ShellCheck Alternatives and Add-ons for Shell Scripts

ShellCheck is a static analysis tool for shell scripts, written in Haskell and released under GPLv3. It is alive. The GitHub repository shows v0.11.0 as the latest release, dated August 3, 2025, with new checks already queued in the changelog for the next one. You can paste a script into shellcheck.net without installing anything; the README says the site tracks the latest commit.

Because ShellCheck costs nothing, people searching for an alternative usually want something it does not do. It does not format code. It will not apply its own fixes. It rejects zsh, csh and PowerShell scripts, per its SC1071 wiki page. And it cannot tell you if a script actually works. The tools below fill those gaps, ordered by how many shell authors will want them.

Prices below are as of November 6, 2026. Our method is on How we review tools.

Quick comparison

shfmt

Daniel Martí's shfmt is to shell what gofmt is to Go. It rewrites a script into one canonical layout, so code review stops being about indentation. The mvdan/sh README says the parser supports POSIX shell, Bash, Zsh and mksh, and the project tagged v3.14.1 on September 6, 2026.

Running shfmt -l -w script.sh lists and fixes files in place. Packages exist for Homebrew, Scoop, Debian, Fedora, Alpine, Arch and PyPI, plus a Docker image, so it drops into CI with one line. Zsh support matters here: it gives zsh users a parser-based check that ShellCheck refuses to provide, since shfmt fails on syntax it cannot parse.

Best for: Teams that want every script formatted the same way, in CI and on save.

Pricing:

• Free and open source (BSD-3-Clause)

Watch out for:

• Formatting cannot be turned off for a range of lines, and the README says the project avoids adding style options on purpose.
• Unquoted Bash associative array keys can be misread as arithmetic, so the README tells you to always quote them.

Official site: shfmt.

Bash Language Server

This is the IDE route. The Bash Language Server uses a Tree-sitter parser to give any LSP editor jump-to-definition, find references, rename, completion, hover docs from explainshell, and an outline. Version 5.8.1 went out on npm on September 19, 2026, under the MIT licence.

It does not replace ShellCheck; it wraps it. The project README says that if shellcheck is installed, the server runs it on each change with a 500 ms debounce and offers quick fixes that insert disable directives. With shfmt installed, the format command works too. Clients exist for VS Code (the Bash IDE extension), Neovim, Vim, Emacs, Sublime Text and Eclipse, and Helix supports it out of the box.

Best for: Anyone who wants ShellCheck warnings, formatting and navigation inside their usual editor.

Pricing:

• Free and open source (MIT)

Watch out for:

• The README asks for Node.js 20 or newer, which is an extra runtime on servers that only have a shell.
• Scope-aware jump to declaration and find references are still listed as not yet implemented.

Official site: Bash Language Server.

ShellHarden

ShellHarden starts where ShellCheck stops. ShellCheck tells you a variable needs quotes; ShellHarden adds them. By default it prints your script like cat with syntax colours and shows suggested additions in green and removals in red. Passing --transform applies them.

The tool is written in Rust and installed with cargo install shellharden or a distro package. Version 4.3.2 was published on crates.io on June 27, 2026, under the MPL-2.0. It is a fast way to bring an old script up to ShellCheck conformance before you fix the remaining warnings by hand.

Best for: Cleaning up quoting in legacy Bash scripts in bulk.

Pricing:

• Free and open source (MPL-2.0)

Watch out for:

• The README assumes the script does not depend on the unsafe behaviour it removes and says code review is on you. It focuses mainly on quoting, not on logic bugs.

Official site: ShellHarden.

checkbashisms

Debian's checkbashisms answers one question: will this /bin/sh script break on dash or another strict POSIX shell? It comes from a lintian check and ships in the devscripts package, which is at 2.26.13 in Debian unstable and testing.

The man page lists the useful switches. -p flags non-POSIX features that Debian Policy still allows, -n catches echo -n, and -x prints extra context to help spot false positives. ShellCheck covers similar ground when the shebang says sh, so this is a second opinion for packagers and anyone targeting minimal containers.

Best for: Debian packagers and container builders who must stay POSIX-clean.

Pricing:

• Free, part of Debian devscripts

Watch out for:

• The man page calls its checks basic. By default it skips scripts with a bash shebang unless you pass -f, and it permits extensions Debian Policy allows.

Official site: checkbashisms.

BashSupport Pro

BashSupport Pro is the only paid pick. It is a plugin for JetBrains IDEs such as IntelliJ IDEA, PyCharm, GoLand and CLion, and it bundles ShellCheck and shfmt, so you get both without installing them separately. It adds what free tools lack: a debugger built on bashdb and zshdb with conditional breakpoints, and a test runner for bats-core.

Zsh users get completion and docs for built-in variables and expansion flags. The pricing page sells personal licences at $39 for the first year, dropping to $31 and then $23, and organisation licences at $99, $79 and $59. A 30-day trial needs no registration.

Best for: Developers who already live in a JetBrains IDE and want to step through shell scripts.

Pricing:

• Individual: $39 first year, $31 second, $23 third (or $3.90, $3.10, $2.30 monthly)
• Organization: $99, $79, $59 per year (or $9.90, $7.90, $5.90 monthly)
• Perpetual fallback licence after 12 months of continuous subscription
• Free licences for open source and academic projects, on application

Watch out for:

• It runs in every JetBrains IDE except Air and the .NET products, per the home page, so Rider users are out.
• ShellCheck does not cover zsh, so the plugin shows fewer warnings in zsh files.

Official site: BashSupport Pro.

bashate

OpenStack wrote bashate as a pep8 for Bash, starting inside DevStack. It checks layout, not bugs: trailing whitespace, tab indents, indents that are not multiples of four, lines longer than 79 columns, and then or do placed on the wrong line. It also runs bash -n and flags deprecated syntax such as $[ arithmetic.

Install it with pip. The repository is Apache 2.0 and includes a pre-commit hook. Output follows the pycodestyle format, so it slots into CI that already parses Python lint results.

Best for: Python-heavy teams that want shell style rules reported like pep8.

Pricing:

• Free and open source (Apache 2.0)

Watch out for:

• The last PyPI release is 2.1.1 from October 6, 2022, so new Bash syntax may not be covered.
• Its rules come from OpenStack's own style, such as 4-space indents and a specific function declaration form, and some will clash with shfmt defaults.

Official site: bashate.

Bats-core

Linters read code; Bats runs it. Bats-core is a TAP-compliant testing framework for Bash 3.2 or later, where each test is a function marked with @test and a description. Version 1.14.0 was tagged on July 21, 2026, under the MIT licence.

A ShellCheck-clean script can still do the wrong thing. Bats lets you assert exit codes and output for each function, and TAP output plugs into most CI dashboards. It is also on npm as bats, per the bats-core README.

Best for: Teams that need proof a script behaves, not only that it looks safe.

Pricing:

• Free and open source (MIT)

Watch out for:

• It is not a linter and finds nothing until you write tests. It also needs Bash 3.2 or later, so pure sh environments still need ShellCheck or checkbashisms.

Official site: Bats-core.

How to choose

When to stay with ShellCheck

Keep ShellCheck as your main linter. Its numbered SC warnings, each with a wiki page, catch real bugs like unquoted expansions, broken tests and unused functions, and v0.11.0 added checks such as SC2329 for functions that are never called. Plugins exist for Vim, Emacs, Sublime and VS Code, per the README. Add shfmt for layout and Bats for behaviour rather than dropping it.

Frequently asked questions