6 min read

Rust/Go Leverage in PHP

In the previous post we looked at how Rust's speed of static analysis opened the door for non-PHP languages to analyze PHP codebases.

What influence did it bring upon the PHP world? How can we - PHP devs - leverage it for our own profit?

Mago made PHPStan faster

Mago 1.0 was released in December 2025. Until then, speed was not a priority for static analyzers. Correctness was: how accurate the analysis is and how much broken code it can spot in CI. Mago changed this. Well, seeing a project run 50x faster than the fastest monopoly on the market does that.

We love healthy competition, the same way we're happy to see Anthropic and OpenAI compete for our subscriptions with lower prices.

PHPStan jumped on the train, put agents to work and managed to speed up 3x in 2026 alone. I didn't have any real numbers, apart from a few tweets here and there, but Ondra wrote a blog post with the speed-up improvements since December 2025 until October 2026.

You may say "from 60 s to 20 s is still incomparable to 2 s of Mago", and you'd be right.

But instead of absolute data, let's focus on the vector direction. Mago was fast from the start and cannot run much faster (there is no need to; 1-2 s is not a weak spot). PHPStan, on the other hand, was always blocking CI pipelines, requiring splitting into multiple directories and skip paths. Not anymore. If you use PHPStan on PHP 7.4+, update to version 2.3 and profit.

Independent Benchmarks

On a side note, can we trust these benchmarks? We've seen way too many of them thanks to agentic scoring, where somehow the author's tool is always the winner.

"I don't trust benchmarks I haven't forged myself"

Locally, with 24 or 32 cores, most results are somewhat fast. Though 30-120 seconds is still a pain to sit through for us, and especially for agents. The CI is the blocker, along with laptops with 4-8 cores. Yes, not everyone in the world has the latest Macbook M5. So to be sure we see real numbers, I made a small open-source repository:

  • the benchmark runs in GitHub Actions CI - a reproducible environment with a capped CPU count
  • it runs on various PHP versions, like the real world
  • it runs various tools I don't own
  • anyone can contribute

It also has a CI check that makes sure the latest version is benchmarked. This avoids the "old version is slow" fallacy we often see with static blog posts.


Check it here: Need for Speed


Screenshot from today.


Game is on! Mago's speed was just cut in half in the past week. This is only the beginning. By the end of 2026, we'll see PHPStan running 2x faster than today.

"I don't know any Rust nor Go"

"This is all nice, Tomas, but not for me. I'm only a passive end-user of these tools. Install, run it and forget. How is this useful in a deeper way?"

If that's the case, I'm with you. I had this view in July 2026, when I was envious of people who knew Rust - that they could look into Mago, improve it, or build their own tiny tool doing something similar. Like we do with php-parser when we need to get the job done fast.

But...! We don't need to know the language anymore.

Zero + agents = Hero

If you're a fan of Rust but never wrote a line, give it a go. Mago has a crate for PHP parsing (something like a monorepo split package) that you can use. Me, I want to experiment fast without depending on someone else's speed. Also, I kinda fell in love with Go's simple syntax and philosophy.

Here is my experience: after learning a bit of Go syntax and philosophy this summer, I gave agentic development a Go (pun intended):

  • Command line,
  • parse file,
  • change return type declaration to array,
  • and print the file back.

In the last post, we looked at z7zmey/php-parser - a PHP parser written in 2018, but abandoned in 2020. It could not parse PHP 8 and was not maintained.

Could agents help?

  • "Hey, take this repository and add PHP 8.0-8.5 compatibility, test it, allow parsing of any PHP on the input."

I didn't want to embarrass myself by publishing crappy slop, so I made the fork private. First I wanted to run it on a real project - legacy, with PHP 5.6 or 7.2, where neither PHPStan nor Rector can run - and see real results merged and shipped. Proof over hype.

Real Results on Real Projects

Anyone can run a tool fast on this or that slim open-source project. Open-source projects are tiny, specialized and typically run on the latest PHP. The total opposite of any private PHP project I've seen (or made). E.g. Laravel 13 has around 270 000 loc.

  • at least 500 000 loc,
  • not the latest modern PHP
  • not made in the past 5 years by a team of well-funded senior developers

I gave it a go and... it worked! Where Rector would have to run in Docker for 20+ mins, or with features frozen in a 2020 version, I could now run any Reco (code name) rule in a couple of seconds.

To be clear, under 1 second.

How about Rust? I still wasn't sure whether to double down on Golang, so I implemented a similar task in Rust. After all, if Go were ~10 seconds and Rust ~1 s on a legacy project, Rust would be the clear winner to lean towards.

To my surprise, both were under 1s. When speed is the same, simplicity wins.

Under 1s Club

This is a new baseline. With speed like this on a whole (legacy!) codebase, you can just do stuff.

Like run 100 rules, 1 rule changes = 1 commit. 20 commits...? = 20 seconds.

Just Build Things

It's been 3 months and Reco has over 100 rules now. Reco is still exclusive to my clients, but you can take the Mago crate and make the tool you want to see run really fast.

If you prefer Go, I made the improved fork available as PHP Parser in Go. Full PHP 5, 7 and 8 support, no requirements. Runs on any code, use at your own risk.


I'm walking the talk: building a static analysis tool and... a coding standard tool.

Why is Go/Rust tooling useful when it comes to dependencies? Why do agents prefer it to PHP tooling? What to be aware of when rewriting a PHP tool to Go/Rust? You'll see in the next post.


Happy coding!