Maintainer-curated PHP tooling index
Explore static analyzers, coding-standard tools, architecture guards, metrics, refactoring utilities, and hosted services in one current, searchable catalog.
Catalog freshness: 107/111 records refreshed within 7 days as of .
Search installable tools
Installable analyzers, packages, plugins, and command-line tools come first. Recommended order prioritizes editorial relevance; repository activity remains a separate signal.
Showing 72 tools
Default order: current editorial picks, then other current tools. Search covers descriptions, tags, ecosystems, capabilities, and trade-offs. Jump to results ↓
A practical starting point
One maintainer-curated starting point per category. The full set remains available below, with repository data and evidence-backed trade-offs.
PHP applications that need configurable type-safety checks and a broad extension ecosystem
Rule levels, baselines, and framework extensions support both gradual adoption and deep type analysis.
ProPairs mature type analysis with a large extension ecosystem.
ConHigher rule levels often need annotations and gradual adoption.
Evidence: Source 1
Teams enforcing published PHP standards or detailed project-specific coding rules
Its extensible sniff API supports mature community standards and precise custom rules.
ProSupports established standards and detailed custom sniffs.
ConLarge standards need configuration and can produce many findings.
Evidence: Source 1
Projects that want automatic formatting and coding-standard fixes
A broad fixer catalog and custom rule sets make formatting changes deterministic and automatable.
ProOffers a broad catalog of automatic coding-standard fixes.
ConBroad rule changes can create large review diffs.
Evidence: Source 1
Layered applications and modular monoliths that enforce dependency boundaries in CI
Dependency rules convert intended architecture boundaries into repeatable CI checks.
ProTurns layer and module boundaries into repeatable CI checks.
ConThe dependency map must stay aligned with the architecture.
Evidence: Source 1
Developers building analyzers, refactoring tools, formatters, or source transformations
A mature AST, traversal API, and code builder underpin many PHP analysis and transformation tools.
ProProvides a mature PHP AST and traversal API.
ConIt produces syntax structures, not high-level findings.
Evidence: Source 1
Security teams writing custom checks for PHP and polyglot repositories
Source-like patterns make custom bug and security checks accessible across multiple languages.
ProMakes custom security rules concise and language-friendly.
ConDeep PHP type and framework semantics are limited.
Evidence: Source 1
Projects needing advanced type modelling, taint analysis, and security checks
An expressive type system and taint engine cover correctness and application-security problems.
ProCombines expressive types with taint and security analysis.
ConAdvanced checks add annotation and configuration work.
Evidence: Source 1
Teams automating PHP upgrades, framework migrations, or repeatable refactoring
AST-based rules turn upgrades and refactoring recipes into reviewable project-wide code changes.
ProAutomates PHP upgrades and repeatable AST refactoring.
ConGenerated refactors still require tests and code review.
Evidence: Source 1
Laravel projects that want a low-configuration, framework-oriented formatter
Laravel-maintained presets deliver practical PHP-CS-Fixer defaults with very little setup.
ProProvides Laravel-oriented formatting defaults with minimal configuration.
ConIts opinionated defaults offer less control than configuring PHP-CS-Fixer directly.
Evidence: Source 1
PHP Static Analysis Tool - discover bugs in your code without running it!
ProPairs mature type analysis with a large extension ecosystem.
ConHigher rule levels often need annotations and gradual adoption.
Evidence: Source 1
Editorially reviewed
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
ProCombines expressive types with taint and security analysis.
ConAdvanced checks add annotation and configuration work.
Evidence: Source 1
Editorially reviewed
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
ProSupports established standards and detailed custom sniffs.
ConLarge standards need configuration and can produce many findings.
Evidence: Source 1
Editorially reviewed
A tool to automatically fix PHP Coding Standards issues
ProOffers a broad catalog of automatic coding-standard fixes.
ConBroad rule changes can create large review diffs.
Evidence: Source 1
Editorially reviewed
Instant Upgrades and Automated Refactoring of any PHP 5.3+ code
ProAutomates PHP upgrades and repeatable AST refactoring.
ConGenerated refactors still require tests and code review.
Evidence: Source 1
Editorially reviewed
Keep your architecture clean.
ProTurns layer and module boundaries into repeatable CI checks.
ConThe dependency map must stay aligned with the architecture.
Evidence: Source 1
Editorially reviewed
A PHP parser written in PHP
ProProvides a mature PHP AST and traversal API.
ConIt produces syntax structures, not high-level findings.
Evidence: Source 1
Editorially reviewed
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
ProMakes custom security rules concise and language-friendly.
ConDeep PHP type and framework semantics are limited.
Evidence: Source 1
Editorially reviewed
Laravel projects that want a low-configuration formatter with framework-oriented defaults.
ProProvides Laravel-oriented formatting defaults with minimal configuration.
ConIts opinionated defaults offer less control than configuring PHP-CS-Fixer directly.
Evidence: Source 1
Editorially reviewed
⚗️ Adds code analysis to Laravel improving developer productivity and code quality.
ProTeaches PHPStan about Laravel containers, facades, and models.
ConIt depends on PHPStan and Laravel-specific configuration.
Evidence: Source 1
Editorially reviewed
Copy/paste detector for programming source code, supports 223 formats. AI-ready with token-efficient reporter, skill and MCP server.
ProDetects duplication across PHP and hundreds of other formats.
ConGenerated code and boilerplate need threshold tuning.
Evidence: Source 1
Editorially reviewed
🔰 Instant PHP quality checks from your console
ProSummarizes several PHP quality checks in one console report.
ConAggregate scores can hide why a rule matters.
Evidence: Source 1
Editorially reviewed
Official website currently unavailable
Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.
ProPrioritizes low false-positive AST-based type analysis.
ConIt requires the php-ast extension and careful configuration.
Evidence: Source 1
Editorially reviewed
Running a project’s PHP quality tools before code is committed
ProRuns the project's quality tools before commit and in CI.
ConIt orchestrates analyzers rather than adding its own checks.
Evidence: Source 1
Editorially reviewed
Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
ProCombines fast linting, analysis, and formatting in one toolchain.
ConIts ecosystem is younger than established PHP analyzers.
Evidence: Source 1
Editorially reviewed
Polyglot teams that want one local and CI workflow around PHPStan, PHPCS, PHP-CS-Fixer, Semgrep, and other tools.
Editorially reviewed
🔎 Static code analysis engine to find security issues in code.
ProUses source-like rules for custom security checks.
ConCustom rules need tuning to control false positives.
Evidence: Source 1
Editorially reviewed
WordPress core, plugin, and theme projects enforcing ecosystem conventions in CI.
ProApplies the official WordPress PHP conventions through the familiar PHPCS workflow.
ConIts conventions are specific to WordPress projects and require PHP_CodeSniffer.
Evidence: Source 1
Editorially reviewed
Beautiful and understandable static analysis tool for PHP
ProTurns code metrics into readable visual reports.
ConMetrics do not prescribe the right refactor.
Evidence: Source 1
Editorially reviewed
PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD. PHPMD can be seen as an user friendly frontend application for the raw metrics stream measured by PHP Depend.
ProCatches complexity, naming, and maintainability problems.
ConDefault rules can be noisy on existing codebases.
Evidence: Source 1
Editorially reviewed
PHP Compatibility check for PHP_CodeSniffer
ProChecks code against a target PHP version range.
ConIt needs PHP_CodeSniffer and cannot prove runtime compatibility.
Evidence: Source 1
Editorially reviewed
Mainly a PHP Language Server with more features than you can shake a stick at
ProCombines a PHP language server with refactoring tools.
ConIts editor-focused setup can feel heavy for CI-only use.
Evidence: Source 1
Editorially reviewed
ECS runs PHP-CS-Fixer and PHP_CodeSniffer as a single, parallel fast tool with zero dependencies. Run on PHP 7.2+
ProRuns PHP-CS-Fixer and PHP_CodeSniffer from one config.
ConIts wrapper adds another configuration layer.
Evidence: Source 1
Editorially reviewed
Analyzer and documentation-tool authors who need a maintained PHPDoc AST.
ProProvides a maintained PHPDoc AST with generics and advanced type syntax.
ConIt is a parser library, not a ready-to-run analyzer.
Evidence: Source 1
Editorially reviewed
Deep PHP code inspections directly in JetBrains IDEs
ProAdds broad PHP inspections and quick fixes inside JetBrains IDEs.
ConIt requires a supported JetBrains IDE.
Evidence: Source 1
Editorially reviewed
Teams building a strict, project-specific PHPCS standard with many automatically fixable rules.
ProOffers a broad PHPCS ruleset spanning safety, cleanup, formatting, and autofix.
ConIts large and evolving rule catalog needs an explicitly pinned project ruleset.
Evidence: Source 1
Editorially reviewed
Running a ready-made PHP analysis toolchain in Docker
ProBundles a maintained PHP analysis toolchain in Docker.
ConThe Docker image is heavier than installing one focused tool.
Evidence: Source 1
Editorially reviewed
✔️ PHP Architecture Tester - Easy architecture testing for PHP
ProExpresses architecture constraints as readable PHP tests.
ConIts rule ecosystem is smaller than older architecture tools.
Evidence: Source 1
Editorially reviewed
:crystal_ball: Better Reflection is a reflection API that aims to improve and provide more features than PHP's built-in reflection API.
ProInspects source without loading the reflected classes.
ConIt is a building block, not a ready-made analyzer.
Evidence: Source 1
Editorially reviewed
🎵 Provides a composer plugin for normalizing composer.json.
ProKeeps composer.json formatting deterministic.
ConIt only checks and rewrites composer.json.
Evidence: Source 1
Editorially reviewed
A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
ProFinds symbols used without a direct Composer dependency.
ConDynamic symbols can require allowlists.
Evidence: Source 1
Editorially reviewed
Analyzer authors who need the engine AST; Phan is a prominent consumer.
ProExposes the PHP engine's native AST with low parsing overhead.
ConIt is a native extension and consumers must build the actual analysis.
Evidence: Source 1
Editorially reviewed
Measuring PHP design quality and dependency structure
ProMeasures coupling, complexity, and maintainability in detail.
ConTeams must interpret the metrics and choose thresholds.
Evidence: Source 1
Editorially reviewed
Put your architectural rules under test!
ProKeeps architecture rules beside the project's test code.
ConTeams must define enough rules to cover the design.
Evidence: Source 1
Editorially reviewed
🔨 Prefixes all PHP namespaces in a file/directory to isolate the code bundled in PHARs.
ProIsolates bundled PHP code by prefixing namespaces.
ConDynamic names and bundled resources still need testing.
Evidence: Source 1
Editorially reviewed
Symfony applications that need PHPStan to understand containers, console commands, forms, Messenger, and framework return types.
ProTeaches PHPStan about Symfony containers, console commands, forms, and Messenger.
ConAdvanced checks require generated Symfony container metadata and framework-specific setup.
Evidence: Source 1
Editorially reviewed
Teams that have adopted PHPStan and want stronger correctness constraints than the default configuration.
ProEnables a maintained set of stricter correctness rules with little setup.
ConOpinionated rules can create substantial adoption work in an existing codebase.
Evidence: Source 1
Editorially reviewed
🚀 Fast detection of composer dependency issues (unused dependencies, shadow dependencies, misplaced dependencies)
ProFinds unused, shadowed, and misplaced Composer dependencies.
ConIt does not replace type or behavior analysis.
Evidence: Source 1
Editorially reviewed
Library maintainers enforcing semantic-versioning compatibility in CI.
ProTurns PHP API compatibility changes into an enforceable CI check.
ConIt depends on Git history and SemVer tags and cannot detect every behavioral compatibility break.
Evidence: Source 1
Editorially reviewed
JavaScript and Node.js tooling that needs to parse PHP without running PHP.
ProExposes PHP tokens and an AST to Node.js tools.
ConIt is a JavaScript parser, not a complete analyzer.
Evidence: Source 1
Editorially reviewed
Detecting AI-code mistakes and quality regressions before merge
ProFinds common AI-code mistakes with deterministic rules.
ConHeuristic findings still need human review.
Evidence: Source 1
Editorially reviewed
Local pull-request scanning for dead code and security issues
ProScans pull requests locally for dead code and security issues.
ConIts broad PR checks may need repository-specific tuning.
Evidence: Source 1
Editorially reviewed
Large PHP applications that need framework-aware dead-code detection and optional removal.
ProFinds transitive and framework-driven dead code and can remove selected findings.
ConDynamic framework behavior may still require configuration or custom usage providers.
Evidence: Source 1
Editorially reviewed
Applications and libraries preventing new deprecated API usage during upgrades.
ProDetects deprecated APIs and supports project-defined deprecation markers.
ConIt only reports deprecations that metadata, stubs, or extensions declare.
Evidence: Source 1
Editorially reviewed
PHP quality and security analysis in the SonarQube ecosystem
ProBrings PHP quality and security rules into SonarQube.
ConIt ties analysis to the SonarQube ecosystem.
Evidence: Source 1
Editorially reviewed
Library that find out the minimum version and the extensions required for a piece of code to run
ProFinds the minimum PHP version and extensions code requires.
ConRuntime and environment behavior remain outside its scope.
Evidence: Source 1
Editorially reviewed
This tool check syntax of PHP files faster than serial check with fancier output.
Editorially reviewed
PHP applications that want SQL errors and database access-layer type problems caught during PHPStan analysis.
ProAdds SQL validation and database result type inference to an existing PHPStan workflow.
ConDatabase-specific inference adds configuration and does not replace runtime integration tests.
Evidence: Source 1
Editorially reviewed
A Control Flow Graph implementation in PHP
ProBuilds control-flow graphs for custom PHP analysis.
ConConsumers must build the actual analysis on top.
Evidence: Source 1
Editorially reviewed
Static Analysis Results Baseliner
ProCreates manageable baselines for existing analysis debt.
ConA baseline records debt instead of fixing it.
Evidence: Source 1
Editorially reviewed
Performant static analyzer for PHP, which is extremely easy to use. It helps you catch common mistakes in your PHP code.
ProOffers a fast, low-setup check for common PHP mistakes.
ConIts rule set and integrations remain relatively small.
Evidence: Source 1
Editorially reviewed
Multi-language architecture, dependency, complexity, and code-structure metrics.
ProMaps architecture and metrics across several languages.
ConMetrics highlight risk; they do not prove defects.
Evidence: Source 1
Editorially reviewed
Reflection library to do Static Analysis for PHP Projects
ProResolves code and DocBlock types without executing source.
ConIt is a library rather than a standalone checker.
Evidence: Source 1
Editorially reviewed
PHP static analysis for architecture & maintainability — 60+ metrics, complexity analysis, dependency graphs, git churn hotspots, and AI-ready MCP server. Alternative to PHPMetrics.
ProCombines metrics, dependency graphs, and Git churn.
ConIts broad reports require interpretation and prioritization.
Evidence: Source 1
Editorially reviewed
A tool to verify that your files are in harmony with your .editorconfig
ProVerifies EditorConfig rules across a repository.
ConIt enforces basic formatting rules, not PHP semantics.
Evidence: Source 1
Editorially reviewed
🏥 PHPDoctor: Check files, full directories or strings for missing or bad PHPDoc types.
ProFinds missing or inconsistent PHPDoc types.
ConIt covers PHPDoc types, not general correctness.
Evidence: Source 1
Editorially reviewed
Fast & simple tool to find class duplicates in your projects.
ProFinds duplicate class names with a narrow, fast check.
ConIt checks duplicate names, not wider code quality.
Evidence: Source 1
Editorially reviewed
Show unused composer dependencies by scanning your code
ProQuickly flags Composer packages that code may not use.
ConDynamic package use may require exclusions.
Evidence: Source 1
Editorially reviewed
PHP Magic Number Detector
ProTargets unexplained numeric literals with one focused rule set.
ConTeams often need project-specific exclusions.
Evidence: Source 1
Editorially reviewed
Tighten linter for Laravel conventions.
ProChecks Laravel code against Tighten's conventions.
ConIts rules target Laravel projects.
Evidence: Source 1
Editorially reviewed
PHP language analyses in Rascal
ProSupports custom PHP language research in Rascal.
ConIt requires Rascal and targets specialist use cases.
Evidence: Source 1
Editorially reviewed
Static type checker for PHP relying on the php-ast PECL extension. Mirrored from Codeberg.org
ProProvides focused type checks through PHP's native AST.
ConIt depends on php-ast and has a small ecosystem.
Evidence: Source 1
Editorially reviewed
Discover files in need of refactoring.
ProCombines churn and complexity to rank refactoring targets.
ConIts ranking identifies risk, not the required fix.
Evidence: Source 1
Editorially reviewed
Pretty fast linter (code static analysis utility) for PHP
ProRuns PHP lint checks quickly from a standalone binary.
ConIts rule ecosystem is smaller than PHP-native leaders.
Evidence: Source 1
Editorially reviewed
Analyze PHP code with one command
ProRuns a broad PHP quality toolchain with one command.
ConBundled tools still need individual configuration.
Evidence: Source 1
Editorially reviewed
Detect flaws in your architecture, before they drag you down into the depths of dependency hell ...
ProVisualizes dependencies that weaken an architecture.
ConIt focuses on dependency structure, not runtime behavior.
Evidence: Source 1
Editorially reviewed
Detecting source-level API compatibility changes before publishing a PHP package release.
ProSuggests version changes from source-level API differences.
ConDynamic behavior and documentation changes may escape detection.
Evidence: Source 1
Editorially reviewed
A static analysis tool for security
ProTracks tainted data to find PHP security flaws.
ConSecurity findings need framework-aware tuning and review.
Evidence: Source 1
Editorially reviewed
A combined runtime/static code-analysis tool, that can trace parameter types
ProCombines runtime traces with static type information.
ConRuntime traces only cover executed paths.
Evidence: Source 1
Editorially reviewed
Uses complexity metrics to determine which functions need documentation.
ProUses complexity to focus documentation effort.
ConComplexity is only a proxy for documentation value.
Evidence: Source 1
Editorially reviewed
This tool allows you to monitor the dependencies and instability of your classes
ProTracks class dependencies and instability.
ConIt covers one dimension of maintainability.
Evidence: Source 1
Editorially reviewed
Adjacent test-quality gating for critical methods and newly changed PHP code.
ProEnforces coverage on critical methods or newly changed code.
ConIt needs coverage files and CI configuration.
Evidence: Source 1
Editorially reviewed
Try a broader search or reset one of the filters.
Optional cloud platforms
8 web-based services are listed separately from installable tools and packages. They are ordered alphabetically.
Checkmarx scans PHP source code for security vulnerabilities and helps teams review and remediate findings.
ProProvides deep PHP security scanning and remediation workflows.
ConCommercial hosting, setup, and licensing add overhead.
Evidence: Source 1
Editorially reviewed
Continuous code quality and security checks across repositories
ProAdds pull-request quality and security gates with little setup.
ConHosted rules and quality gates need project tuning.
Evidence: Source 1
Editorially reviewed
Continuous PHP static analysis, SAST, and coverage reporting
ProCombines PHP analysis, coverage, and maintainability reporting.
ConCloud integration and vendor policy may not fit every team.
Evidence: Source 1
Editorially reviewed
the automated way to upgrade Laravel applications. Upgrade Laravel applications all the way from Laravel 4.2 to the latest version of Laravel
ProAutomates much of a Laravel version upgrade.
ConTeams must test and review the generated upgrade.
Evidence: Source 1
Editorially reviewed
PhpStorm-grade PHP inspections and quality gates in CI
ProRuns PhpStorm-grade inspections as CI quality gates.
ConLicensing and container setup add operational cost.
Evidence: Source 1
Editorially reviewed
Security-focused PHP static application security testing
ProAdds security-focused PHP SAST to a hosted platform.
ConSAST covers only part of application security.
Evidence: Source 1
Editorially reviewed
Hosted PHP quality gates, maintainability checks, and security analysis
ProProvides hosted PHP quality gates and security analysis.
ConService integration and rule tuning take time.
Evidence: Source 1
Editorially reviewed
Continuous PHP and Symfony quality, security, performance, and upgrade reports.
ProCombines PHP quality, security, performance, and upgrade reports with deeper Symfony understanding.
ConIt is a paid hosted service and its deepest analysis is Symfony-oriented.
Evidence: Source 1
Editorially reviewed
How this catalog stays current
The published site is regenerated from the same committed YAML records that produce the repository README.
Scheduled automation checks public GitHub, Packagist, release, and website metadata for catalog entries.
Tests validate curated picks and require manually maintained pros, cons, and evidence sources for every current entry.
A dependency-free Python generator turns committed catalog data into this static, searchable site.
See the source repository and catalog records to inspect the data or propose an improvement.
Governance: editorial policy, MIT code license, and CC BY 4.0 data license. Download the catalog as JSON or CSV.
Project history
Retired, superseded, or historically relevant projects remain preserved without being recommended as current choices.
Historical reference for the service now continued as Qlty.
Editorially reviewed
Allows old code to use new standards
Legacy repository for the Exakat PHP static-analysis engine, superseded by exakat-ce.
A QA static analysis code, with a different approach
provides a way to replace relative references of functions in function calls with absolute references
Historical reference: HHVM included static code analysis through version 3.3.8; newer versions do not.
Editorially reviewed
A pair programming partner for writing better PHP. Pahout means PHP mahout :elephant:
Tools for code analysis, visualizations, or style-preserving source transformation.
Tool to detect assumptions
[Git hook] Tool to add all PHP internal functions and constants to its namespace by adding backslash to them.
PHP Formatter is a PHP developer friendly set of tools
Library for Analyzing and Modifying PHP Source Code
Smart/Static Analyzer(sis) for PHP :bowtie::neckbeard:
Analyses and reports testability issues of a php codebase
Detect potentially malicious PHP files
This tool check syntax of PHP files faster than serial check with fancier output.
Editorially reviewed
A command line refactoring tool for PHP
PHP 7 Migration Assistant Report (MAR)
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards.
Editorially reviewed
Really, it's "php extensions usage analyzer". It scans codebase and analyzes which non-built-in php extensions used
Analyzer of PHP code to search issues with deprecated functionality in newer interpreter versions.
Copy/Paste Detector (CPD) for PHP code.
Static code analysis to find violations in a dependency graph
Add scalar type hints and return types to existing PHP projects using PHPDoc annotations
A tool for quickly measuring the size of a PHP project.
Parse: A Static Security Scanner
Tool helping us to analyze software projects
Historical PHP security analyzer acquired by SonarSource in 2020 and integrated into SonarQube.
Editorially reviewed
The retired Scrutinizer service provided continuous inspection for automated code-quality and bug detection.
Retired continuous-integration service for automated code review and static analysis.
PHP 7 to PHP 5.6 Transpiler