An Open-Source, Free Source Code Analyzer Tool from Microsoft

It is used to identify “interesting” features and metadata, like the use of cryptography, connecting to a remote entity, and the platforms it runs on.

Application Inspector differs from more typical static analysis tools in that it isn’t limited to detecting poor programming practices; rather, it surfaces interesting characteristics in the code that would otherwise be time-consuming or difficult to identify through manual introspection. It then simply reports what’s there, without judgement.

Application Inspector is a cross-platform, command-line tool that can produce output in multiple formats, including JSON and interactive HTML. 

Application Inspector is different from traditional static analysis tools in that it doesn't attempt to identify "good" or "bad" patterns; it simply reports what it finds against a set of over 400 rule patterns for feature detection including features that impact security such as the use of cryptography and more. This can be extremely helpful in reducing the time needed to determine what Open Source or other components do by examining the source directly rather than trusting to limited documentation or recommendations.

Application Inspector comes with hundreds of feature detection patterns covering many popular programming languages, with good support for the following types of characteristics:

• Application frameworks (development, testing)

• Cloud / Service APIs (Microsoft Azure, Amazon AWS, and Google Cloud Platform)

• Cryptography (symmetric, asymmetric, hashing, and TLS)

• Data types (sensitive, personally identifiable information)

• Operating system functions (platform identification, file system, registry, and user accounts)

• Security features (authentication and authorization)

Application Inspector can identify interesting features in source code, enabling you to better understand the software components that your applications use. Application Inspector is open source, cross-platform (.NET Core).

The tool supports scanning various programming languages including C, C++, C#, Java, JavaScript, HTML, Python, Objective-C, Go, Ruby, PowerShell and more and can scan projects with mixed language files. It also includes HTML, JSON and text output formats

Download Application Inspector