PHP_CodeSniffer CLI
PHP_CodeSniffer is a PHP checking CLI that applies project rules locally and in CI so teams share one coding standard.
- 1,572 ★ on the repository
- Last commit
- BSD-3-Clause
Extended access
Why this level
- The phpcs command reads source files, phpcbf modifies them, and configured rules may invoke external programs.
Install
Manual install
curl -OL https://phars.phpcodesniffer.com/phpcs.phar
curl -OL https://phars.phpcodesniffer.com/phpcbf.pharFirst README PHAR download commands; run through PHP after verifying files.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The phpcs command reads source files, phpcbf modifies them, and configured rules may invoke external programs.
This is third-party code. Review the repository files before installing.
What it does
PHP_CodeSniffer provides two commands: phpcs reports coding-standard violations, while phpcbf fixes supported findings. Checks can target a file or directory. Project configuration aligns local and CI rules. PSR12 is the default standard and can be changed. Reports show violations of the configured rules; the team chooses which standard to enforce.
Who it is for. PHP maintenance teams enforcing shared coding standards while separating reports from automatic fixes.
Good fit when
- Before review, PHP changes go through the agreed style rules.
- The team stores its coding standard in project configuration instead of individual editor settings.
- A large directory is checked before any source edits.
- After reviewing the report, a developer runs automatic fixes separately.
Not a fit when
- You need proof of application behavior.
- Automatic fixes cannot be reviewed before commit.
- The environment predates the supported PHP minimum.
Example request
Check this PHP directory with phpcs and our ruleset. Group findings without running phpcbf yet.Limitations
PHP 7.2.0 or newer is required; individual checks may need extensions or separately installed external programs. PSR12 is enabled by default, so configure a different ruleset before assessing compliance. Even patch releases can alter findings and fixes, making version pinning useful in CI. phpcbf modifies source files; review the diff and run tests rather than assuming every automated edit preserves intent.
How to disable. Remove CI and hook checks, then uninstall or remove downloaded PHARs. Applied edits remain in source.
FAQ
How do the commands differ?
phpcs reports violations; phpcbf fixes supported cases. Start with reporting.
What is the default standard?
PSR12. Use `--standard` or project configuration to change it.
Why does Composer still use squizlabs?
The maintained continuation retains the package name. Verify releases through PHPCSStandards.
Can I check a directory?
Yes. Pass its path to phpcs and review exclusions first.
How do I verify a PHAR?
Verify the provenance of `phpcs.phar` with `gh attestation verify phpcs.phar -o PHPCSStandards`. Releases also carry a signature, with verification instructions in the project README.
Discussion
No questions or reviews yet.
Related
CLI toolsComposerRequireChecker finds PHP symbols and extensions used by code but missing from its declared direct Composer dependencies.
An adversarial code-audit skill: Hunter finds bugs, Skeptic challenges them, Referee rules, and no source edit happens without your permission
Qlty CLI reports duplicate and complex code before refactoring; automatic formatting runs as a separate action.
A Claude Code and OpenCode plugin that will not let a session end until 1C edits pass standards, architecture and XML checks
A CLI for performance measurement and regression detection; the repository also holds a plugin with two skills and MCP for Claude Code and Cursor
Habit Hooks runs linters after an agent's edits and turns each violation into a short guide for fixing the code
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| PHP_CodeSniffer (this card) | no | 1,572 | ||
| Semgrep | yes | not required | 17,523 | PHP_CodeSniffer enforces PHP style standards and fixes some findings; Semgrep finds error and vulnerability patterns across languages. |
| ComposerRequireChecker | no | 1,011 | ComposerRequireChecker finds PHP symbols and extensions used by code but missing from its declared direct Composer dependencies. | |
| scc | no | not required | 8,860 | scc counts code and comments, estimates complexity, inspects Git history and exposes analysis to agents through built-in MCP. |
README in short
PHPCSStandards maintains the continuation of the Squizlabs project with the same Composer package name. PHAR distributions and Phive installation are also available.