Static analysis for Go — locally, in 60 seconds.
Scan your Go module for cyclomatic-complexity outliers, vulnerable
dependencies, unchecked errors, unreachable functions, and tangled
package imports — with the ik CLI itself written in
Go. Pairs with go vet and staticcheck; inkode
contributes the security, structural, and historical signal those don't.
Running on a typical Go module
What we check, and how.
Use both.
go vet is a linter, not a security tool. govulncheck walks call graphs from main to confirm a vulnerable function is actually reachable in your binary — not just declared in a transitive dependency you never call.
staticcheck flags unused identifiers within a package. The deadcode tool walks every reachable call from main to find functions and methods that no path reaches — the kind that pile up after AI-generated refactors.
errcheck catches the Go-specific anti-pattern of x, _ := foo() or bare foo() when foo returns an error. AI tools default to these when they're not sure what to do; the language's idioms expect you not to.
Hotspots from git log ranking, coupling pairs from co-change history, the package import graph for cycles — none of which a single-snapshot linter can see. Add the security pass (gitleaks) and you've got a complete picture, not just "does it compile."
Run it on your Go module.
Install in one line, scan in under a minute. No account required.
Scan another language
Cross-cutting checks: secret scanning · dependency vulnerability scanning · AI code review