About Psalm
Psalm is a static analysis tool for PHP that helps identify problems in code, including type-related runtime errors and security vulnerabilities. It is free and open-source, and can be used on codebases of various sizes and ages.
On its strictest setting, Psalm can help prevent almost all type-related runtime errors and enables safe coding patterns. It also includes automatic bug fixing capabilities.
Key features
- Identifies type-related runtime errors
- Detects security vulnerabilities
- Supports strict analysis settings
- Automatically fixes bugs
- Works with large and small codebases
Good fit for
- Finding errors in PHP applications
- Improving code quality with static analysis
Psalm: questions and answers
- What is Psalm used for?
- Psalm is a free and open-source static analysis tool for PHP that helps identify problems in code, including type-related runtime errors and security vulnerabilities. It is a good fit for finding errors in PHP applications and improving code quality with static analysis.
- Is Psalm open source?
- Yes. Psalm is open source under the MIT licence. Its source code is on GitHub at vimeo/psalm and is written mainly in PHP.
- Is Psalm free?
- Yes. Psalm is open source, so the software itself is free to use.
- Can I self-host Psalm?
- Yes. Psalm can be self-hosted on your own server or infrastructure.
- What is Psalm an alternative to?
- Psalm is an open-source alternative to Codacy. Other open-source alternatives to Codacy include Semgrep, SonarQube and ESLint.
- Is Psalm actively maintained?
- Yes. The most recent commit to Psalm was on 13 October 2026, and the latest release is 6.20.0, published on 9 October 2026. The project has 5.9k stars on GitHub.
Open-source alternatives to Psalm
See all
Semgrep
Security
Lightweight static analysis for many languages. Find bug variants with patterns that look
LGPL-2.1vs Snyk★ 17k
SonarQube
Developer Tools
Continuous Inspection
LGPL-3.0vs Codacy★ 11k
ESLint
Open source
Find and fix problems in your JavaScript code.
MITvs SonarQube Cloud★ 28k
MISP
Security
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
AGPL-3.0vs Recorded Future★ 6.6k
Nuclei
Security
Nuclei is a fast, customizable vulnerability scanner powered by the global security commun
MITvs Checkmarx★ 32k
Gitleaks
Security
Find secrets with Gitleaks 🔑
MITvs GitGuardian★ 30k
SaaS alternatives to Psalm
See all
Codacy
Developer Tools
Automated code quality and security analysis for pull requests
SaaS
VibeDoctor
Security
Runs 129+ deterministic checks on a GitHub repo for security, leaked secrets, performance and dependency health
SaaS
ShipShield
Security
Security engine that checks a codebase against known vulnerability signatures and delivers an audit with AI fixes
SaaS
Ontoly Cloud
Developer Tools
Verifies AI-generated code for architecture, security, dependencies and deployment readiness using a Software Graph
SaaS
Abnormal Security
Security
Behavior-based cloud email security that blocks phishing and account takeover
SaaS
Adverse Monitor
Security
Cyber threat intelligence tool that watches the dark web for incident claims naming your company
SaaS

