Java Code Analyzer
Paste a public GitHub URL and REPO-SIGHT reads your Java source directly — complexity, common code smells, and 15 rules built specifically for Java. Free.
What REPO-SIGHT checks in your Java code
15 rules, tuned for Java — 6 of them security-specific.
Complexity & structure
Cyclomatic complexity, max nesting depth (flagged past 6 levels), and methods over 100 lines — the same thresholds used in the health score.
Swallowed exceptions & noisy logging
java-empty-catch-block and java-printstacktrace catch two ways real failures get lost instead of logged properly.
Encapsulation & raw generics
java-public-field and java-raw-type-usage flag fields exposed without accessors and generics used without their type parameters. Public fields on classes that only hold data (fields, constructors, toString/equals/hashCode and getters/setters) are treated as DTOs and not flagged.
SQL injection risk
java-sec-sql-string-concat flags queries built by concatenating strings instead of using parameterized statements.
Weak crypto & TLS trust
Hardcoded secrets, Runtime.exec, permissive/custom TrustManagers, weak ciphers, and weak hashes — 6 security checks in total.
Duplication & debt
Token-based clone detection across the whole repo, plus every TODO/FIXME counted — java-todo-without-ticket flags the ones with no ticket reference.
String query = "SELECT * FROM users WHERE id = " + userId;
statement.executeQuery(query);Illustrative example. java-sec-sql-string-concat: building SQL by concatenating a variable in directly opens the door to SQL injection — a parameterized query (PreparedStatement) closes it.
Frequently asked questions
Does REPO-SIGHT need a Maven or Gradle build to run?
No. It reads source files directly — no build file, no dependency resolution, no compilation step.
How is this different from Checkstyle, PMD, or SpotBugs?
Those need local setup and configuration per project. REPO-SIGHT runs from a GitHub URL alone and combines quality and security checks into one project health score.
Which Java version does it support?
The parser targets standard Java syntax rather than gating on a specific JDK version — the patterns above apply across modern Java codebases.
Is it actually free?
Yes — no tiers, no paywalled metrics. A small amount of advertising covers hosting instead of a paid plan.
Other languages
Related reading
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.