — Multi-language maintainability analyzer. Computes cyclomatic and cognitive complexity, Halstead volume, afferent/efferent coupling and maintainability index, detects communities in the dependency graph, and generates an explorable HTML report plus JSON, Markdown, SARIF and OpenMetrics output. Single fast binary with no runtime dependency, and a built-in MCP server so AI agents can query codebase structure before refactoring.

• callGraph ⚠️ — Statically generates a call graph image and displays it on screen.

• Codemodder ⚠️ — Codemodder is a pluggable framework for building expressive codemods. Use Codemodder when you need more than a linter or code formatting tool. Use it to fix non-trivial security issues and other code quality problems.

• emerge (⭐1.1k) — Emerge is a source code and dependency visualizer that can be used to gather insights about source code structure, metrics, dependencies and complexity of software projects. After scanning the source code of a project it provides you an interactive web interface to explore and analyze your project by using graph structures.

• Fallow — Rust-native static analysis for JavaScript and TypeScript. Maps a repository as one dependency graph to find unused code and structural problems across file boundaries. Runs from the CLI or GitHub Actions, with VS Code, LSP, MCP, and Node API integrations.

• Inkog — AI agent security scanner. Detects behavioral vulnerabilities (prompt injection, infinite loops, token bombing, SQL injection via LLM) across 11 framework adapters including LangChain, CrewAI, and pydantic-ai. Audits MCP servers. Maps findings to EU AI Act, OWASP LLM Top 10, and NIST AI RMF.

• nestjs-doctor (⭐157) — Static analysis tool for NestJS applications. Detects anti-patterns across security, performance, correctness, and architecture with 30+ built-in rules. Outputs a 0-100 health score. Includes module graph visualization, endpoint dependency graphs, and database schema analysis. CLI and VS Code extension.

• Offensive360 ©️ — Offensive360 is an application security platform combining SAST (taint/data-flow analysis across 60+ languages), DAST, SCA, mobile app scanning (Android/iOS), malware/binary analysis and license compliance. Findings include the full source-to-sink trace and a secure code example. Deploys as SaaS or as a self-hosted virtual appliance for offline/air-gapped networks. SARIF output; CI/CD (GitHub Actions, GitLab, Jenkins, Azure DevOps) and IDE integrations.

• Repowise — Deterministic, zero-LLM code-health analysis. Scores every file 1-10 for defect risk, maintainability, and performance from 25 markers: McCabe complexity, LCOM4 cohesion, god classes, Rabin-Karp clone detection, change entropy, and untested hotspots. Adds a dependency graph, dead-code detection, git-history signals (churn, ownership, co-change), and concrete graph-aware refactoring plans. Ships as a CLI, an MCP server, and a VS Code extension across 15 languages.

• sem (⭐3.3k) — Semantic version control CLI that provides entity-level diffs, blame, and impact analysis on top of git. Uses tree-sitter to parse 26 languages and builds a cross-file dependency graph with structural hashing. Commands include sem diff, sem blame, sem graph, and sem impact for blast-radius analysis of code changes.

• Super-Linter (⭐152) — Combination of multiple linters to install as a GitHub Action.

• Wakaru — JavaScript decompiler that turns bundled, minified, transpiled production code back into readable modules. Unpacks webpack, esbuild, Metro, Browserify, SystemJS, and AMD/UMD bundles, then reverses minifier artifacts and Babel/TypeScript/SWC helpers (async/await, classes, optional chaining, and more). Written in Rust; runs as a CLI or fully in-browser via WebAssembly.

• weave (⭐1.3k) — Entity-level semantic merge driver for git. Resolves false conflicts that line-based merge produces when independent changes touch the same file. Parses functions and classes via tree-sitter, matches by name, and merges at the entity level. Benchmarked at 100% clean merges vs git's 48% on a 31-scenario suite.

• Wotan (⭐281) — Pluggable TypeScript and JavaScript linter.

• Next: Aug 27, 2026