qltysh/qlty

πŸ’Ž Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability

3,148

stars

2,398

commits

Rust

primary language

Sep 8, 2026

updated

qlty.sh/
code-quality
formatter
linter
quality
static-analysis
Browse cluster: Static Analysis & Code Quality Tools β†’

README

Qlty

Universal linting, auto-formatting, maintainability, and security scanning

Qlty CLI is a multi-language code quality tool for linting, auto-formatting, maintainability, and security with support for 70+ static analysis tools for 40+ languages and technologies.

With Qlty CLI, polyglot team can take advantage of the best code quality static analysis with fast, consistent, and unified results through a single tool. Configuration is done through a simple .qlty/qlty.toml file in your repository, which can be auto-generated based on the languages you use.

The Qlty CLI is completely free for all use, including for commercial projects, with no limits on contributors.

Maintainability Code Coverage Unit Tests Latest release docs.qlty.sh GitHub stars


πŸ“– Table of Contents


✨ Key Features

What We Do

FeatureAdvantage
πŸ›LintingComprehensive language support in one tool
πŸ–ŒοΈAuto-formattingConsistent code style everywhere
πŸ’©MaintainabilityCode smells like copy-paste detection and complexity
🚨Security scanningSAST, SCA, secret detection, IaC analysis, and more
🚦Code coverageTotal coverage and diff coverage
πŸ“ŠQuality metricsComplexity, duplication, LOC, etc.

How We Do It

FeatureAdvantage
🌲Git-awareFocus on newly introduced quality issues
⚑Auto-initializationGet up and running in two minutes
βœ…AutofixesIncluding tool-generated and AI-generated fixes
βš™οΈConfig as codeVersion controlled with maximum flexibility
🏎️Caching and concurrencyThe absolute fastest way to run static analysis
πŸͺGit hooksIntegrate with pre-commit and pre-push hooks
πŸ€–Pull request reviewsAutomated feedback in comments and statuses
🌐Runs anywhereMac, Linux, and Windows with no dependency on Docker
πŸ¦€Written in RustFast execution and easy to contribute
🎁100% freeIncluding for commercial projects, with no contributor limits
βš–οΈFair SourcePublic on GitHub with delayed open source publication (DOSP). PRs accepted!

πŸ’‘ Learn more in the Documentation.

Qlty Software: Code quality and coverage done right

Qlty CLI is part of Qlty Software's comprehensive platform for code quality. Bring code quality into every step of your software development workflow with:


πŸš€ Quick Start

Installation

The fastest way to install Qlty CLI is using our installer scripts which install our native binaries:

# Install on MacOS or Linux
curl https://qlty.sh | bash


# Install on Windows
powershell -c "iwr https://qlty.sh | iex"

We also package the CLI as a Docker image on GitHub Container Registry (GHCR).

[!NOTE] The Qlty CLI does not use Docker to run linters. By running linters natively, we achieve maximum performance. The Docker image is provided for situations where running the CLI as a containers is preferred over running it as a native binary.

Setting up Qlty in a new repository

Setup Qlty within a Git repository:

cd my_repo/
qlty init

Usage

Example CommandDescription
qlty initSetup Qlty within a Git repository
qlty check --sample=5View a sample of lint issues
qlty fmt --allAuto-format the codebase
qlty smells --allScan for code smells like duplication
qlty metrics --max-depth=2 --sort complexity --allReview a summary of code quality metrics

Configuration

Qlty CLI is configured using a .qlty/qlty.toml file in your Git repository. You can generate a default configuration with qlty init and then customize it.

Read our documentation about configuration for more information.


🧹 Available Linters

Over 20,000 code quality rules are available via the Qlty CLI through its 60+ linter plugins.

To enable new plugins by adding them to your .qlty/qlty.toml file run:

qlty plugins enable <NAME>
TechnologyAvailable code quality tools
All filesast-grep, gitleaks, ripgrep, semgrep, trivy, trufflehog, vale
Apexpmd
C#complexity, duplication
C/C++osv-scanner, trivy
CloudFormationcheckov
CoffeeScriptcoffeelint
CSSbiome, prettier, stylelint
Dartosv-scanner, trivy
Dockercheckov, dockerfmt, hadolint, radarlint, trivy
Dotenvdotenv-linter
Elixircomplexity, duplication, osv-scanner, trivy
Erlangosv-scanner, trivy
GitHub Actionsactionlint
Gocomplexity, duplication, gofmt, golangci-lint, osv-scanner, radarlint
GraphQLprettier
HTMLprettier
Javacheckstyle, complexity, duplication, google-java-format, osv-scanner, pmd, radarlint, trivy
JavaScriptbiome, complexity, duplication, eslint, knip, osv-scanner, oxc, prettier, radarlint, trivy
JSONbiome, prettier
Kotlincomplexity, duplication, osv-scanner, radarlint, trivy
Kuberneteskube-linter
Markdownmarkdownlint, prettier
OpenAPIredocly, spectral
PHPcomplexity, duplication, osv-scanner, php-codesniffer, php-cs-fixer, phpstan, radarlint, trivy
Prismaprisma
Pythonbandit, black, complexity, duplication, flake8, mypy, osv-scanner, radarlint, ruff, trivy
Rosv-scanner, trivy
Rubybrakeman, complexity, duplication, osv-scanner, radarlint, reek, rubocop, ruby-stree, standardrb, trivy
Rustclippy, complexity, duplication, osv-scanner, rustfmt, trivy
SASSprettier, stylelint
Scalaradarlint
Shellshellcheck, shfmt
SQLsqlfluff
Swiftswiftlint
Terraformcheckov, osv-scanner, radarlint, tflint, trivy
TypeScriptbiome, complexity, duplication, eslint, knip, oxc, prettier
VB.NETcomplexity, duplication
YAMLprettier, trivy, yamllint

The full list of plugins is available on GitHub.


πŸ“Š Code Quality Metrics

The Qlty CLI calculates a variety of code quality metrics which are available through the qlty metrics subcommand and as trends on Qlty Cloud.

Duplication
Duplication DensityDuplicated Lines divided by Code Lines
Duplicated LinesThe number of lines that are duplicated
Duplicated BlocksThe number of contiguous spans of duplicated lines
Complexity
Complexity DensityComplexity divided by Code Lines
Total ComplexityThe count of Cognitive Complexity
Cyclomatic ComplexityThe count of Cyclomatic (McCabe's) Complexity
Maintainability
SmellsThe number of duplication and structure issues
Technical DebtThe estimated amount of time needed to resolve the code smells
Technical Debt RatioTechnical Debt divided by estimated implementation time
Maintainability RatingTechnical Debt Ratio expressed as a letter rating
LCOMLack of cohehsion in methods (LCOM4)
Security
Security Issues by LevelCount of security issues by high, medium, and low level
Security IssuesCount of security issues
Security RatingA letter rating based on security issues and their severity level
Coverage
Covered LinesCount of lines covered by automated tests
Uncovered LinesCount of lines that could be covered but are not
Line CoverageCovered Lines divided by Coverd Lines plus Uncovered Lines
Diff CoverageThe Line Coverage of the new and changes lines of a Git diff
Coverage RatingLine Coverage expressed as a letter rating
Size
ClassesCount of classes
FieldsCount of unique fields
FunctionsCount of functions or methods
Code FilesCount of programming language files
LinesCount of all lines including blanks and comments
Lines of CodeCount of lines that are not blank or comments
Comment LinesCount of comment lines
Comments DensityComment Lines divided by Lines
Issues
Issues CountCount of static analysis issues
Issues Count by LevelCount of static analysis issues by high, medium, and low level

Quality metrics are available for C, C++, C#, Elixir, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Swift, TypeScript, and VB.NET.


πŸ–₯️ System Requirements

Qlty CLI is available for MacOS, Linux, and Windows on x86 and ARM platforms.

Additional requirements for PHP linters

Certain PHP linters require a working installation of PHP available in your $PATH. To install PHP, use Homebrew or an alternative method.


πŸ›Ÿ Help or Feedback


πŸ§‘β€πŸ’» Contributing

Adding plugins

Creating a plugin can be as easy as writing a small plugin definition TOML file. If the tool has a custom output format (instead of a standard like SARIF), then writing a simple output parser in Rust is also needed.

We also happily accept requests for new plugins via GitHub issues.

Developing the CLI

Developing on Qlty CLI requires a working Rust toolchain and adheres to the standard Rust development process:

git clone https://github.com/qltysh/qlty.git
cd qlty
cargo build
cargo test

More information

More information about how to contribute can be found in CONTRIBUTING.md.

Reports of security vulnerabilities should be handled with the process outlined in SECURITY.md.


βš–οΈ License

Qlty CLI is published under a Fair Source license. As Fair Source, the Qlty CLI is free to use (including in commercial contexts), modify, and distribute in accordance with its license.

This code is made available under the Business Source License 1.1 (BSL) and transitions into Open Source via a Delayed Open Source Publication (DOSP). More details are available in LICENSE.md.

Acknowledgements

We would like to thank all of the developers of code quality tooling like linters and meta-linters as well as everyone who has contributed to the field of open source static analysis. Qlty CLI stands on the shoulders of decades of this excellent work.

Licenses for code incorporated into Qlty CLI can be found in the docs/licenses folder.


Contributors

(top 30 of 81)

brynary

373 commits

pbrisbin

253 commits

wfleming

211 commits

qltysh/qlty

πŸ’Ž Code quality CLI for universal linting, auto-formatting, security scanning, and maintainability

3,148

stars

2,398

commits

Rust

primary language

Sep 8, 2026

updated

qlty.sh/
code-quality
formatter
linter
quality
static-analysis
Browse cluster: Static Analysis & Code Quality Tools β†’

README

Qlty

Universal linting, auto-formatting, maintainability, and security scanning

Qlty CLI is a multi-language code quality tool for linting, auto-formatting, maintainability, and security with support for 70+ static analysis tools for 40+ languages and technologies.

With Qlty CLI, polyglot team can take advantage of the best code quality static analysis with fast, consistent, and unified results through a single tool. Configuration is done through a simple .qlty/qlty.toml file in your repository, which can be auto-generated based on the languages you use.

The Qlty CLI is completely free for all use, including for commercial projects, with no limits on contributors.

Maintainability Code Coverage Unit Tests Latest release docs.qlty.sh GitHub stars


πŸ“– Table of Contents


✨ Key Features

What We Do

FeatureAdvantage
πŸ›LintingComprehensive language support in one tool
πŸ–ŒοΈAuto-formattingConsistent code style everywhere
πŸ’©MaintainabilityCode smells like copy-paste detection and complexity
🚨Security scanningSAST, SCA, secret detection, IaC analysis, and more
🚦Code coverageTotal coverage and diff coverage
πŸ“ŠQuality metricsComplexity, duplication, LOC, etc.

How We Do It

FeatureAdvantage
🌲Git-awareFocus on newly introduced quality issues
⚑Auto-initializationGet up and running in two minutes
βœ…AutofixesIncluding tool-generated and AI-generated fixes
βš™οΈConfig as codeVersion controlled with maximum flexibility
🏎️Caching and concurrencyThe absolute fastest way to run static analysis
πŸͺGit hooksIntegrate with pre-commit and pre-push hooks
πŸ€–Pull request reviewsAutomated feedback in comments and statuses
🌐Runs anywhereMac, Linux, and Windows with no dependency on Docker
πŸ¦€Written in RustFast execution and easy to contribute
🎁100% freeIncluding for commercial projects, with no contributor limits
βš–οΈFair SourcePublic on GitHub with delayed open source publication (DOSP). PRs accepted!

πŸ’‘ Learn more in the Documentation.

Qlty Software: Code quality and coverage done right

Qlty CLI is part of Qlty Software's comprehensive platform for code quality. Bring code quality into every step of your software development workflow with:


πŸš€ Quick Start

Installation

The fastest way to install Qlty CLI is using our installer scripts which install our native binaries:

# Install on MacOS or Linux
curl https://qlty.sh | bash


# Install on Windows
powershell -c "iwr https://qlty.sh | iex"

We also package the CLI as a Docker image on GitHub Container Registry (GHCR).

[!NOTE] The Qlty CLI does not use Docker to run linters. By running linters natively, we achieve maximum performance. The Docker image is provided for situations where running the CLI as a containers is preferred over running it as a native binary.

Setting up Qlty in a new repository

Setup Qlty within a Git repository:

cd my_repo/
qlty init

Usage

Example CommandDescription
qlty initSetup Qlty within a Git repository
qlty check --sample=5View a sample of lint issues
qlty fmt --allAuto-format the codebase
qlty smells --allScan for code smells like duplication
qlty metrics --max-depth=2 --sort complexity --allReview a summary of code quality metrics

Configuration

Qlty CLI is configured using a .qlty/qlty.toml file in your Git repository. You can generate a default configuration with qlty init and then customize it.

Read our documentation about configuration for more information.


🧹 Available Linters

Over 20,000 code quality rules are available via the Qlty CLI through its 60+ linter plugins.

To enable new plugins by adding them to your .qlty/qlty.toml file run:

qlty plugins enable <NAME>
TechnologyAvailable code quality tools
All filesast-grep, gitleaks, ripgrep, semgrep, trivy, trufflehog, vale
Apexpmd
C#complexity, duplication
C/C++osv-scanner, trivy
CloudFormationcheckov
CoffeeScriptcoffeelint
CSSbiome, prettier, stylelint
Dartosv-scanner, trivy
Dockercheckov, dockerfmt, hadolint, radarlint, trivy
Dotenvdotenv-linter
Elixircomplexity, duplication, osv-scanner, trivy
Erlangosv-scanner, trivy
GitHub Actionsactionlint
Gocomplexity, duplication, gofmt, golangci-lint, osv-scanner, radarlint
GraphQLprettier
HTMLprettier
Javacheckstyle, complexity, duplication, google-java-format, osv-scanner, pmd, radarlint, trivy
JavaScriptbiome, complexity, duplication, eslint, knip, osv-scanner, oxc, prettier, radarlint, trivy
JSONbiome, prettier
Kotlincomplexity, duplication, osv-scanner, radarlint, trivy
Kuberneteskube-linter
Markdownmarkdownlint, prettier
OpenAPIredocly, spectral
PHPcomplexity, duplication, osv-scanner, php-codesniffer, php-cs-fixer, phpstan, radarlint, trivy
Prismaprisma
Pythonbandit, black, complexity, duplication, flake8, mypy, osv-scanner, radarlint, ruff, trivy
Rosv-scanner, trivy
Rubybrakeman, complexity, duplication, osv-scanner, radarlint, reek, rubocop, ruby-stree, standardrb, trivy
Rustclippy, complexity, duplication, osv-scanner, rustfmt, trivy
SASSprettier, stylelint
Scalaradarlint
Shellshellcheck, shfmt
SQLsqlfluff
Swiftswiftlint
Terraformcheckov, osv-scanner, radarlint, tflint, trivy
TypeScriptbiome, complexity, duplication, eslint, knip, oxc, prettier
VB.NETcomplexity, duplication
YAMLprettier, trivy, yamllint

The full list of plugins is available on GitHub.


πŸ“Š Code Quality Metrics

The Qlty CLI calculates a variety of code quality metrics which are available through the qlty metrics subcommand and as trends on Qlty Cloud.

Duplication
Duplication DensityDuplicated Lines divided by Code Lines
Duplicated LinesThe number of lines that are duplicated
Duplicated BlocksThe number of contiguous spans of duplicated lines
Complexity
Complexity DensityComplexity divided by Code Lines
Total ComplexityThe count of Cognitive Complexity
Cyclomatic ComplexityThe count of Cyclomatic (McCabe's) Complexity
Maintainability
SmellsThe number of duplication and structure issues
Technical DebtThe estimated amount of time needed to resolve the code smells
Technical Debt RatioTechnical Debt divided by estimated implementation time
Maintainability RatingTechnical Debt Ratio expressed as a letter rating
LCOMLack of cohehsion in methods (LCOM4)
Security
Security Issues by LevelCount of security issues by high, medium, and low level
Security IssuesCount of security issues
Security RatingA letter rating based on security issues and their severity level
Coverage
Covered LinesCount of lines covered by automated tests
Uncovered LinesCount of lines that could be covered but are not
Line CoverageCovered Lines divided by Coverd Lines plus Uncovered Lines
Diff CoverageThe Line Coverage of the new and changes lines of a Git diff
Coverage RatingLine Coverage expressed as a letter rating
Size
ClassesCount of classes
FieldsCount of unique fields
FunctionsCount of functions or methods
Code FilesCount of programming language files
LinesCount of all lines including blanks and comments
Lines of CodeCount of lines that are not blank or comments
Comment LinesCount of comment lines
Comments DensityComment Lines divided by Lines
Issues
Issues CountCount of static analysis issues
Issues Count by LevelCount of static analysis issues by high, medium, and low level

Quality metrics are available for C, C++, C#, Elixir, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Swift, TypeScript, and VB.NET.


πŸ–₯️ System Requirements

Qlty CLI is available for MacOS, Linux, and Windows on x86 and ARM platforms.

Additional requirements for PHP linters

Certain PHP linters require a working installation of PHP available in your $PATH. To install PHP, use Homebrew or an alternative method.


πŸ›Ÿ Help or Feedback


πŸ§‘β€πŸ’» Contributing

Adding plugins

Creating a plugin can be as easy as writing a small plugin definition TOML file. If the tool has a custom output format (instead of a standard like SARIF), then writing a simple output parser in Rust is also needed.

We also happily accept requests for new plugins via GitHub issues.

Developing the CLI

Developing on Qlty CLI requires a working Rust toolchain and adheres to the standard Rust development process:

git clone https://github.com/qltysh/qlty.git
cd qlty
cargo build
cargo test

More information

More information about how to contribute can be found in CONTRIBUTING.md.

Reports of security vulnerabilities should be handled with the process outlined in SECURITY.md.


βš–οΈ License

Qlty CLI is published under a Fair Source license. As Fair Source, the Qlty CLI is free to use (including in commercial contexts), modify, and distribute in accordance with its license.

This code is made available under the Business Source License 1.1 (BSL) and transitions into Open Source via a Delayed Open Source Publication (DOSP). More details are available in LICENSE.md.

Acknowledgements

We would like to thank all of the developers of code quality tooling like linters and meta-linters as well as everyone who has contributed to the field of open source static analysis. Qlty CLI stands on the shoulders of decades of this excellent work.

Licenses for code incorporated into Qlty CLI can be found in the docs/licenses folder.


Contributors

(top 30 of 81)

brynary

373 commits

pbrisbin

253 commits

wfleming

211 commits

Languages

Rust

91.5%

TypeScript

1.7%