Open-Source Testing · carlosas

phpat

PHPat is a PHP architecture testing tool built as a PHPStan extension that lets developers define and enforce architectural rules using natural language syntax. It helps prevent violations of layering, dependency, and structural patterns in PHP codebases.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/carlosas/phpat

1.3k

GitHub stars

Forks

PHP

Primary language

MIT

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	carlosas/phpat
Owner	carlosas
Primary language	PHP
License	MIT — OSI-approved
Stars	1.3k
Forks	62
Open issues	17
Latest release	0.12.4 (2026-03-17)
Last updated	2026-03-17
Source	https://github.com/carlosas/phpat

What phpat is

PHPat extends PHPStan (static analysis tool) to provide architecture validation through declarative rules. It performs static analysis to detect violations of defined architectural constraints without runtime execution, integrating into the PHPStan analysis pipeline.

Quickstart

Get the phpat source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/carlosas/phpat.git2cd phpat3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Enforcing layered architecture patterns

Define which layers can depend on others (e.g., controllers cannot depend on domain logic) and catch violations automatically in CI/CD pipelines before code review.

Maintaining package/namespace boundaries

Prevent internal APIs from leaking into public interfaces or enforce module isolation rules across a large codebase without manual inspection.

Adding guardrails to legacy PHP codebases

Gradually enforce architectural constraints on existing projects to prevent further degradation and guide refactoring efforts over time.

Implementation considerations

Rules are written in a domain-specific natural language syntax; investment in learning and documenting your team's architectural decisions upfront pays off in clarity.
PHPat requires PHPStan 2.1+; ensure PHP version and PHPStan compatibility with existing static analysis setup before adoption.
Composer dev-dependency installation; requires integration into CI/CD pipelines and local pre-commit workflows to be effective.
Initial rule definition and tuning may identify large numbers of pre-existing violations; plan for a phased rollout or blanket suppression strategy.
Performance impact is PHPStan-dependent; monitor analysis time in large monorepos and adjust rule scope if necessary.

When to avoid it — and what to weigh

Runtime behavior validation is primary concern — PHPat performs static analysis only; it cannot validate runtime dependency injection, dynamic instantiation, or runtime configuration patterns.
Non-PHPStan static analysis workflow — PHPat is tightly coupled to PHPStan and requires it as a dependency. Projects not using PHPStan will incur additional tooling overhead.
Pre-1.0 stability critical — Project is at 0.12.4 with stated breaking changes in minor versions until 1.0.0 release; breaking upgrades may require rule refactoring.
Needs multi-language architecture validation — PHPat is PHP-only; projects requiring polyglot architecture checks need separate tools per language or a language-agnostic platform.

License & commercial use

MIT License—permissive OSI-approved license allowing commercial use, modification, and distribution with attribution.

MIT permits unrestricted commercial use as a dependency in closed-source projects. No proprietary licensing model detected; safe for enterprise deployment without license review.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Good
Assessment confidence	High

Security considerations

PHPat is static analysis only; no network calls, credential handling, or data processing detected. Runs locally as PHPStan extension. No security audit data provided. Relies on PHPStan's security posture.

Alternatives to consider

PHPStan (core)

PHPStan is the underlying engine and provides basic rule enforcement; PHPat adds architecture-specific DSL on top. Use core PHPStan if needs are simpler or if you prefer raw constraint writing.

Psalm

Alternative static analysis tool for PHP with different rule model and ecosystem. Requires different rule syntax and integration; lighter-weight than PHPStan for some projects.

dePHPend

Older, focused dependency graph analyzer for PHP architecture. Less actively maintained and smaller ecosystem compared to PHPat; useful if you prefer low-overhead tooling.

Software development agency

Build on phpat with DEV.co software developers

PHPat helps teams prevent architectural decay and enforce design patterns automatically. Start with a free consultation on integrating static analysis into your CI/CD pipeline.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

phpstan arkitect unit-testing-tips

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Testing Custom Software Development Web Application Development Talk to DEV.co

phpat FAQ

Will PHPat work with my existing PHPStan setup?

Yes, if you are on PHPStan 2.1+. Install via Composer and activate either automatically (using phpstan/extension-installer) or manually via phpstan.neon config.

Can I suppress specific violations?

Not clearly stated in provided data. Likely inherits PHPStan suppression mechanisms (e.g., @phpstan-ignore, baseline files). Requires review of official documentation.

What happens when I upgrade to a minor version (0.x.x)?

Potential breaking changes in API or rule syntax until 1.0.0 release, per Semantic Versioning policy stated in README. Plan upgrades with test runs and rule review.

Is PHPat suitable for large monorepos?

Unknown. No performance benchmarks, scoping options, or monorepo-specific guidance provided. Recommend testing with representative codebase and monitoring PHPStan analysis time.

Custom software development services

Adopting phpat is usually one piece of a larger software development effort. As a software development agency, DEV.co provides software development services and web development expertise — pairing senior software developers and web developers with your team to design, build, and operate open-source testing software in production.

Strengthen your PHP architecture today

PHPat helps teams prevent architectural decay and enforce design patterns automatically. Start with a free consultation on integrating static analysis into your CI/CD pipeline.

Talk to DEV.co Schedule a Consultation