Standards
The linter each stack trusts, plus engines for rules you write yourself.
Rule 19 says standards are enforced by machines. Every stack has a linter and formatter it treats as the default, and you'll find them here. The custom-rule engines deserve a closer look. When a reviewer catches the same mistake twice, an agent can write a rule for it, and the build catches it from then on.
Show tools for
71 tools
Rules you write yourself
Ours
Praxis
No pull request merges while a file breaks a convention your team wrote down.
Start here
ast-grep
Searches and rewrites code by syntax tree patterns, and lints with the same rules.
A review comment becomes a YAML rule that fails the build the next time an agent repeats the mistake.
-
CodeQL
Treats code as a queryable database so teams can write semantic security and quality queries.
Dataflow queries catch cross-file problems that pattern tools miss, and an agent can draft a new query from a bug report.
Free for open source and research. Private repos need GitHub Code Security.
-
Comby
Structural search and replace with lightweight templates for most languages.
The template syntax is short enough for an agent to write a bulk rewrite in one line.
-
Dylint
Runs custom Clippy-style lints loaded from dynamic libraries.
A Rust team gets project-specific lints without forking Clippy, so a repeated agent habit can become a build failure.
-
GritQL
A query language for searching and rewriting code, used for custom lint rules and migrations.
Rules are written as code snippets, which makes them easy for an agent to author and for a human to review.
Honeycomb acquired Grit in April 2025 and sunset the hosted product. GritQL now lives under Biome.
-
Open Policy Agent (Conftest)
Tests config files against policies written in Rego.
A policy the machine checks covers infrastructure changes an agent proposes, with no one reading every line.
-
Opengrep
A community fork of Semgrep's engine that keeps taint analysis and other features open.
Semgrep-style rules keep working with no dependence on one vendor's license terms.
Forked from Semgrep after its December 2024 license change, and run by a group of AppSec vendors.
-
OpenRewrite
Automated refactoring and lint-style recipes for JVM code, runnable from Maven and Gradle.
Recipes apply framework upgrades and fixes the same way every time, which saves agent tokens and cuts risk.
Moderne is the paid platform built on it.
-
Rector
Automated refactoring and upgrades for PHP code, with custom rules written in PHP.
Version upgrades and house rules roll across a PHP codebase with predictable results.
-
Roslyn custom analyzers
Write your own analyzers and code fixes against the C# compiler's syntax and semantic model.
An analyzer with a code fix lets an agent encode a convention and repair every existing violation.
-
ruleguard
Define Go lint rules in a small DSL of code patterns.
It runs inside golangci-lint through gocritic, so project rules ride the same CI step.
Activity has slowed. The last update was September 2025.
-
Semgrep
Pattern matching for 30+ languages that finds bugs and enforces your own YAML rules.
Rules look like the code they match, so an agent can write one straight from a review comment.
A December 2024 license change on rules and some features led to the Opengrep fork.
Linters and type checkers
Start here
actionlint
Lints GitHub Actions workflow files, including expression types and embedded shell.
Workflow YAML can't run locally, so an agent edits it blind. This catches the mistakes before the push.
Start here
Biome
One fast Rust tool that formats and lints JavaScript, TypeScript, CSS and JSON.
One binary and one config file leave an agent a single command to run and little to misconfigure.
Now also hosts GritQL and supports GritQL plugins.
Start here
Clippy
The official Rust linter, with hundreds of lints for correctness, speed and idiom.
Agent-written Rust compiles often enough. Clippy flags the clones, unwraps and odd idioms that slip past the compiler.
Start here
cppcheck
A static analyzer for C and C++ that finds bugs without needing a build.
Runs on code that doesn't build yet, so it can check an agent's work in progress.
Start here
Dart analyzer and dart format
The Dart SDK's built-in analyzer, lint rules and formatter, set in analysis_options.yaml.
Strict-casts and strict-inference flags give hard feedback with nothing extra to install.
Start here
Dialyzer and Dialyxir
Success typing analysis for BEAM languages, with Mix tasks from Dialyxir.
It finds type discrepancies in code that has no annotations, which suits agent-written Elixir.
Elixir is adding a gradual type system to the compiler.
Start here
Error Prone
A Google compiler plugin that turns common Java mistakes into compile errors.
Bugs fail at compile time, and the plugin API lets a team add checks for its own conventions.
Start here
golangci-lint
Runs dozens of Go linters in parallel, including dupl, gocyclo, gocognit, unused and depguard.
One config turns on duplication, complexity, dead-code and import rules for every change.
Start here
hadolint
Lints Dockerfiles against best practices and runs ShellCheck on RUN lines.
Unpinned base images and root users are old tutorial habits that agents copy, and this flags both.
Start here
ktlint
A Kotlin linter and formatter with autocorrect.
Autocorrect keeps agent-written Kotlin on the official style with no manual fixes.
Start here
markdownlint
Checks Markdown files for structure and style issues.
Agent-written docs and instruction files stay consistent. Run it through markdownlint-cli2.
Start here
PHPStan
A PHP static analyzer that finds bugs without running the code.
Higher levels demand precise types, which stops loosely typed PHP from reaching review.
Start here
Roslyn analyzers and .NET code analysis
Built-in compiler analyzers for .NET, configured through .editorconfig and warnings-as-errors.
TreatWarningsAsErrors with AnalysisMode set to All makes the compiler the first reviewer of agent code.
The analyzers now live in the dotnet/roslyn and dotnet/runtime flow. The roslyn-analyzers repo is their historical home.
Start here
Ruff
A fast Python linter and formatter that replaces Flake8, isort and Black.
It runs in milliseconds, so an agent can lint after every edit and fix what it finds before anyone looks.
Start here
Scalafmt
The standard code formatter for Scala.
Layout gets settled by the tool, so agents and humans produce identical diffs.
Start here
ShellCheck
Finds bugs and pitfalls in shell scripts.
Agents write a lot of bash, and quoting mistakes are the classic failure ShellCheck catches.
Start here
SQLFluff
A SQL linter and formatter that supports many dialects and dbt templates.
Agents write SQL fast and unevenly. This fixes layout and flags ambiguous constructs.
Start here
Standard Ruby
A RuboCop configuration with fixed rules and no options to argue about.
With nothing to configure, agents and humans share one style and the config can't drift.
Start here
swift-format
Apple's official Swift formatter and linter, bundled with the toolchain.
It ships with Xcode toolchains, so agents running in CI have nothing extra to install.
Start here
TFLint
Lints Terraform for provider-specific errors and deprecated syntax.
Invalid instance types and bad arguments get caught before an agent's plan reaches a cloud account.
Start here
Vale
A prose linter that checks writing against style rules you define.
Bans house-style tics in docs and release notes, which counters the stock phrasing of model output.
A paid hosted service also exists.
Start here
yamllint
Lints YAML for syntax errors and style problems.
A cheap check on the config files that agents edit most often.
-
Checkstyle
Java style checker, with checks that cap cyclomatic complexity and method nesting.
Maven and Gradle builds fail on oversized methods and style slips, whoever wrote them.
-
Credo
Elixir static analysis with checks for cyclomatic complexity, ABC size, nesting and more.
Strict mode turns its findings into CI failures.
-
detekt
Kotlin static analyzer with complexity and unused-code rules and a baseline file for old code.
Complexity and unused-code limits live in one config, and the baseline holds new code to them.
-
EditorConfig
A shared file for indentation and line endings that editors and agents both read.
One file sets baseline whitespace for every editor and agent that touches the repo.
-
ESLint
The pluggable JavaScript and TypeScript linter, with thousands of rules from plugins.
Most JavaScript projects already run it, so a new rule an agent writes lands where every pull request will hit it.
-
Laravel Pint
An opinionated PHP formatter built on PHP-CS-Fixer for Laravel projects.
Zero-config formatting lets an agent run one command with no rules to choose.
-
mypy
The original static type checker for Python.
Strict mode turns the type hints an agent writes into checks that fail the build when they are wrong.
-
oxlint
A very fast Rust linter for JavaScript and TypeScript with ESLint-compatible rules, plus oxfmt for formatting.
It finishes in milliseconds, so an agent can lint after every edit and skip the wait for CI.
-
PHP-CS-Fixer
Fixes PHP code to match PSR and Symfony style.
Autofixing holds agent output to PSR style and spares the review thread a round of nitpicks.
-
Prettier
An opinionated code formatter for web languages, Markdown, YAML and more.
Formatting drops out of review because every file gets rewritten the same way.
-
Psalm
A PHP static analyzer with taint analysis for security flaws.
Taint tracking finds the injection paths that appear when an agent concatenates user input into a query.
-
Pyrefly
Meta's Rust type checker for Python, successor to Pyre.
It infers types even in unannotated code, which helps when agents write loosely typed Python.
Version 1.0 shipped in May 2026.
-
Pyright
Microsoft's fast Python type checker, also the engine behind Pylance.
Strict inference catches agent mistakes even in lightly annotated code.
-
RBS and Steep
Steep type checks Ruby against RBS signature files that ship with Ruby itself.
RBS is the official signature format, so an agent can generate and check signatures with no third-party DSL.
-
RuboCop
Checks Ruby style and common bugs, and fixes many of them on its own.
Custom cops are plain Ruby, so a team convention an agent keeps breaking can become a cop in an afternoon.
-
rustfmt
The official Rust code formatter.
Formatting leaves the review conversation entirely.
-
shfmt
Formats shell scripts.
Agent-written scripts come out uniform, which keeps diffs small.
-
Sorbet
A fast gradual type checker for Ruby, built by Stripe.
A type error gives an agent a quick, hard signal that a change broke a method contract.
-
SpotBugs
Finds bug patterns in JVM bytecode, successor to FindBugs.
It reads compiled output, so it catches the null and concurrency bugs that hide in plausible-looking agent code.
-
Spotless
A Gradle and Maven plugin that applies formatters across many languages.
A single spotlessCheck task enforces formatting across a JVM monorepo.
-
staticcheck
A Go analyzer that finds bugs, deprecated calls, unused code and needless complexity.
Catches the subtle Go mistakes that compile and pass tests, which is where agent-written code tends to hide them.
-
StyleCop Analyzers
Roslyn analyzers that enforce C# layout and documentation style.
Style rules in the build keep agent-written C# in the house layout.
-
stylelint
Lints CSS and its dialects for errors and convention violations.
Stylesheet mistakes are hard to spot in a diff, and an agent won't see them by reading it.
-
SwiftLint
Swift linter with rules for cyclomatic complexity and for function and type body length.
The standard Swift linter keeps all its limits in one YAML file.
-
ty
Astral's Rust type checker and language server for Python.
It comes from the makers of Ruff and uv and is built for speed, so type checks fit in an agent's edit loop.
Still in beta with 0.0.x versions and possible breaking changes. Pin the version.
-
TypeScript strict mode
The compiler's strict flag turns on the checks that catch null, any and unsafe assignment.
A strict tsc run is the cheapest correctness check in the stack, and it rejects plausible but wrong code.
-
typos
A fast source code spell checker with low false positives.
A misspelled identifier gets copied through the codebase by the next agent that reads it.
-
Zuban
A Rust Python type checker and language server aiming to match mypy behavior.
Teams with configs tuned to mypy semantics get a faster drop-in.
Licensed AGPL-3.0, with a paid commercial license on offer.
Hook runners and linter bundles
Start here
pre-commit
A framework for managing git hooks from a shared YAML file of linters.
Hooks run before every commit, the earliest point to stop an agent's bad change.
-
Husky
Runs scripts on git hooks in npm projects.
It is the usual hook setup in JavaScript repos, and it pairs with lint-staged.
-
Lefthook
A fast Go git hooks manager with parallel runs and no runtime dependency.
One binary and parallel jobs keep commit hooks quick enough that agents run them every time.
-
MegaLinter
Runs linters for 50 languages and many formats in one CI step.
One config and one container give every stack a full lint pass, with fixes pushed back as a PR.
Licensed AGPL-3.0.
-
pre-commit.ci
A hosted service that runs pre-commit on pull requests and pushes autofixes.
Formatting on an agent's PR gets fixed with no CI config to write.
Free for open source. Private repos need a paid plan.
-
reviewdog
Posts linter output as inline pull request review comments.
Lint failures land on the exact lines of an agent's PR, where the agent will read them.
-
Super-Linter
A GitHub Action that bundles many linters into one container.
A repo with mixed languages gets drop-in coverage with no tool installs.
The project moved from GitHub to its own org.
-
Trunk Check
Installs and runs 100+ linters, formatters and security tools with hold-the-line checks on new changes.
Hold-the-line lets an old codebase enforce rules only on the lines an agent touched.
Free for individuals and small teams. Paid beyond that.
Nothing in this section is built for the stacks you picked, and nothing here works with any language. Pick another stack, or .
Missing a tool that belongs here? Suggest it.
Every tool here was checked against its GitHub repository or its own site on 6 October 2026. Stars and dates come from GitHub on that day.