pkg.soopen package index

brew / rank 4247

Install psalm with Homebrew, pacman

PHP Static Analysis Tool. Version 6.20.6 via Homebrew; verified 2026-11-02. Also installable with pacman: sudo pacman -S psalm.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install psalm

local Homebrew formula metadata

overview

Package summary

PHP Static Analysis Tool

Commands and aliases

  • psalm

history

Project history and usage

Psalm is an open-source static-analysis engine for PHP that finds type errors, correctness defects, and security vulnerabilities without executing the analyzed application.

Project history

Matt Brown created Psalm to analyze Vimeo's large PHP codebase and prevent production defects. Vimeo open-sourced it after a year of internal use; the official repository continues to credit Brown as its creator and Vimeo's engineering team for supporting its development.

The 2019 Psalm 3 release improved performance and added a Composer-based plugin framework, generated baselines, and IDE support. Subsequent development expanded its type system, security analysis, automated fixes, and language-server workflow.

Adoption history

Psalm grew from Vimeo's internal quality gate into a widely packaged PHP analysis tool. Composer-oriented installation, generated baselines, plugins, editor support, and continuous-integration use made gradual adoption practical for existing applications.

How it is used

Projects commonly install Psalm as a Composer development dependency, run `psalm --init` to generate `psalm.xml`, and invoke the analyzer locally or in continuous integration. Baselines and issue-level configuration allow teams to introduce stricter analysis gradually.

Psalm also supports taint analysis, project-specific stubs and annotations, automated fixes, refactoring commands, plugins, and language-server integration.

Why package nerds care

Psalm helped make whole-program type analysis and taint tracking routine parts of PHP development. Package enthusiasts value its Composer integration, XML configuration, plugin API, standalone CLI tools, language server, automated fixes, and refactoring support.

Timeline

  • Internal origin: Psalm was created to analyze Vimeo's PHP codebase.
  • Public release: Vimeo open-sourced Psalm after a year of internal use.
  • 2019: Psalm 3 added faster analysis, baselines, plugins, and IDE support.

Related projects

  • PHPStan addresses the same PHP static-analysis problem through its own rule-level, extension, and baseline model.
  • Composer is Psalm's documented project-local installation mechanism and supplies its plugin-oriented PHP ecosystem workflow.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 1 platform targets.
  • Installs with 1 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
psalm.xml

executables

Installed executables

CommandKindExposureNote
psalmcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-11-04
manager version6.20.6
manager updated2026-11-02
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/vimeo/psalm

install metadata

Package metadata

Package keybrew:psalm
Version6.20.6
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/psalm
Homepagehttps://psalm.dev
Repositoryhttps://github.com/vimeo/psalm
Upstream docshttps://psalm.dev
LicenseMIT
Source archivehttps://github.com/vimeo/psalm/releases/download/6.20.6/psalm.phar
Last updated2026-11-02T18:42:55Z
Pulseupdated
Dependenciesphp
Bottleavailable (on all)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namepsalm
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

pacman95%

psalm 6.16.1-1

A static analysis tool for finding errors in PHP applications

https://psalm.dev/

sudo pacman -S psalm
  • License: MIT
  • Architecture: any
  • 1 dependencies
  • normalized package name match
  • Matched by: Psalm
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: psalm from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation