qlty

Universal linting, auto-formatting, maintainability, and security scanning

Qlty CLI is a multi-language code quality tool for linting, auto-formatting, maintainability, and security with support for 70+ static analysis tools for 40+ languages and technologies.

With Qlty CLI, polyglot team can take advantage of the best code quality static analysis with fast, consistent, and unified results through a single tool. Configuration is done through a simple .qlty/qlty.toml file in your repository, which can be auto-generated based on the languages you use.

The Qlty CLI is completely free for all use, including for commercial projects, with no limits on contributors.

---

📖 Table of Contents

• ✨ Key Features
• 🚀 Quick Start
  • 📦 Installation
  • Setting up Qlty in a new repository
  • Usage
  • Configuration
• 🧹 Available Linters
• 📊 Code Quality Metrics
• 🖥️ System Requirements
• 🛟 Help or Feedback
• 🧑‍💻 Contributing
• ⚖️ License

---

✨ Key Features

What We Do

	Feature	Advantage
🐛	Linting	Comprehensive language support in one tool
🖌️	Auto-formatting	Consistent code style everywhere
💩	Maintainability	Code smells like copy-paste detection and complexity
🚨	Security scanning	SAST, SCA, secret detection, IaC analysis, and more
🚦	Code coverage	Total coverage and diff coverage
📊	Quality metrics	Complexity, duplication, LOC, etc.

How We Do It

	Feature	Advantage
🌲	Git-aware	Focus on newly introduced quality issues
⚡	Auto-initialization	Get up and running in two minutes
✅	Autofixes	Including tool-generated and AI-generated fixes
⚙️	Config as code	Version controlled with maximum flexibility
🏎️	Caching and concurrency	The absolute fastest way to run static analysis
🪝	Git hooks	Integrate with pre-commit and pre-push hooks
🤖	Pull request reviews	Automated feedback in comments and statuses
🌐	Runs anywhere	Mac, Linux, and Windows with no dependency on Docker
🦀	Written in Rust	Fast execution and easy to contribute
🎁	100% free	Including for commercial projects, with no contributor limits
⚖️	Fair Source	Public on GitHub with delayed open source publication (DOSP). PRs accepted!

💡 Learn more in the Documentation.

Qlty Software: Code quality and coverage done right

Qlty CLI is part of Qlty Software's comprehensive platform for code quality. Bring code quality into every step of your software development workflow with:

• Qlty CLI -- Polyglot code quality CLI written in Rust
• Qlty Cloud -- Automated code review and quality trends
• Visual Studio Code Extension -- Linting and auto-formatting in your IDE
• GitHub Action -- Run Qlty CLI within your CI workflows
• Chrome and Firefox Extension -- Adds code coverage data to GitHub.com

---

🚀 Quick Start

Installation

The fastest way to install Qlty CLI is using our installer scripts which install our native binaries:

# Install on MacOS or Linux
curl https://qlty.sh | bash


# Install on Windows
powershell -c "iwr https://qlty.sh | iex"

We also package the CLI as a Docker image on GitHub Container Registry (GHCR).

[!NOTE] The Qlty CLI does not use Docker to run linters. By running linters natively, we achieve maximum performance. The Docker image is provided for situations where running the CLI as a containers is preferred over running it as a native binary.

Setting up Qlty in a new repository

Setup Qlty within a Git repository:

cd my_repo/
qlty init

Usage

Example Command	Description
qlty init	Setup Qlty within a Git repository
qlty check --sample=5	View a sample of lint issues
qlty fmt --all	Auto-format the codebase
qlty smells --all	Scan for code smells like duplication
qlty metrics --max-depth=2 --sort complexity --all	Review a summary of code quality metrics

Configuration

Qlty CLI is configured using a .qlty/qlty.toml file in your Git repository. You can generate a default configuration with qlty init and then customize it.

Read our documentation about configuration for more information.

---

🧹 Available Linters

Over 20,000 code quality rules are available via the Qlty CLI through its 60+ linter plugins.

To enable new plugins by adding them to your .qlty/qlty.toml file run:

qlty plugins enable <NAME>

Technology	Available code quality tools
All files	ast-grep, gitleaks, ripgrep, semgrep, trivy, trufflehog, vale
Apex	pmd
C#	complexity, duplication
C/C++	osv-scanner, trivy
CloudFormation	checkov
CoffeeScript	coffeelint
CSS	biome, prettier, stylelint
Dart	osv-scanner, trivy
Docker	checkov, dockerfmt, hadolint, radarlint, trivy
Dotenv	dotenv-linter
Elixir	complexity, duplication, osv-scanner, trivy
Erlang	osv-scanner, trivy
GitHub Actions	actionlint
Go	complexity, duplication, gofmt, golangci-lint, osv-scanner, radarlint
GraphQL	prettier
HTML	prettier
Java	checkstyle, complexity, duplication, google-java-format, osv-scanner, pmd, radarlint, trivy
JavaScript	biome, complexity, duplication, eslint, knip, osv-scanner, oxc, prettier, radarlint, trivy
JSON	biome, prettier
Kotlin	complexity, duplication, osv-scanner, radarlint, trivy
Kubernetes	kube-linter
Markdown	markdownlint, prettier
OpenAPI	redocly, spectral
PHP	complexity, duplication, osv-scanner, php-codesniffer, php-cs-fixer, phpstan, radarlint, trivy
Prisma	prisma
Python	bandit, black, complexity, duplication, flake8, mypy, osv-scanner, radarlint, ruff, trivy
R	osv-scanner, trivy
Ruby	brakeman, complexity, duplication, osv-scanner, radarlint, reek, rubocop, ruby-stree, standardrb, trivy
Rust	clippy, complexity, duplication, osv-scanner, rustfmt, trivy
SASS	prettier, stylelint
Scala	radarlint
Shell	shellcheck, shfmt
SQL	sqlfluff
Swift	swiftlint
Terraform	checkov, osv-scanner, radarlint, tflint, trivy
TypeScript	biome, complexity, duplication, eslint, knip, oxc, prettier
VB.NET	complexity, duplication
YAML	prettier, trivy, yamllint

The full list of plugins is available on GitHub.

---

📊 Code Quality Metrics

The Qlty CLI calculates a variety of code quality metrics which are available through the qlty metrics subcommand and as trends on Qlty Cloud.

Quality metrics are available for C, C++, C#, Elixir, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Swift, TypeScript, and VB.NET.

---

🖥️ System Requirements

Qlty CLI is available for MacOS, Linux, and Windows on x86 and ARM platforms.

Additional requirements for PHP linters

Certain PHP linters require a working installation of PHP available in your $PATH. To install PHP, use Homebrew or an alternative method.

Runner images that set QLTY_PHP_RUNTIMES_DIR=/opt/qlty/php provide a fixed set of PHP versions. Select a supported minor line in your configuration:

[runtimes.enabled]
php = "8.4"

The initial supported lines are 8.1, 8.2, 8.3, 8.4, and 8.5; the default is 8.3. The runner installs the available Sury packages at image build time and records the exact installed revisions. New patches reach customers through runner image releases; rebuilding an image for unrelated changes can also update PHP. Qlty selects the baked interpreter for Composer and PHP plugins without installing system packages or contacting APT during a run. 8.3, 8.3.7, and 8.3.x all select the image's baked 8.3 patch. Patch numbers select their minor line rather than requiring that historical patch. If an exact patch request differs from the baked version, Qlty logs a warning during installation with the requested and selected versions. Each interpreter uses its own configuration and extensions.

Previously, PHP runtime configuration was ignored. To preserve working builds, unsupported or unrecognized values such as 7.4, 8.0, 8, ^8.3, and latest produce a warning during installation and use the image's PHP 8.3. Set a supported minor line to select that interpreter explicitly.

Without QLTY_PHP_RUNTIMES_DIR, PHP continues to come from the local $PATH.

---

🛟 Help or Feedback

• Read the documentation
• Join our Discord chat
• Community support via GitHub Discussions
• Feature requests via GitHub Discussions
• Bug reports via GitHub Issues
• Plugin request via GitHub Issues

---

🧑‍💻 Contributing

Adding plugins

Creating a plugin can be as easy as writing a small plugin definition TOML file. If the tool has a custom output format (instead of a standard like SARIF), then writing a simple output parser in Rust is also needed.

We also happily accept requests for new plugins via GitHub issues.

Developing the CLI

Developing on Qlty CLI requires a working Rust toolchain and adheres to the standard Rust development process:

git clone https://github.com/qltysh/qlty.git
cd qlty
cargo build
cargo test

More information

More information about how to contribute can be found in CONTRIBUTING.md.

Reports of security vulnerabilities should be handled with the process outlined in SECURITY.md.

---

⚖️ License

Qlty CLI is published under a Fair Source license. As Fair Source, the Qlty CLI is free to use (including in commercial contexts), modify, and distribute in accordance with its license.

This code is made available under the Business Source License 1.1 (BSL) and transitions into Open Source via a Delayed Open Source Publication (DOSP). More details are available in LICENSE.md.

Acknowledgements

We would like to thank all of the developers of code quality tooling like linters and meta-linters as well as everyone who has contributed to the field of open source static analysis. Qlty CLI stands on the shoulders of decades of this excellent work.

Licenses for code incorporated into Qlty CLI can be found in the docs/licenses folder.

---