How Rust and Go Are Revolutionizing PHP Static Analysis

The article examines the impact of Rust and Go on PHP static analysis tooling, focusing on two major developments: the Rust-based analyzer Mago and a custom Go-based PHP parser called Reco.

Mago Accelerates PHPStan

Mago 1.0 was released in December 2025. Unlike traditional static analyzers where correctness was the primary concern, Mago introduced extreme speed — 50 times faster than the fastest existing competitor . This competitive pressure prompted PHPStan to respond, achieving a 3x speed improvement throughout 2026 (from December 2025 to October 2026). Ondra detailed the speed improvements in a blog post covering this period. The author notes that while PHPStan reduced analysis time from 60 seconds to 20 seconds , Mago still completes in 2 seconds . For PHP 7.4+ users, updating to PHPStan 2.3 delivers a significantly smoother CI experience.

Independent Benchmarking

To avoid biased benchmarks, the author created an open-source benchmark repository that runs on GitHub Actions CI with constrained CPU, tests across multiple PHP versions, includes tools the author doesn't own, and accepts community contributions. This ensures reproducible, up-to-date results and avoids the "old version is slow" fallacy common in static blog posts. Recent benchmark data shows Mago's speed halved in just one week , and the author predicts PHPStan will double its speed again by end of 2026.

Building Custom Parsers Without Knowing Rust or Go

The author, initially envious of Rust developers who could contribute to Mago, discovered that AI agents can now write Rust/Go code on behalf of PHP developers. After learning basic Go syntax over the summer, the author used an agent to build a command-line tool that parses PHP files, modifies return type declarations to arrays, and prints the result.

The experiment started with z7zmey/php-parser, a PHP parser written in Go in 2018 but unmaintained since 2020 and unable to parse PHP 8. The agent was tasked with adding PHP 8.0–8.5 compatibility and ensuring it could parse any PHP input. The author kept the fork private initially, wanting to test on a real legacy project (PHP 5.6/7.2, 500k+ LOC ) where PHPStan and Rector failed or took 20+ minutes in Docker .

Real-World Results on Legacy Codebase

The Go-based parser (codenamed Reco) succeeded: rules that previously required 20+ minutes now run in under 1 second . The author also implemented the same task in Rust for comparison; both languages completed in under 1 second , leading to the conclusion that when speed is equal, the simpler approach (Go) wins.

The "Under 1 Second" Club

Achieving sub-second analysis across an entire legacy codebase enables new workflows: running 100 rules with 1 rule change = 1 commit = ~1 second each, so 20 commits take ~20 seconds. Over three months, Reco grew to over 100 rules. While Reco remains private for clients, the author offers the Mago toolkit for similar speedups and has released the improved Go PHP parser (supporting PHP 5, 7, 8 with zero dependencies) for public use at own risk.

The article concludes by teasing a follow-up covering why Go/Rust tools excel at dependency management, why agents prefer them over PHP tools, and pitfalls when rewriting PHP tools in Go/Rust.

Reference:

https://tomasvotruba.com/blog/rust-go-leverage-in-php