Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Static Code Analysis

Check Python types without executing the project

ty-check is an offline Python type-checking node using ty.

Agent
Check return annotationsFind argument mismatchesTarget a Python version

overview

What ty-check does

Type-check Python source with Astral ty and emit diagnostics as GitLab Code Quality JSON. Static analysis only; no code is executed and no packages are installed.

Return GitLab Code Quality JSON with check_name, description, severity, fingerprint and line-column locations. A clean check returns an empty array. Type findings are successful data through --exit-zero; configuration or runtime failures produce no output.

Repository pyproject.toml tool.ty settings and ty.toml are respected; the optional python-version input overrides the configured target. The image has no Python interpreter or installed project dependencies. Bundled typeshed covers the standard library; third-party imports can be unresolved. Source is neither executed nor modified.

Packaged version: 0.0.84. Upstream license: MIT. The ty release repository points to the linked Ruff commit for its Rust compiler source.

source github.com/astral-sh/ruff/tree/11aaa39f84c0c44bdfb4c9cc21e4038c6f74c00a

use cases

Where ty-check fits

Check return annotations

Locate return values that conflict with declared types.

Find argument mismatches

Report incompatible argument types at their source positions.

Target a Python version

Use the python-version port to override the repository target.

reference

ty-check inputs and flags

2 inputs
NameTypeFlagDescription
sourceFOLDER--sourceFolder of Python source, optionally with pyproject.toml [tool.ty] or ty.toml. Third-party packages are not installed, so their imports report unresolved-import.
python-versionSTRING--python-versionOptional target Python version such as 3.12; defaults to project config or ty's default.

Showing key inputs. ty-check exposes 2 inputs in total.

example

Run ty-check

ty-check · command
/app/run.sh --source ./source --python-version 3.12 ./output

guidance

Choosing ty-check

Use ty-check to investigate Python type mismatches. Ruff lint rules and Black formatting answer different questions. This pre-1.0 compiler can change diagnostic coverage between releases; the packaged release is ty 0.0.84.

faq

ty-check questions

source: Folder of Python source, optionally with pyproject.toml [tool.ty] or ty.toml. Third-party packages are not installed, so their imports report unresolved-import. python-version: Optional target Python version such as 3.12; defaults to project config or ty's default.

Return GitLab Code Quality JSON with check_name, description, severity, fingerprint and line-column locations. A clean check returns an empty array. Type findings are successful data through --exit-zero; configuration or runtime failures produce no output.

Repository pyproject.toml tool.ty settings and ty.toml are respected; the optional python-version input overrides the configured target. The image has no Python interpreter or installed project dependencies. Bundled typeshed covers the standard library; third-party imports can be unresolved. Source is neither executed nor modified.

Use ty-check to investigate Python type mismatches. Ruff lint rules and Black formatting answer different questions. This pre-1.0 compiler can change diagnostic coverage between releases; the packaged release is ty 0.0.84.

The public image repository gives immutable image and ORAS download commands, the expected source/notices bundle checksum and pinned upstream source directions. The accompanying OCI bundle retains the original build recipe, runtime sources and full installed notices. The Git recipe keeps primary notices and an exact layer/hash index; it does not duplicate the full installed notice tree or mirror every upstream source archive. Image, source and license notice downloads.

related

More Static Code Analysis tools

  1. bandit

    Python source in, JSON security findings out.

  2. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  3. gosec

    Go AST security scanner for credentials, crypto, and injection.

  4. guarddog

    A package coordinate in, indicator hits out.

  5. malcontent-scan

    A package coordinate in, behavior findings out.

  6. osv-malicious

    A package coordinate in, malware advisory rows out.

Run ty-check yourself

The saved synthetic verifier confirmed invalid-return-type at line 2 and invalid-argument-type at line 4 in typed.py. These are verifier-confirmed locations, not a retained complete native diagnostics array. The command shows the container entrypoint with example paths.

Open ty-check in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.