PHPStan checks PHP lines before they run, and leaves the install step to another site

Analysis that reads source text instead of running it

PHPStan's premise fits in one sentence: it finds errors in your code without actually running it. The README says it catches whole classes of bugs even before you write tests for the code, which matters most for a codebase whose suite exercises only some paths. Its stated goal is to move PHP closer to compiled languages, where the correctness of each line can be checked before you run the actual line. There is a public playground at phpstan.org/try if you would rather not install anything first. What you get is a review of source text. What you do not get is a view of the running program, because no execution takes place and no runtime state exists to inspect. Every answer comes from reading files, not from watching a request fail.

The default branch is 2.3.x, the newest release is 2.2.16

The default branch is named 2.3.x, and the most recent releases are 2.3.4 on October 28, 2026, 2.3.3 on October 27, 2026, and 2.3.2 on October 24, 2026. The root does carry CHANGELOG.md and UPGRADING.md, but their format and their mapping to versions are not described here, so judging whether an upgrade is safe means reading those two files on your own.

No install command in the README, but phpstan.phar sits in the root

There is no install command in the README. If you are sizing up PHPStan from the repository alone, that is the first gap: the page links to the Getting Started and User Guide on phpstan.org and stops there. The root directory does hold a set of entry points that hint at the intended shapes of an install, including a phpstan file, phpstan.phar, phpstan.phar.asc, a .phar-checksum file, bootstrap.php, and composer.json. Nothing states which of these you are meant to use or how the phar relates to the packaged distribution. A docker directory sits in the root as well and is never mentioned, so a team standardizing on containers gets no image name and no tag from this file. Take the install path from the User Guide instead of from here.

Pull requests go to phpstan-src, not to this repository

The README points out that PHPStan's source code open to pull requests lives at phpstan/phpstan-src. That one sentence is the entire contribution story, and it has a practical effect: a patch opened against phpstan/phpstan targets the distribution repository rather than the place that accepts pull requests. The root listing also shows what this repository carries besides the analyzer, with website, playground-api, playground-runner, identifier-extractor, turbo-ext, docker, conf, e2e, CLAUDE.md, and a .claude directory. None of that division is explained. Participation is framed through a Contributor Code of Conduct, and funding runs through GitHub Sponsors, one-time donations through Revolut.me, and e-mail invoices to the maintainer.

Watch mode and the error browser sit behind the --pro option

Two capabilities people look for are not in the open-source tool. They live in PHPStan Pro, a paid add-on: a Web UI for browsing found errors where you click a finding and open your editor of choice on the offending line, and continuous analysis in watch mode, which scans changed files in the background and refreshes the UI automatically. Starting it needs PHPStan 0.12.45 or later and the --pro option, then an account created from the on-screen instructions or at account.phpstan.com. After a 30-day free trial the price is 7 EUR for individuals monthly and 70 EUR for teams of up to 25 members. On a large codebase that means a live loop while you edit is something you buy or replace with a second run.

Every configuration detail lives off the repository

Nothing in the README tells you what PHPStan will check. The README hands you seven external destinations: the Getting Started and User Guide, the Config Reference, PHPDocs Basics, PHPDoc Types, the Extension Library, Developing Extensions, and the API Reference at apiref.phpstan.org. There is no sample config file in the README, no list of the error identifiers the tool can emit, and no statement of the rule set a project starts with. The conf directory in the root is not explained either. The consequence is blunt for anyone deciding on this: you cannot tell whether PHPStan fits your codebase until you fetch the Config Reference, and you cannot write a shared ruleset for a team from this file alone.

No documented way to defer a finding you disagree with

Nor does this page explain what to do with a finding you believe is wrong. There is no line level ignore, no baseline file for known problems, and no cache reset command anywhere in the README, and no error identifier you could match against a suppression list. The words do not appear because the file is a summary rather than a manual. The consequence shows up on the first day of an adoption: a static analyzer runs against code that already ships, so the opening report is a list of existing problems, and if those cannot be deferred anywhere, that report has no route to zero. Teams that need suppression to land the tool should hunt for it before committing, not after the first noisy run.

Three 2.2.x patches in two weeks, MIT licensed, sponsor funded

The maintenance picture is healthy. The repository is not archived, the last push is dated November 2, 2026, and three 2.3.x patch releases landed between October 24 and October 28, 2026, a cadence you can schedule around. The license is MIT. Funding comes from sponsors rather than a foundation: gold sponsors include ma.tt, mojam.co, and check24.de, shipmonk and shopware are listed at silver, and a longer list sits at bronze, with support routed through GitHub Sponsors, one-time donations through Revolut.me, and invoices by e-mail. The tradeoff for a reader is that sponsor money is not governance. No charter, foundation, or published roadmap appears in this repository, so a team putting its static analysis gate on PHPStan is making that bet on one maintainer's release rhythm.

Editorial conclusion

For a PHP team that wants error classes caught before tests exist, PHPStan is worth an evaluation, but the decision belongs to the Config Reference and the extension library rather than to the README. If a browsable error list and watch mode are requirements, budget 7 EUR a month for one person or 70 EUR for a team of up to 25. Before you commit, verify the PHP versions you run and the rule set you intend to enforce, because the README states neither.

Frequently asked questions

Official sources

1. License: MIT
2. phpstan/phpstan on GitHub
3. Project website
4. README
5. Releases