AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomsphpat
PHPat is a PHP architecture testing tool built as a PHPStan extension that lets developers define and enforce architectural rules using natural language syntax. It helps prevent violations of layering, dependency, and structural patterns in PHP codebases.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | carlosas/phpat |
| Owner | carlosas |
| Primary language | PHP |
| License | MIT — OSI-approved |
| Stars | 1.3k |
| Forks | 62 |
| Open issues | 17 |
| Latest release | 0.12.4 (2026-03-17) |
| Last updated | 2026-03-17 |
| Source | https://github.com/carlosas/phpat |
What phpat is
PHPat extends PHPStan (static analysis tool) to provide architecture validation through declarative rules. It performs static analysis to detect violations of defined architectural constraints without runtime execution, integrating into the PHPStan analysis pipeline.
Get the phpat source
Clone the repository and explore it locally.
git clone https://github.com/carlosas/phpat.gitcd phpat# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Rules are written in a domain-specific natural language syntax; investment in learning and documenting your team's architectural decisions upfront pays off in clarity.
- PHPat requires PHPStan 2.1+; ensure PHP version and PHPStan compatibility with existing static analysis setup before adoption.
- Composer dev-dependency installation; requires integration into CI/CD pipelines and local pre-commit workflows to be effective.
- Initial rule definition and tuning may identify large numbers of pre-existing violations; plan for a phased rollout or blanket suppression strategy.
- Performance impact is PHPStan-dependent; monitor analysis time in large monorepos and adjust rule scope if necessary.
When to avoid it — and what to weigh
- Runtime behavior validation is primary concern — PHPat performs static analysis only; it cannot validate runtime dependency injection, dynamic instantiation, or runtime configuration patterns.
- Non-PHPStan static analysis workflow — PHPat is tightly coupled to PHPStan and requires it as a dependency. Projects not using PHPStan will incur additional tooling overhead.
- Pre-1.0 stability critical — Project is at 0.12.4 with stated breaking changes in minor versions until 1.0.0 release; breaking upgrades may require rule refactoring.
- Needs multi-language architecture validation — PHPat is PHP-only; projects requiring polyglot architecture checks need separate tools per language or a language-agnostic platform.
License & commercial use
MIT License—permissive OSI-approved license allowing commercial use, modification, and distribution with attribution.
MIT permits unrestricted commercial use as a dependency in closed-source projects. No proprietary licensing model detected; safe for enterprise deployment without license review.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Good |
| Assessment confidence | High |
PHPat is static analysis only; no network calls, credential handling, or data processing detected. Runs locally as PHPStan extension. No security audit data provided. Relies on PHPStan's security posture.
Alternatives to consider
PHPStan (core)
PHPStan is the underlying engine and provides basic rule enforcement; PHPat adds architecture-specific DSL on top. Use core PHPStan if needs are simpler or if you prefer raw constraint writing.
Psalm
Alternative static analysis tool for PHP with different rule model and ecosystem. Requires different rule syntax and integration; lighter-weight than PHPStan for some projects.
dePHPend
Older, focused dependency graph analyzer for PHP architecture. Less actively maintained and smaller ecosystem compared to PHPat; useful if you prefer low-overhead tooling.
Build on phpat with DEV.co software developers
PHPat helps teams prevent architectural decay and enforce design patterns automatically. Start with a free consultation on integrating static analysis into your CI/CD pipeline.
Talk to DEV.coRelated open-source tools
Surfaced by semantic similarity across the DEV.co open-source index.
Related on DEV.co
Explore the category and the services that help you build with it.
phpat FAQ
Will PHPat work with my existing PHPStan setup?
Can I suppress specific violations?
What happens when I upgrade to a minor version (0.x.x)?
Is PHPat suitable for large monorepos?
From evaluation to production software
Open-source adoption creates integration work. DEV.co supplies the software development services that close the gap between phpat and a running open-source testing system your team can operate.
Strengthen your PHP architecture today
PHPat helps teams prevent architectural decay and enforce design patterns automatically. Start with a free consultation on integrating static analysis into your CI/CD pipeline.