miropen/mir-php

Fast static analyzer for PHP

Maintainers

Package info

github.com/jorgsowa/mir

Type:composer-plugin

pkg:composer/miropen/mir-php

Transparency log

Statistics

Installs: 11

Dependents: 0

Suggesters: 0

Stars: 10

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v0.72.1 2026-08-30 09:58 UTC

Requires

  • php: >=8.1
  • composer-plugin-api: ^2.0

Requires (Dev)

MIT 44b4d6072cc336ab2a0fe532558c93ed155d4f3c

phpanalyzerstatic-analysisPHPStanpsalm

Published on Packagist.org on 2026-08-30 10:13 UTC

This package is auto-updated.

Last update: 2026-08-30 10:13:06 UTC

README

mir

mir

Docs

⚠️ Experimental. mir is under active development and not yet production-ready. APIs, CLI flags, issue codes, and output formats may change between releases; expect false positives and rough edges.

Try the Playground →

A fast, incremental PHP static analyzer written in Rust, inspired by Psalm.

Features

  • 140+ diagnostic rules across type errors, undefined symbols, dead code, taint, and more
  • Sound type system — scalars, objects, generics, unions, intersections, literals, never, void
  • Full type inference — return types, literal narrowing, if/match/instanceof/is_string() etc.
  • Call checking — argument count and types for user-defined and built-in functions/methods
  • Class analysis — inheritance, interface compliance, abstract enforcement, visibility, readonly, final
  • Dead code detection — unused variables, parameters, private methods, properties, and functions
  • Taint analysis — tracks data from $_GET/$_POST to HTML/SQL/shell sinks
  • Incremental cache — unchanged files skipped on re-runs via content hashing
  • Parallel analysis — rayon-powered; scales to available CPUs
  • PHP 7.4–8.5 support with version-aware stub filtering
  • Comprehensive built-in coverage — powered by JetBrains phpstorm-stubs (57 extensions, 500+ functions, 100+ classes)

Installation

From Composer (PHP projects)

composer require --dev miropen/mir-php
vendor/bin/mir src/

A post-install-cmd hook downloads the prebuilt binary matching your version and host platform from GitHub Releases. See the getting started guide for supported targets.

From crates.io

cargo install mir-php

Build from source

git clone https://github.com/jorgsowa/mir.git
cd mir
cargo build --release
# binary at target/release/mir

Usage

mir                        # analyze current directory
mir src/ lib/              # analyze specific paths
mir --format json src/     # machine-readable output
mir --baseline baseline.xml src/  # suppress known issues

See the CLI reference for all flags and options.

Suppressing issues inline

Use @mir-ignore, @mir-ignore-next-line, or @mir-ignore-file to suppress a false positive directly in source. @psalm-suppress and @phpstan-ignore-* aliases are accepted. See the suppression reference.

Documentation

Full documentation is available at jorgsowa.github.io/mir.

Contributing

See CONTRIBUTING.md.

License

MIT