# vimeo/psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

Repository: https://github.com/vimeo/psalm
Canonical: https://ross.abutalabs.com/products/psalm
Homepage: https://psalm.dev
Language: PHP
License: MIT
License Family: permissive
Topics: static-analysis, php, type-inference, security-analysis, taint-analysis, hacktoberfest
Last push: 2026-07-13T07:42:30+00:00

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 92, release rhythm 75, longevity 100
- inputs: {"age_days": 3572, "days_push": 51, "days_rel": 167, "gap_med": 2.0, "n_releases_24m": 49}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5884, forks 707 (observed 2026-08-28T04:09:31.927129+00:00)

## What it is
Psalm is an open-source static analysis tool for PHP that finds type-related bugs and security vulnerabilities through type inference and taint analysis. It includes a language server for IDE integration, automatic fixes via Psalter, and a plugin system.

## Use cases
- find type errors in php code
- detect security vulnerabilities in php applications
- taint analysis for php
- automatically fix php code issues
- add type checking to a legacy php codebase
- run static analysis in ci for php
- php language server for ide

## When to choose
- you maintain a PHP codebase and want to catch type-related runtime errors before they happen
- you need taint analysis to find injection-style security vulnerabilities in PHP
- you want automated fixes and refactoring for missing typehints and common issues
- you want gradual typing with configurable strictness levels for large or legacy codebases

## When to avoid
- your project is not written in PHP
- you need runtime profiling or performance analysis rather than static checks
- you want a zero-configuration linter without type annotations or error levels

## Facets
- artifact type: cli-tool
- maturity: active
- function: linter, type-system, security, code-review, developer-tools
- domain: developer-tools, programming-languages, security, testing
- platform: php, cli, cross-platform
- tags: static-analysis, php, taint-analysis, type-inference, psalter, language-server, security-scanning, docker

## Member repositories
- vimeo/psalm (main) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:31.927129+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:51:33.870318+00:00, confidence not recorded.
  - readme: https://github.com/vimeo/psalm (fetched 2026-08-28T04:09:31.927129+00:00, sha 2854503969aa)
  - homepage: https://psalm.dev (fetched 2026-08-29T08:47:02.984506+00:00, sha d68de0b1b9c5)
  - site_page: https://psalm.dev/docs/installation (fetched 2026-08-29T08:47:02.994006+00:00, sha f6451a4e486d)
  - site_page: https://psalm.dev/docs (fetched 2026-08-29T08:47:02.996353+00:00, sha a366c24eb225)
  - site_page: https://psalm.dev/docs/manipulating_code/fixing (fetched 2026-08-29T08:47:02.998415+00:00, sha adf8fd94a8f8)
- Data as of 2026-08-30T08:39:29.467469+00:00.