C# Code Analyzer
Paste a public GitHub URL and REPO-SIGHT reads your C# source directly — complexity, async and exception-handling pitfalls, and 15 rules built specifically for C#. Free.
What REPO-SIGHT checks in your C# code
15 rules, tuned for C# — 6 of them security-specific. Every .cs file in the repo is analyzed.
Complexity & structure
Cyclomatic complexity, max nesting depth (csharp-deep-nesting flags files past 6 levels), and csharp-long-method for methods over 100 lines — the same thresholds used in the health score.
Async & swallowed exceptions
csharp-async-void catches async void methods whose exceptions the caller can never await, and csharp-empty-catch-block catches errors silently thrown away.
Encapsulation & logging
csharp-public-field flags public fields that should be properties (properties, constants, and static readonly values are left alone), and csharp-console-writeline flags Console.WriteLine calls that belong in a logger.
SQL injection & process launch
csharp-sec-sql-string-concat flags new SqlCommand(...) queries built with string concatenation, and csharp-sec-process-start flags Process.Start calls to review for untrusted arguments.
Weak crypto, TLS & secrets
MD5/SHA1 hashes, DES/TripleDES ciphers, custom ServerCertificateValidationCallback handlers, and hardcoded credentials round out 6 security checks in total.
Duplication & debt
Token-based clone detection across the whole repo, plus every TODO/FIXME counted — csharp-todo-without-ticket flags the ones with no ticket reference.
public async void LoadOrders()
{
var orders = await _repo.GetAllAsync();
Render(orders);
}Illustrative example. csharp-async-void: an exception thrown inside an async void method can't be awaited or caught by the caller and can crash the process — returning Task keeps it observable.
Frequently asked questions
Which C# files does it analyze?
Every .cs file in the repository. Methods, lambdas, generic methods with where constraints, records, and namespaces (including file-scoped ones) are all recognized.
Are expression-bodied members counted?
Not as separate functions. A method written as => expr; has no braces to measure, so it adds no function length or nesting of its own. Everything with a braced body is measured.
How is this different from Roslyn analyzers?
Roslyn analyzers run inside a .NET build, so they need the SDK and a restorable project. REPO-SIGHT runs from a GitHub URL alone, across the whole repo, and rolls the result into a single project health score — nothing to install or configure.
Does REPO-SIGHT build or run my code?
No. It's static analysis only — the source is parsed, never compiled, restored, or executed.
Is it actually free?
Yes — no tiers, no paywalled metrics. A small amount of advertising covers hosting instead of a paid plan.
Other languages
Related reading
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.