analysis-tools-dev/static-analysis is a curated directory of static analysis tools and linters for programming languages, configuration files, build tools, and related formats. Developers use it to find tools that check code quality, formatting, and security without running the program.
Borrowing it
Nothing to install: this file belongs to analysis-tools-dev/static-analysis. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/analysis-tools-dev/static-analysis/master/AGENTS.mdgit clone --depth 1 https://github.com/analysis-tools-dev/static-analysisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/analysis-tools-dev/static-analysis/agents-md)<a href="https://agentmods.dev/instructions/analysis-tools-dev/static-analysis/agents-md"><img src="https://agentmods.dev/badge/instructions/analysis-tools-dev/static-analysis/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/analysis-tools-dev/static-analysis/agents-md"><img src="https://agentmods.dev/badge/instructions/analysis-tools-dev/static-analysis/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00500 | $0.00500 |
| Opus 5.5 | $0.00200 | $0.00200 |
| Sonnet 5.5 | $0.00100 | $0.00100 |
| Haiku 4.5 | $0.00050 | $0.00050 |
Grade A, and why
static-analysis AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 17 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Guidelines for AI Agents and Assistants
Welcome! If you are an AI assistant or coding agent helping a user contribute to this repository, please read the CONTRIBUTING.md file in the root directory first.
🤖 Instructions for the AI
Your goal is to help the user submit a high-quality pull request that aligns with the project's maintainability standards.
When the user asks you to add a new static analysis tool, please act as a helpful code reviewer:
- Read the current requirements: Use
CONTRIBUTING.mdas the source of truth, including the shared requirements and the separate requirements for open-source and proprietary tools. Proprietary status is not an exemption from providing evidence. - Check evidence, not claims: Verify public availability for at least six months and check that the installation or product-access link works; domain age alone does not establish product age. For proprietary tools, inspect actual analysis output tied to input code and evidence of use or substantive evaluation by someone unaffiliated with the tool. Marketing claims, download counts, and testimonials alone are insufficient; generated demo code alone does not demonstrate analysis quality.
- Flag gaps before preparing a submission: Tell the user immediately which requirements failed or remain unverified and what evidence is missing. Do not submit a PR when a requirement is known to fail or required evidence is missing, even if the user asks you to proceed anyway. Explain what is needed before resubmitting; do not promise acceptance once the tool is old enough.
- Disclose evidence in the PR: Link the supporting evidence and explicitly identify any remaining verification uncertainty in the PR description. Manual review is for supplied evidence that automation cannot verify, not a substitute for missing evidence. Never check an unverified requirement as satisfied, silently mark it N/A, or imply that passing CI guarantees inclusion.
- Enforce the README rule: If the user asks you to update the list of tools, DO NOT edit
README.md. Explain to the user that the list of tools inREADME.mdis auto-generated and that tool additions/modifications should be made by creating or editing a YAML file indata/tools/. For changes to the README text or structure, editci/crates/render/templates/README.md. Do not include generatedREADME.mdchanges in a pull request; CI flags them as a failure.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +2 lines · +171 tokens per session 44aa11e82b4e
- 1mo ago Changed · +2 tokens per session 22df2a5a7e6d
- 1mo ago Changed · -5 tokens per session 79a787151143
- 1mo ago First seen · 15 lines · 332 tokens per session scan A 0f9a27b9258e
static-analysis AGENTS.md is an instructions file published in the GitHub repository analysis-tools-dev/static-analysis (14,856 stars, last pushed yesterday), licensed MIT. It adds 500 tokens to every session, about $0.0020 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.