Rampart PHP

One command. Plain PHP or any framework. No install in the target.

Rampart PHP wraps phpcs, phpstan, phpunit, composer audit, npm audit and trivy, and adds 59 PHP-Parser rules for security, framework routing, missing tests and conventions. It parses the target; it never boots it.

git clone https://github.com/thiennhant95/Rampart-PHP.git
cd Rampart-PHP && composer install
php bin/rampart /path/to/project --tier=security --fail-on=none

The Rampart family

Project	Focus	Repository	Documentation
Rampart	Laravel quality gate: Artisan command, 50 rules, Laravel semantics	thiennhant95/Rampart	Pages
Rampart PHP	Plain PHP + Slim, CodeIgniter 4, FuelPHP, Symfony, Phalcon, Laravel; PHP 7.4+	thiennhant95/Rampart-PHP	Pages
Rampart WP	WordPress plugins and themes: WPCS, capability, nonce, escaping, `$wpdb`	thiennhant95/Rampart-Wordpress	Pages

Start here

English documentation — install, frameworks, rules, reports, CI.
日本語ドキュメント
Tài liệu tiếng Việt

Repository guides

Framework support — detection, layouts, route auth.
Rule notes — confidence, Laravel-only gating, conservative rules.
False positives — triage and inline suppression.
Reports — console, JSON, HTML, Markdown, SARIF.
Tools — benchmark, external precision, smoke test.