-
🌎 Astrée :copyright: — Astrée automatically proves the absence of runtime errors and invalid concurrent behavior in C/C++ applications. It is sound for floating-point computations, very fast, and exceptionally precise. The analyzer also checks for MISRA/CERT/CWE/Adaptive Autosar coding rules and supports qualification for ISO 26262, DO-178C level A, and other safety standards. Jenkins and Eclipse plugins are available.
-
CBMC — Bounded model-checker for C programs, user-defined assertions, standard assertions, several coverage metric analyses.
-
🌎 clang-tidy — Clang-based C++ linter tool with the (limited) ability to fix issues, too.
-
742⭐ 97🍴 clazy) — Qt-oriented static code analyzer based on the Clang framework. clazy is a compiler plugin which allows clang to understand Qt semantics. You get more than 50 Qt related compiler warnings, ranging from unneeded memory allocations to misusage of API, including fix-its for automatic refactoring.
-
80⭐ 28🍴 CMetrics) — Measures size and complexity for C files.
-
🌎 CPAchecker — A tool for configurable software verification of C programs. The name CPAchecker was chosen to reflect that the tool is based on the CPA concepts and is used for checking software programs.
-
🌎 cppcheck — Static analysis of C/C++ code.
-
🌎 CppDepend :copyright: — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity.
-
1831⭐ 307🍴 cpplint) — Automated C++ checker that follows Google's style guide.
-
69⭐ 11🍴 cqmetrics) — Quality metrics for C code.
-
🌎 CScout — Complexity and quality metrics for C and C preprocessor code.
-
ENRE-cpp :warning: — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-cpp is a ENtity Relationship Extractor for C/C++ based on @eclipse/CDT. (Under development)
-
ESBMC — ESBMC is an open source, permissively licensed, context-bounded model checker based on satisfiability modulo theories for the verification of single- and multi-threaded C/C++ programs.
-
flawfinder — Finds possible security weaknesses.
-
flint++ :warning: — Cross-platform, zero-dependency port of flint, a lint program for C++ developed and used at Facebook.
-
🌎 Frama-C — A sound and extensible static analyzer for C code.
-
🌎 GCC — The GCC compiler has static analysis capabilities since version 10. This option is only available if GCC was configured with analyzer support enabled. It can also output its diagnostics to a JSON file in the SARIF format (from v13).
-
🌎 Goblint — A static analyzer for the analysis of multi-threaded C programs. Its primary focus is the detection of data races, but it also reports other runtime errors, such as buffer overflows and null-pointer dereferences.
-
🌎 Helix QAC :copyright: — Enterprise-grade static analysis for embedded software. Supports MISRA, CERT, and AUTOSAR coding standards.
-
3158⭐ 218🍴 IKOS) — A sound static analyzer for C/C++ code based on LLVM.
-
KLEE — A dynamic symbolic execution engine built on top of the LLVM compiler infrastructure. It can auto-generate test cases for programs such that the test cases exercise as much of the program as possible.
-
🌎 LDRA :copyright: — A tool suite including static analysis (TBVISION) to various standards including MISRA C & C++, JSF++ AV, CWE, CERT C, CERT C++ & Custom Rules.
-
MATE :warning: — A suite of tools for interactive program analysis with a focus on hunting for bugs in C and C++ code. MATE unifies application-specific and low-level vulnerability analysis using code property graphs (CPGs), enabling the discovery of highly application-specific vulnerabilities that depend on both implementation details and the high-level semantics of target C/C++ programs.
-
🌎 PC-lint :copyright: — Static analysis for C/C++. Runs natively under Windows/Linux/MacOS. Analyzes code for virtually any platform, supporting C11/C18 and C++17.
-
🌎 Phasar — A LLVM-based static analysis framework which comes with a taint and type state analysis.
-
🌎 Polyspace Bug Finder :copyright: — Identifies run-time errors, concurrency issues, security vulnerabilities, and other defects in C and C++ embedded software.
-
🌎 Polyspace Code Prover :copyright: — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array acce
