View source for List of tools for static code analysis

{{Short description|None}}
<!--
EDITORS, PLEASE NOTE:

This article is covered under Wikipedia's [[Wikipedia:Manual of Style/Stand-alone lists|guidelines for standalone lists]]. This means that the only tools that should be listed here are ones that have their own articles on Wikipedia. This is not the place to have external links to a tool's homepage or anything like that. Tools that fail to meet this criteria (of having an article) may be deleted per our guidelines. If the tool has no article, consider [[WP:WTAF|writing one first]]. 
-->
This is a list of notable tools for [[static program analysis]] (program analysis is a synonym for code analysis).

== Static code analysis tools ==
<!--
This section includes anchors (the id attributes) for each tool. To reference a tool in this page, but from another section, avoid duplicating content by using [[#idForTool]] too link to this table.
Example: [[[#ConQAT]]

This section uses Wikidata on some entries to automatically update version numbers and release dates. On these entries please update these on it's Wikidata item.
-->
{{sticky header}} 
{| class="wikitable sortable sticky-header-multi" style="font-size:95%;" |
! width="120" rowspan="2" |Tool
! width="60"  rowspan="2" | Latest release
! rowspan="2" | [[Free software]]
! colspan="7" | [[Programming language|Supported languages]]
! rowspan="2" class="unsortable" | Notes
|-
![[Ada (programming language)|Ada]]
! width="100" | [[C (programming language)|C]], [[C++]], [[C Sharp (programming language)|C#]], {{nowrap|[[Objective-C]]}}
![[List of JVM languages|JVM]]
![[JavaScript]], [[TypeScript]]
![[.NET]], [[Visual Basic .NET|VB.NET]]
![[Python (programming language)|Python]]
! Other languages
|- id="Astree"
![[Astrée (static analysis)|Astrée]]
| 2024-10 (24.10)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Finds all potential runtime errors and data races by abstract interpretation, can prove their absence, and can prove functional assertions; tailored towards safety-critical C/C++ code (e.g. avionics and automotive). Includes [[Motor Industry Software Reliability Association|MISRA]] checker.
|-
![[Bauhaus Project (computing)|Axivion Suite]]
|2025-05-19
(7.10)
| {{No}}; proprietary
| {{sdash}}
|C, C++, C#
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
|QML, Axivion CUDA
|Static code analysis suite designed for safety-critical and security-focused software development with certification support for ISO 26262, IEC 61508, IEC 62304, EN 50128, and EN 50657. Comprehensive analysis includes coding standards compliance (MISRA C/C++, AUTOSAR, CERT, CWE), clone detection, dead code analysis, architecture verification, cycle detection, and metrics monitoring. Includes qualification kit for regulated environments such as automotive, aerospace, medical devices, and security applications.
|- id="BLAST"
![[BLAST model checker|BLAST]] (retired)
| 2015-10-30 (2.7.3)
| {{Yes}}; [[Apache License|ASL&nbsp;2]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source software model checker for C programs based on lazy abstraction (follow-on project is CPAchecker.<ref>{{cite web |url=http://cpachecker.sosy-lab.org/|title=CPAchecker|date=2015-02-08}}</ref>).
|- id="Clang"
![[Clang]]
| {{#time: Y-m-d|{{wikidata|qualifier|Q864915|P577|P348}}}} ({{wikidata|property|Q864915|P348}})
| {{Yes}}; [[Apache License|ASL&nbsp;2]] with LLVM Exceptions
| {{sdash}}
| C, C++, Objective-C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source compiler that includes a static analyzer. As of version 3.2, this analyzer is included in [[Xcode]].<ref>{{cite web |url=https://developer.apple.com/mac/library/featuredarticles/StaticAnalysis/ |title=Static Analysis in Xcode |publisher=Apple |access-date=2009-09-03 |url-status=dead |archive-date=2009-09-05 |archive-url=https://web.archive.org/web/20090905192610/http://developer.apple.com/mac/library/featuredarticles/StaticAnalysis/index.html}}</ref><ref>{{cite web |title=Running the analyzer within Xcode |url=https://clang-analyzer.llvm.org/xcode.html |access-date=14 January 2022 |archive-url=https://web.archive.org/web/20211205091824/https://clang-analyzer.llvm.org/xcode.html |archive-date=5 December 2021}}</ref>
|- id="Coccinelle"
![[Coccinelle (software)|Coccinelle]]
| 2021-09-06 (1.1.1)
| {{Yes}}; [[GNU General Public License|GPLv2]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source source code pattern matching and transformation.
|- id="Code Dx"
![[Code Dx]] (Defunct 2021)
| 2015-01-15
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#
| Java, [[JavaServer Pages|JSP]], [[Scala (programming language)|Scala]]
| JavaScript
| VB.NET
| Python
| PHP, Rails, Ruby, XML<ref>{{cite web|url=https://codedx.com/supported-tools/|work=codedx.com|access-date=Apr 25, 2017|title=Supported Application Security Testing Tools and Languages}}</ref>
| Software application vulnerability correlation and management system that uses multiple [[Static application security testing|SAST]] and [[Dynamic application security testing|DAST]] tools, as well as the results of manual code reviews. Can calculate cyclomatic complexity.
|- id="CodePeer"
![[CodePeer]]
| 2021-05-07 (21)
| {{No}}; proprietary
| Ada
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An advanced static analysis tool that detects potential run-time logic errors in Ada programs. 
|- id="CodeScene"
![[CodeScene]]
| 2023-10-13
(6.3.5)
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#, Objective-C
| Java, [[Apache Groovy|Groovy]], Scala
| JavaScript, TypeScript
| VB.NET
| Python 
| Swift, Go, PHP, Ruby
| Behavioral analysis of code. Helps identify, prioritize, and manage technical debt. Measures organizational aspects of developer teams.  Automated pull request integrations.
|- id="CodeQL"
![[CodeQL]]
| 2023-02-07 (CLI: 2.12.2)
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#
| Java, Kotlin
| JavaScript, TypeScript
| .NET
| Python
| Go, Ruby
| A code searching tool with an emphasis on finding software bugs. Search patterns are written in a query language which can search the AST and graphs (CFG, DFG, etc.) of supported languages. A plugin is available for Visual Studio.
|- id="ConQAT"
![[ConQAT]] (retired)
| 2015-02-01
| {{Yes}}; [[Apache License|ASL&nbsp;2]]
| Ada
| C#, C++
| Java
| JavaScript
| {{sdash}}
| {{sdash}}
| ABAP
| Continuous quality assessment toolkit that allows flexible configuration of quality analyses (architecture conformance, clone detection, quality metrics, etc.) and dashboards.
|- id="Coverity"
![[Coverity]]
| 2023-04-29 (2022.12)<ref>{{Cite web|url=https://scan.coverity.com|title=Coverity Scan website|access-date=2023-08-23}}</ref>
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#, Objective-C
| Java
| JavaScript, TypeScript
| {{sdash}}
| Python
| Ruby, PHP
| Multi-language tool for security and quality issues. Supports compliance standards ([[Motor Industry Software Reliability Association|MISRA]], [[ISO 26262]] and others). Free to use for open-source projects.
|- id="ECLAIR"
![[ECLAIR]]
| 2021-07-15 (3.11)<ref>{{Cite web|url=https://www.bugseng.com/eclair|title=ECLAIR website|access-date=2021-10-07}}</ref>
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Multi-language tool for software verification. Applications range from coding rule validation, to automatic generation of testcases, to the proof of absence of run-time errors or generation of counterexamples, and to the specification of code matchers and rewriters based both syntactic and semantic conditions. Supports compliance standards ([[Motor Industry Software Reliability Association|MISRA]], [[Embedded C Coding Standard]] and others).
|- id="CPAchecker"
![[CPAchecker]]
| 2022-01-24 (2.1.1)
| {{Yes}}; [[Apache License|ASL&nbsp;2]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A configurable software verification tool for execution path checking of C.
|- id="Cppcheck"
![[Cppcheck]]
| 2023-09-10 (2.12)
| {{yes}}; [[GNU General Public License|GPLv3]]
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Open-source tool that checks for several types of errors, including use of [[Standard Template Library|STL]]. MISRA support is being added.
|- id="Cppdepend"
![[Cppdepend]]
| 2023-03-01 (2023.1)<ref>{{cite web |title=CppDepend what's new |url=https://www.cppdepend.com/cppdepend-version-2023 |website=cppdepend.com |access-date=1 March 2023}}</ref>
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Simplifies managing a complex C/C++ code base by analyzing and visualizing code dependencies, by defining design rules, by doing [[Change impact analysis|impact analysis]], and comparing different versions of the code.
|- id="Cpplint"
![[Cpplint]]
| 2020-07-29
| {{Yes}}; [[Creative Commons license|CC-BY-3.0]]<ref>{{cite web |title=Readme.md of Google Style Guides |url=https://github.com/google/styleguide/blob/gh-pages/README.md |website=GitHub |access-date=8 November 2021}}</ref>
| {{sdash}}
| C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source tool that checks for compliance with Google's style guide for C++ coding.
|- id="Fluctuat"
![[Fluctuat]]
| 2001
| {{No}}; proprietary
| Ada95
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| [[Abstract interpretation|Abstract interpreter]] for the validation of numerical properties of programs.
|- id="Frama-C"
![[Frama-C]]
| 2022-06-21
| {{Yes}}; [[GNU Lesser General Public License|LGPL v2.1]], [[BSD licenses|BSD]], [[Q Public License|QPL]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source extensible analysis framework for C with several analyzers and a specification language common to all of them. Includes analyses based on [[abstract interpretation]], deductive verification and runtime monitoring.
|- id="CodeSonar"
![[GrammaTech]] [[CodeSonar]]
| 2020-06-01 (5.3)
| {{No}}; proprietary
| {{sdash}}
| C, C++, Objective-C
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Defect detection (buffer overruns, memory leaks, etc.), concurrency and security checks, architecture visualization and software metrics.
|- id="GCC"
![[GNU Compiler Collection|GCC]]
| 2023-4-26 (13.1)
|{{Yes}}; GPLv3+ with GCC Runtime Library Exception
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
|Compiling with {{nowrap|-fanalyzer}} flag (available from GCC 10) enables the static analyzer functionality<ref>{{Cite web |last=Malcolm |first=David |date=2020-03-26 |title=Static analysis in GCC 10 |url=https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10 |access-date=2022-04-13 |website=Red Hat Developer |language=en}}</ref>
|- id="Security AppScan"
![[Security AppScan|HCL Security AppScan]] Source
| 2020-12-01 (10.0.3) 
| {{No}}; proprietary
| {{sdash}}
| C, C++
| Java, JSP
| JavaScript
| .NET
| Python
| ColdFusion, ASP, PHP, Perl, Visual Basic 6, PL/SQL, T-SQL, COBOL
| Analyzes source code to identify security vulnerabilities while integrating security testing with software development processes and systems.
|- id="Helix QAC"
![[Helix QAC]]
| 2023-04 (2023.1)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Formerly PRQA QA·C and QA·C++, deep static analysis of C/C++ for quality assurance and guideline/coding standard enforcement with MISRA support.
|- id="Facebook Infer"
![[Infer Static Analyzer]]
| {{#time: Y-m-d|{{wikidata|qualifier|Q48996266|P348|P577}}}} ({{wikidata|property|Q48996266|P348}})
| {{Yes}}; [[MIT License|MIT]]
| {{sdash}}
| C, C++, Objective-C
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Targets null pointer problems, leaks, concurrency issues and API usage for Facebook's mobile apps. Available as open source on GitHub. Sometimes referred as Facebook Infer.
|- id="Imagix 4D"
![[Imagix 4D]]
| 2020-10-01 (10.1.0)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Windows and Linux versions.
|- id="Kiuwan"
![[Kiuwan]]
| 2020-07-22
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#, Objective-C
| Java, JSP
| JavaScript
| VB.NET
| {{sdash}}
| ABAP, COBOL, PHP, [[PL/SQL]], [[Transact-SQL|T-SQL]], SQL, Visual Basic, [[Android (operating system)|Android]]
| Software Analytics end-to-end platform for static code analysis and automated code review. It covers defect detection, application security & IT Risk Management, with enhanced life cycle and application governance features. Support for over 20 languages. 
|- id="Klocwork"
![[Klocwork]]
| 2023-04-04 (2023.1)
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#
| Java
| JavaScript
| {{sdash}}
| Python
| Kotlin
| Provides security vulnerability, standards compliance (MISRA, [[ISO 26262]] and others), defect detection and build-over-build trend analysis
|- id="LDRA Testbed"
![[LDRA Testbed]]
| 2021-05-07 (v9.8.6)
| {{No}}; proprietary
| Ada83, Ada95
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Assembler (Intel, Freescale, Texas Instruments)
| A software analysis and testing tool suite, that performs static analysis, standards enforcement (eg. MISRA C/C++), dynamic analysis, unit testing and requirements traceability.
|- id="Lint"
![[lint (software)|Lint]]
| 1978-07-26
| {{Yes}}; [[Permissive license|permissive]] [[BSD license|BSD-like]]<ref>{{cite web |url=http://www.lemis.com/grog/UNIX/|publisher=lemis.com |title=UNIX is free! |date=2002-01-24}}</ref>
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| The original, from 1978, static code analyzer for C.
|- id="MALPAS"
![[MALPAS Software Static Analysis Toolset|MALPAS]]
| 
| {{No}}; proprietary
| Ada
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Pascal, Assembler (Intel, PowerPC and Motorola)
| A software static analysis toolset for a variety of languages. Used primarily for safety critical applications in Nuclear and Aerospace industries.
|- id="Moose"
![[Moose (analysis)|Moose]]
| 2021-01-21 (7.0.3)
| {{Yes}}; [[MIT License|MIT]]
| {{sdash}}
| C, C++
| Java
| {{sdash}}
| .NET
| {{sdash}}
| Smalltalk
| Moose started as a software analysis platform with many tools to manipulate, assess or visualize software. It can evolve to a more generic data analysis platform.
|- id="NDepend"
![[NDepend]]
| 2022-03-16 (2022.1)<ref>{{cite web |title=NDepend what's new |url=https://www.ndepend.com/whatsnew |website=ndepend.com |access-date=15 June 2022}}</ref>
| {{No}}; proprietary
| {{sdash}}
| C# 
| {{sdash}}
| {{sdash}}
| VB.NET .NET
| {{sdash}}
| {{sdash}}
| Simplifies managing a complex .NET code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and by comparing different versions. Integrates into [[Visual Studio]].
|- id="NET Complier Platform"
![[.NET Compiler Platform]] (''Roslyn'')
| {{#time: Y-m-d|{{wikidata|qualifier|Q6840207|P348|P577}}}} ({{wikidata|property|Q6840207|P348}})
| {{Yes}}; [[MIT License|MIT]]
| {{sdash}}
| C#
| {{sdash}}
| {{sdash}}
| VB.NET
| {{sdash}}
| {{sdash}}
| Open-source compiler framework for [[C Sharp (programming language)|C#]] and [[Visual Basic .NET]] developed by [[Microsoft]] .NET. Provides an API for analyzing and manipulating syntax. [[FxCop]] rules were implemented into Roslyn.
|- id="Parasoft C/C++test"
![[Parasoft C/C++test]]
| 2024-12-03 (2024.2)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A C/C++ tool with AI that does static analysis, unit testing, code review, and runtime error detection along with enforcement of safety and security standards; plugins available for [[Visual Studio]], [[Visual Studio Code]] and [[Eclipse (software)|Eclipse]]-based IDEs as well as [[Github]] integration.
|- id="Parasoft Jtest"
![[Jtest|Parasoft Jtest]]
| 2024-12-03 (2024.2)
| {{No}}; proprietary
| {{sdash}}
| {{sdash}}
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A Java tool with AI that does static analysis and unit testing as well as enforcement of safety and security standards; plugins available for [[IntelliJ IDEA]], [[Visual Studio Code]] and [[Eclipse (software)|Eclipse]]-based IDEs as well as [[Github]] integration.
|- id="PC-lint Plus"
![[PC-Lint|PC-lint Plus]]
| 2022-08-02 (2.0 Beta 2)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A static analysis tool used to detect a wide range of defects, identify suspicious code, enforce various coding standards (MISRA/AUTOSAR/etc), calculate and report complex metrics, and implement user-defined checks.
|- id="PMD"
![[PMD (software)|PMD]]
| 2023-2-25 (6.55.0)
| {{Yes}}; BSD-like
| {{sdash}}
| C, C++
| Java, JSP
| JavaScript
| {{sdash}}
| {{sdash}}
| [[ColdFusion]], PHP
| [[duplicate code]] detection (e.g.)<ref>{{cite web|url=http://sourceforge.net/projects/pmd/files/pmd/5.0.0/|access-date=Dec 9, 2012|title=PMD - Browse /pmd/5.0.0 at SourceForge.net}}</ref> code.
|- id="Polyspace"
![[Polyspace]]
| 2022-09-15
| {{No}}; proprietary
| Ada
| C, C++
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Uses [[abstract interpretation]] to detect and prove the absence of certain [[run time (program lifecycle phase)|run time errors]] and dead code in source code as well as used to check all MISRA (2004, 2012) rules (directives, non directives).
|- id="Pretty Diff"
![[Pretty Diff]]
| {{#time: Y-m-d|{{wikidata|qualifier|Q7242217|P348|P577}}}} ({{wikidata|property|Q7242217|P348}})
| {{Yes}}; [[Creative Commons license#Zero / public domain|CC0]]
| {{sdash}}
| {{sdash}}
| {{sdash}}
| JavaScript, TypeScript
| {{sdash}}
| {{sdash}}
| Markup, script and style languages (like XML, CSS)
| A language-specific [[Comparison of file comparison tools|code comparison]] tool that features language-specific analysis reporting in addition to language-specific [[Minification (programming)|minification]] and [[Prettyprint|beautification]] algorithms.
|- id="PVS-Studio"
![[PVS-Studio]]
| {{#time: Y-m-d|{{wikidata|qualifier|Q7121140|P348|P577}}}} ({{wikidata|property|Q7121140|P348}})
| {{No}}; proprietary
| {{sdash}}
| C, C++, [[C++/CLI]], [[C++/CX]], C#
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A software analysis tool.
|- id="Qodana"
![[Qodana]]
| 2023-07-23 (2023.2)
| {{No}}; proprietary
| {{sdash}}
| C#
| Java, Kotlin
| JavaScript, TypeScript
| VB.NET
| Python
| Go, HTML, PHP, CSS, Android, Vue.js
| A code quality analysis tool that uses static code analysis.
|- id="RIPS"
![[RIPS]]
| 2020-02-17 (3.4)
| {{No}}; proprietary
| {{sdash}}
| {{sdash}}
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| PHP
| A static code analysis solution with many integration options for the automated detection of complex security vulnerabilities.
|- id="sastonline"
![[SAST Online]]
| 2022-03-07 (1.1.0)
| {{No}}; proprietary
| {{sdash}}
| {{sdash}}
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| [[Kotlin (programming language)|Kotlin]], [[Apk (file format)|APK]]
| Check the Android Source code thoroughly to uncover and address potential security concerns and vulnerabilities. Static application security testing (Static Code Analysis) tool Online
|- id="Semgrep"
![[Semgrep]]
| {{#time: Y-m-d|{{wikidata|qualifier|Q105563018|P348|P577}}}} ({{wikidata|property|Q105563018|P348}})
| {{Yes}}; [[GNU Lesser General Public License|LGPL v2.1]] 
| {{sdash}}
| {{sdash}}
| Java
| JavaScript, TypeScript
| {{sdash}}
| Python
| Go, [[JSON]], PHP, Ruby, language-agnostic mode
| A static analysis tool that helps expressing code standards and surfacing bugs early. It also has experimental support for eleven other languages. A CI service and a rule library is also available.
|- id="Sider"
![[Sider (Automated Code Review)|Sider]]
| 2021-02-02
| {{No}}; proprietary
| {{sdash}}
| {{sdash}}
| {{sdash}}
| JavaScript, CoffeeScript
| {{sdash}}
| Python
| Ruby, PHP, Go
| Static code analysis based automated code review tool working on GitHub and GitLab. Checks style, quality, dependencies, security and bugs. It integrates a number of open source static analysis tools.
|- id="SLAM project"
![[SLAM project]]
| 2010-07-14
| {{No}}; proprietary
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| A project of [[Microsoft Research]] for checking that software (drivers) satisfies critical behavioral properties of the interfaces it uses.
|- id="SofCheck Inspector"
![[SofCheck Inspector]], Codepeer
| 2020-08-24 (21.x)
| {{No}}; proprietary
| Ada
| {{sdash}}
| Java
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| Static detection of logic errors, [[race condition]]s, and [[redundant code]]. automatically extracts [[precondition|pre]]-[[postcondition]]s from code.
|- id="SonarQube"
![[SonarQube]]
| 2024-02-05 (10.4)
| {{Partial|Partly}}; framework is [[GNU Lesser General Public License|LGPL v3.0]], but some features can be proprietary
| {{sdash}}
| C, C#, C++, Objective-C
| Java, [[Kotlin (programming language)|Kotlin]], Scala
| JavaScript, TypeScript
| VB.NET
| Python
| ABAP, Apex, CSS, COBOL, Flex, Go, HTML, PHP, PLI, PL/SQL, Ruby, Swift, TSQL, Visual Basic 6, XML
| A continuous inspection engine that finds vulnerabilities, bugs and [[code smell]]s. Also tracks code complexity, unit test coverage and duplication. Offers branch analysis and C/C++/Objective-C support via commercial licenses.
|- id="SourceMeter"
![[SourceMeter]]
| 2016-12-16 (8.2)
| {{No}}; proprietary
| {{sdash}}
| C, C++
| Java
| {{sdash}}
| {{sdash}}
| Python
| RPG IV (AS/400)
| A platform-independent, command-line static source code analyzer. Integrates with [[PMD (software)|PMD]] and SpotBugs.
|- id="SourceTrail"
![[Sourcetrail]] (retired)
| 2021-04 (2021.4.19)
| {{Yes}}; [[GNU General Public License|GPL]]
| {{sdash}}
| C, C++
| Java
| {{sdash}}
| {{sdash}}
| Python
| Perl
| An open-source source code explorer that provides interactive dependency graphs and supports multiple programming languages.
|- id="Sparse"
![[Sparse]]
| 2021-09-06 (0.6.4)
| {{Yes}}; [[MIT License|MIT]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| GCC extensions
| An open-source tool designed to find faults in the [[Linux]] kernel.
|- id="Splint"
![[Splint (programming tool)|Splint]] 
| 2007-07-12 (3.1.2)
| {{Yes}}; [[GNU General Public License|GPLv2]]
| {{sdash}}
| C
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| An open-source tool statically checking C programs for security vulnerabilities and coding mistakes.
|- id="StyleCop"
![[StyleCop]]
| 2016-05-02 (2016.1.0)
| {{Yes}}; [[Shared Source Initiative#Microsoft Public License (Ms-PL)|Ms-PL]] 
| {{sdash}}
| C#
| {{sdash}}
| {{sdash}}
| .NET
| {{sdash}}
| {{sdash}}
| Analyzes C# source code to enforce a set of style and consistency rules. It can be run from inside of [[Microsoft Visual Studio]] or integrated into an [[MSBuild]] project.
|- id="Squore"
![[SQuORE|Squore]]
| 2020-11-27 (20.1)
| {{No}}; proprietary
| Ada
| C, C++, C#, Objective-C
| Java
| JavaScript, TypeScript
| VB.NET
| Python
| Fortran, PHP, PL/SQL, Swift, T-SQL, XAML
| A multi-purpose and multi-language monitoring tool for software projects. It integrates with other scanners.
|- id="Understand"
![[Understand (software)|Understand]]
| 2023-01-19 (6.3)
| {{No}}; proprietary
| Ada
| C, C++, C#, Objective-C
| Java
| JavaScript
| {{sdash}}
| Python
| FORTRAN, Jovial, Pascal, VHDL, HTML, PHP, XML
| A multi-platform tool for code analysis and comprehension of large code bases. Can recognize multiple dialects of C, C++ and C# like ANSI, K&R and Objective C++.
|- id="Visual Expert"
![[Visual Expert]]
|2021-09-10
| {{No}}; proprietary
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
|PowerBuilder, Oracle PL/SQL, SQL Server Transact-SQL (T-SQL)
|Continuous Code inspection, reports on quality and security issues, helps understand complex code (cross-references, source code documentation, code comparison, code performance analysis).
|- id="Visual Studio"
![[Visual Studio]]
| 2021-10-12 (16.11)
| {{No}}; proprietary
| {{sdash}}
| C, C++, C#
| {{sdash}}
| {{sdash}}
| {{sdash}}
| {{sdash}}
| VB.NET
| An IDE that provides static code analysis for C/C++ both in the editor environment and from the compiler command line. Also includes the .NET Compiler Platform (Roslyn) which provides C# and VB.NET analysis.
|- id="Yasca"
![[Yasca]] (retired)
| 2010-11-01 (2.21)
| {{Yes}}; multiple licenses
| {{sdash}}
| C, C++
| Java
| JavaScript
| {{sdash}}
| {{sdash}}
| ASP, PHP, HTML, CSS, ColdFusion, [[COBOL]]
| Yet Another Source Code Analyzer, a plugin-based framework to scan arbitrary file types, with plugins. It integrates with other scanners, including [[FindBugs]], [[PMD (software)|PMD]], and Pixy.
|-
! scope="col" | Tool
! scope="col" | Release
! scope="col" | Free software
! scope="col" colspan="7" | Supported languages
! scope="col" | Notes
|}

== Languages ==

=== [[Ada (programming language)|Ada]] ===
<!--
This section links to anchors in the main list in this article to decrease content duplication. Please consider adding notes into the main list and not here. To link from here, the tool in the main list needs to have an id.
-->
{{Hatnote|This section is a sublist. Links here will take you to the full list on the top of this article.|selfref=yes}}
* {{Pslink|CodePeer}}
* {{Pslink|ConQAT}}
* {{Pslink|Fluctuat}}
* {{Pslink|LDRA Testbed}}
* {{Pslink|MALPAS}}
* {{Pslink|Polyspace}}
* {{Pslink|SofCheck Inspector}}
* {{Pslink|Squore}}
* {{Pslink|Understand}}

=== [[C (programming language)|C]], [[C++]] ===
<!--
This section links to anchors in the main list in this article to decrease content duplication. Please consider adding notes into the main list and not here. To link from here, the tool in the main list needs to have an id.
-->
{{Hatnote|This section is a sublist. Links here will take you to the full list on the top of this article.|selfref=yes}}
* {{Pslink|Astree}}
* [[Bauhaus Project (computing)|Axivion Suite]] (Bauhaus)
* {{Pslink|BLAST}}
* {{Pslink|Clang}}
* {{Pslink|Coccinelle}}
* {{Pslink|Coverity}}
* {{Pslink|CPAchecker}}
* {{Pslink|Cppcheck}}
* {{Pslink|Cppdepend}}
* {{Pslink|Cpplint}}
* {{Pslink|ECLAIR}}
* {{Pslink|Eclipse}}
* {{Pslink|Fluctuat}}
* {{Pslink|Frama-C}}
* {{Pslink|GCC}}
* {{Pslink|Helix QAC}}
* {{Pslink|Facebook Infer}}
* {{Pslink|Klocwork}}
* {{Pslink|Lint}}
* {{Pslink|LDRA Testbed}}
* {{Pslink|Parasoft C/C++test}}
* {{Pslink|PC-lint Plus}}
* {{Pslink|Polyspace}}
* {{Pslink|PVS-Studio}}
* {{Pslink|SLAM project}}
* {{Pslink|Sparse}}
* {{Pslink|SonarQube}}
* {{Pslink|Splint}}
* {{Pslink|Understand}}
* {{Pslink|Visual Studio}}

=== [[C Sharp (programming language)|C#]] ===
<!--
This section links to anchors in the main list in this article to decrease content duplication. Please consider adding notes into the main list and not here. To link from here, the tool in the main list needs to have an id.
-->
{{Hatnote|This section is a sublist. Links here will take you to the full list on the top of this article.|selfref=yes}}
* [[Bauhaus Project (computing)|Axivion Suite]] (Bauhaus)
* {{Pslink|Code Dx}}
* {{Pslink|CodeScene}}
* {{Pslink|CodeQL}}
* {{Pslink|Coverity}}
* {{Pslink|Kiuwan}}
* {{Pslink|Klocwork}}
* {{Pslink|.NET Compiler Platform}}
* {{Pslink|PVS-Studio}}
* {{Pslink|SonarQube}}
* {{Pslink|Sotoarc}}
* {{Pslink|StyleCop}}
* {{Pslink|Squore}}
* {{Pslink|Understand}}
* {{Pslink|Visual Studio}}

=== [[IEC 61131-3]] ===
* CODESYS Static Analysis{{snd}} integrated add-on for [[CODESYS]] (application code realized e.g. in ST, FBD, LD)

=== [[Java (programming language)|Java]] ===
{| class="wikitable sortable"
! Tool
! width="60" | Latest release
! [[Free software|Free&nbsp;software]]
! [[Duplicate code|Duplicate<br />code]]
! Notes
|-
![[Checkstyle]]
| 2020-01-26
| {{yes}};&nbsp;[[GNU Lesser General Public License|LGPL]]
| {{No}}
| Besides some static code analysis, it can be used to show violations of a configured coding standard. Duplicate code detection was removed<ref>{{Cite web|url=https://github.com/checkstyle/checkstyle/issues/523|title=Remove StrictDuplicateCodeCheck and whole package · Issue #523 · checkstyle/Checkstyle|website=[[GitHub]]}}</ref> from Checkstyle.
|-
![[Eclipse (software)|Eclipse]]
| 2017-06-28
| {{yes}}; [[Eclipse Public License|EPL]]
| {{no}}
| Cross-platform IDE with own set of several hundred code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. Plugins for Checkstyle, FindBugs, and PMD.
|-
![[FindBugs]]
| 2015-03-06
| {{yes}}; [[GNU Lesser General Public License|LGPL]]
| 
| Based on [[Jakarta Project|Jakarta]] [[Byte Code Engineering Library|BCEL]] from the University of Maryland. [[SpotBugs]] is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community.
|-
![[IntelliJ IDEA]]
| 2021-04-06
| {{yes}}; [[Apache License|ASL&nbsp;2]]
| {{yes}}
| A leading Java IDE with built-in code inspection and analysis. Plugins for Checkstyle, FindBugs, and PMD.
|-
![[JArchitect]]
| 2017-06-11
| {{no}}; proprietary
| 
| Simplifies managing a complex code base by analyzing and visualizing code dependencies, defining design rules, doing impact analysis, and by comparing different versions of the code.
|-
![[Jtest]]
| 2024-11-01 (2024.2)
| {{no}}; proprietary
| {{yes}}
| Testing and static code analysis product by [[Parasoft]].
|-
![[Soot (software)|Soot]]
| 2020-10-28
| {{yes}}; [[GNU Lesser General Public License|LGPL]]
| 
| A language manipulation and optimization framework consisting of intermediate languages.
|-
![[PMD (software)|PMD]]
| 2021-01-30
| {{yes}}; [[BSD License]]
| {{yes}}
| Static code analyzer with support for plugins, including [[Copy/Paste Detector|CPD]].  PMD supports checking of several languages.
|-
![[Squale]]
| 2011-05-26
| {{yes}}; [[GNU Lesser General Public License|LGPL]]
| 
| A platform to manage software quality.
|-
![[ThreadSafe]]
| 2014-03-28
| {{no}}; proprietary
| 
| A static analysis tool focused on finding concurrency bugs.
|}
<!--
This section links to anchors in the main list in this article to decrease content duplication. Please consider adding notes into the main list and not here. To link from here, the tool in the main list needs to have an id.
-->
{{Hatnote|This section is a sublist. Links here will take you to the full list on the top of this article.|selfref=yes}}
* {{Pslink|Coverity}}
* {{Pslink|Facebook Infer}}
* {{Pslink|Klocwork}}
* {{Pslink|LDRA Testbed}}
* {{Pslink|PMD}}
* {{Pslink|RIPS}}
* {{Pslink|Semgrep}}
* {{Pslink|SourceMeter}}
* {{Pslink|Understand}}

=== [[JavaScript]] ===
* [[ESLint]]{{snd}} JavaScript [[syntax checker]] and formatter.
* [[Google Closure Tools#Closure Compiler|Google's Closure Compiler]]{{snd}} JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions.
* [[CodeScene]]{{snd}} Behavioral analysis of code.
* [[JSHint]]{{snd}} A community driven fork of JSLint.
* [[JSLint]]{{snd}} JavaScript syntax checker and validator.
* {{Pslink|Klocwork}}
* [[Semgrep]]{{snd}} A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
* {{Pslink|Understand}}

=== [[Objective-C]], Objective-C++ ===
* [[Clang]]{{snd}} The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in [[Xcode]].<ref>{{cite web | url=https://developer.apple.com/mac/library/featuredarticles/StaticAnalysis/index.html | title=Static Analysis in Xcode | publisher=Apple | access-date=2009-09-03}}</ref>
* [[Infer Static Analyzer|Infer]]{{snd}} Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github.
* {{Pslink|Understand}}

=== Opa ===
* [[Opa (programming language)|Opa]] includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as [[Cross-site scripting|XSS]] attacks and database code injections.

=== [[Package management system|Packaging]] ===
* [[Lintian]]{{snd}} Checks Debian software packages for common inconsistencies and errors.
* [[RPM Package Manager|Rpmlint]]{{snd}} Checks for common problems in rpm packages.

=== [[Perl]] ===
* [[Perl::Critic]]{{snd}} A tool to help enforce common Perl best practices. Most best practices are based on [[Damian Conway]]'s [[Perl Best Practices]] book.
* [[PerlTidy]]{{snd}} Program that acts as a [[syntax checker]] and tester/enforcer for coding practices in Perl.
* [[Padre (software)|Padre]]{{snd}} An IDE for Perl that also provides static code analysis to check for common beginner errors.

=== [[PL/SQL]] ===
* [[TOAD]]{{snd}} A PL/SQL development environment with a Code xPert component that reports on general code efficiency as well as specific programming issues.
* [[Visual Expert]]{{snd}} A PL/SQL [[static program analysis|code analysis]] tool<ref>{{Cite web|url=http://www.visual-expert.com/EN/stored-procedure-pl-sql-oracle-plsql/code-function-analysis-impact-source_wpcodeanalysis.html|title=Visual Expert for Oracle - PL/SQL Code Analyzer|date=2017-08-24|website=www.visual-expert.com}}</ref> that reports on programming issues and helps understand and maintain complex code ([[Change impact analysis|Impact Analysis]], [[Software documentation|Source Code documentation]], [[Call graph|Call trees]], [[Create, read, update and delete|CRUD matrix]], etc.).

=== [[PowerBuilder]], PowerScript ===
* [[Visual Expert]]{{snd}} A tool scanning PowerBuilder libraries (PBLs) for [[Software inspection|code inspection]], [[Change impact analysis|Impact Analysis]], [[Software documentation|Source Code documentation]], [[Call graph|Call trees]], [[Create, read, update and delete|CRUD matrix]].

=== [[Python (programming language)|Python]] ===
* [[PyCharm]]{{snd}} Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project.
* [[PyDev]]{{snd}} Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time.
* [[Pylint]]{{snd}} Static code analyzer. Quite stringent; includes many stylistic warnings as well.
* {{Pslink|Klocwork}}
* [[Semgrep]]{{snd}} Static code analyzer that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
* {{Pslink|Understand}}

=== [[Transact-SQL]] ===
* [[Visual Expert]]{{snd}} A SQLServer [[static program analysis|code analysis]] tool<ref>{{Cite web|url=http://www.visual-expert.com/EN/stored-procedure-t-sql-server-mssql-tsql/sqlserver-code-function-impact-analysis-source_wpcodeanalysis.html|title=Visual Expert for SQL Server - Transact SQL Code Analyzer|date=2017-08-24|website=www.visual-expert.com}}</ref> that reports on programming issues and helps understand and maintain complex code (Impact Analysis, source code documentation, call trees, CRUD matrix, etc.).

== Tools with duplicate code detection ==
<!--
This section links to anchors in the main list in this article to decrease content duplication. Please consider adding notes into the main list and not here. To link from here, the tool in the main list needs to have an id.
-->
{{Broader|selfref=yes|Duplicate code}}
{{Hatnote|This section is a sublist. Links here will take you to the full list on the top of this article.|selfref=yes}}
* [[Bauhaus Project (computing)|Axivion Suite]] (Bauhaus)
* {{Pslink|Code Dx}}
* {{Pslink|CodeScene}}
* {{Pslink|PMD}}
* {{Pslink|SofCheck Inspector}}
* {{Pslink|SonarQube}}
* {{Pslink|SourceMeter}}
* {{Pslink|Understand}}

== Formal methods tools ==
Tools that use [[Soundness|sound]], i.e. over-approximating a rigorous model, [[formal methods]] approach to static analysis (e.g., using static [[assertion (computing)|program assertions]]). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report '''all''' bugs for buggy programs, they will report at least one.

* [[Astrée (static analysis)|Astrée]]{{snd}} finds all potential [[runtime errors]] by [[abstract interpretation]], can prove the absence of runtime errors and can prove functional assertions; tailored towards safety-critical C code (e.g. avionics).
* [[CodePeer]]{{snd}} Statically determines and documents [[precondition|pre]]- and [[postcondition|post-condition]]s for [[Ada (programming language)|Ada]] subprograms; statically checks preconditions at all call sites.
* [[ECLAIR]]{{snd}} Uses formal methods-based static code analysis techniques such as abstract interpretation and [[model checking]] combined with [[constraint satisfaction]] techniques to detect or prove the absence of certain [[run time (program lifecycle phase)|run time errors]] in [[source code]].
* [[ESC/Java]] and [[ESC/Java2]]{{snd}} Based on [[Java Modeling Language]], an enriched version of Java
* [[Frama-C]]{{snd}} An open-source analysis framework for C, based on the [[ANSI/ISO C Specification Language]] (ACSL). Its main techniques include abstract interpretation, [[Predicate transformer semantics|deductive verification]] and [[Runtime verification|runtime monitoring]].
* [[KeY]]{{snd}} analysis platform for Java based on [[proof assistant|theorem proving]] with specifications in the Java Modeling Language; can generate [[unit test|test cases]] as counterexamples; stand-alone GUI or [[Eclipse (software)|Eclipse]] integration
* [[MALPAS Software Static Analysis Toolset|MALPAS]]{{snd}} A formal methods tool that uses [[Graph (discrete mathematics)|directed graphs]] and [[regular algebra]] to prove that software under analysis correctly meets its mathematical specification.
* [[Polyspace]]{{snd}} Uses abstract interpretation, a formal methods based technique,<ref>{{cite book |chapter=The Role of Abstract Interpretation in Formal Methods |first=Patrick |last=Cousot |title=Fifth IEEE International Conference on Software Engineering and Formal Methods (SEFM 2007) |pages=135–140 |year=2007 |publisher=IEEE International Conference on Software Engineering and Formal Methods |doi=10.1109/SEFM.2007.42 |isbn=978-0-7695-2884-7 |s2cid=67212 }}</ref> to detect and prove the absence of certain [[run time (program lifecycle phase)|run time errors]] in source code for C/C++, and Ada
* [[SPARK Toolset]] including the [[SPARK Examiner]]{{snd}} Based on the SPARK language, a subset of Ada.

== See also ==
* [[Automated code review]]
* [[Coding best practices|Best Coding Practices]]
* [[List of software development philosophies]]
* [[Dynamic program analysis]]
* [[Software metric]]s
* [[Integrated development environment]] (IDE) and [[comparison of integrated development environments]]. IDEs will usually come with built-in support for static program analysis, or with an option to integrate such support. [[Eclipse (software)|Eclipse]] offers such integration mechanism for most different types of extensions (plug-ins).

== References ==
{{reflist}}

== External links ==
* [http://projects.webappsec.org/w/page/61622133/StaticCodeAnalysisList The Web Application Security Consortium's Static Code Analysis Tool List]
* [http://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html SAMATE-Source Code Security Analyzers]
* [http://samate.nist.gov/SATE.html SATE{{snd}} Static Analysis Tool Exposition]
* [http://www.cs.umd.edu/~jfoster/papers/issre04.pdf "A Comparison of Bug Finding Tools for Java"], by Nick Rutar, Christian Almazan, and Jeff Foster, [[University of Maryland, College Park|University of Maryland]].  Compares Bandera, [[ESC/Java]] 2, [[FindBugs]], JLint, and PMD.
* [http://www.oreillynet.com/digitalmedia/blog/2004/03/minireview_of_java_bug_finders.html "Mini-review of Java Bug Finders"], by Rick Jelliffe, [[O'Reilly Media]].

[[Category:Static program analysis tools| ]]
[[Category:Lists of software|Static code analysis]]