Mypy | Stack | Fluid Attacks Help

Mypy

Rationale

We use Mypy as the main static type checker for Python source code. Mypy:
  1. Is an old-school Python type checker, which means it has many rules implemented and has been thoroughly tested
  2. Is open source
  3. Has a huge number of typing checks
  4. Supports caching already-reviewed files for performance
  5. Does not provide a language server out of the box, considerably affecting development experience
  6. Integrates in-editor typing using its VS Code extension for development experience
  7. As it is built in Python, it has serious performance limitations

Alternatives

Below are alternatives we are currently considering as possible replacements to Mypy.

Ty

  1. Ty is a static type checker developed by Astral, creators of uv and Ruff; it is still under development
  2. Is open source
  3. Does not have as many typing checks as Mypy
  4. Although it currently does not support caching, it is still much faster compared to Mypy
  5. Provides a language server out of the box, considerably improving development experience
  6. Integrates in-editor typing using its VS Code extension for development experience
  7. As it is built in Rust, it is considerably faster compared to other type checkers, up to a point where performance is no longer a concern
Note on Prospector last review date
Ty was last reviewed on Aug 1, 2025.

Pyright

  1. Pyright is a static type checker developed by Microsoft; after Mypy, it is the most widely-used type checker and is production-ready
  2. Is open source
  3. Is very close to Mypy, maybe even ahead, in terms of typing checks
  4. Although it currently does not support caching, it is still much faster compared to Mypy
  5. Provides a language server out of the box, considerably improving development experience
  6. Integrates in-editor typing using its VS Code extension for development experience
  7. As it is built in TypeScript, it is faster than Mypy, but still slower than Rust-based ones
Note on Black last review date
Pyright was last reviewed on Aug 1, 2025.

Pyrefly

  1. Pyrefly is a static type checker developed by Meta; it is still under development
  2. Is open source
  3. Does not have as many typing checks as Mypy
  4. Although it currently does not support caching, it is still much faster compared to Mypy
  5. Provides a language server out of the box, considerably improving development experience
  6. Integrates in-editor typing using its VS Code extension for development experience
  7. As it is built in Rust, it is considerably faster compared to other type checkers, up to a point where performance is no longer a concern
Note on SonarQube last review date
Pyrefly was last reviewed on Aug 1, 2025.

Usage

We use Mypy to enforce strict static type checking on all of Fluid Attacks' Python source code.