This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis).
| Tool | Latest release | Free software | Supported languages | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Ada | C, C++, C#, Objective-C | JVM | JavaScript, TypeScript | .NET, VB.NET | Python | Other languages | ||||
| Astrée | 2024-10 (24.10) | No; proprietary | — | C, C++ | — | — | — | — | — | Finds all potential runtime errors and data races by abstract interpretation, can prove their absence, and can prove functional assertions; tailored towards safety-critical C/C++ code (e.g. avionics and automotive). Includes MISRA checker. |
| Axivion Suite | 2024-11-18 (7.9) | No; proprietary | — | C, C++, C# | — | — | — | — | — | Automated analysis to identify violations of coding guidelines like MISRA C and detect clones, dead code, and security vulnerabilities. Key features include coding standards compliance checking, metric monitoring, defect analysis, and certification for safety-critical software development. |
| BLAST (retired) | 2015-10-30 (2.7.3) | Yes; ASL 2 | — | C | — | — | — | — | — | An open-source software model checker for C programs based on lazy abstraction (follow-on project is CPAchecker. [1] ). |
| Clang | 2025-02-24 (19.1.7) | Yes; ASL 2 with LLVM Exceptions | — | C, C++, Objective-C | — | — | — | — | — | An open-source compiler that includes a static analyzer. As of version 3.2, this analyzer is included in Xcode. [2] [3] |
| Coccinelle | 2021-09-06 (1.1.1) | Yes; GPLv2 | — | C | — | — | — | — | — | An open-source source code pattern matching and transformation. |
| Code Dx (Defunct 2021) | 2015-01-15 | No; proprietary | — | C, C++, C# | Java, JSP, Scala | JavaScript | VB.NET | Python | PHP, Rails, Ruby, XML [4] | Software application vulnerability correlation and management system that uses multiple SAST and DAST tools, as well as the results of manual code reviews. Can calculate cyclomatic complexity. |
| CodePeer | 2021-05-07 (21) | No; proprietary | Ada | — | — | — | — | — | — | An advanced static analysis tool that detects potential run-time logic errors in Ada programs. |
| CodeScene | 2023-10-13 (6.3.5) | No; proprietary | — | C, C++, C#, Objective-C | Java, Groovy, Scala | JavaScript, TypeScript | VB.NET | Python | Swift, Go, PHP, Ruby | Behavioral analysis of code. Helps identify, prioritize, and manage technical debt. Measures organizational aspects of developer teams. Automated pull request integrations. |
| CodeQL | 2023-02-07 (CLI: 2.12.2) | No; proprietary | — | C, C++, C# | Java, Kotlin | JavaScript, TypeScript | .NET | Python | Go, Ruby | A code searching tool with an emphasis on finding software bugs. Search patterns are written in a query language which can search the AST and graphs (CFG, DFG, etc.) of supported languages. A plugin is available for Visual Studio. |
| ConQAT (retired) | 2015-02-01 | Yes; ASL 2 | Ada | C#, C++ | Java | JavaScript | — | — | ABAP | Continuous quality assessment toolkit that allows flexible configuration of quality analyses (architecture conformance, clone detection, quality metrics, etc.) and dashboards. |
| Coverity | 2023-04-29 (2022.12) [5] | No; proprietary | — | C, C++, C#, Objective-C | Java | JavaScript, TypeScript | — | Python | Ruby, PHP | Multi-language tool for security and quality issues. Supports compliance standards (MISRA, ISO 26262 and others). Free to use for open-source projects. |
| ECLAIR | 2021-07-15 (3.11) [6] | No; proprietary | — | C, C++ | — | — | — | — | — | Multi-language tool for software verification. Applications range from coding rule validation, to automatic generation of testcases, to the proof of absence of run-time errors or generation of counterexamples, and to the specification of code matchers and rewriters based both syntactic and semantic conditions. Supports compliance standards (MISRA, Embedded C Coding Standard and others). |
| CPAchecker | 2022-01-24 (2.1.1) | Yes; ASL 2 | — | C | — | — | — | — | — | A configurable software verification tool for execution path checking of C. |
| Cppcheck | 2023-09-10 (2.12) | Yes; GPLv3 | — | C, C++ | — | — | — | — | — | Open-source tool that checks for several types of errors, including use of STL. MISRA support is being added. |
| Cppdepend | 2023-03-01 (2023.1) [7] | No; proprietary | — | C, C++ | — | — | — | — | — | Simplifies managing a complex C/C++ code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and comparing different versions of the code. |
| Cpplint | 2020-07-29 | Yes; CC-BY-3.0 [8] | — | C++ | — | — | — | — | — | An open-source tool that checks for compliance with Google's style guide for C++ coding. |
| Fluctuat | 2001 | No; proprietary | Ada95 | C | — | — | — | — | — | Abstract interpreter for the validation of numerical properties of programs. |
| Frama-C | 2022-06-21 | Yes; LGPL v2.1, BSD, QPL | — | C | — | — | — | — | — | An open-source extensible analysis framework for C with several analyzers and a specification language common to all of them. Includes analyses based on abstract interpretation, deductive verification and runtime monitoring. |
| GrammaTech CodeSonar | 2020-06-01 (5.3) | No; proprietary | — | C, C++, Objective-C | Java | — | — | — | — | Defect detection (buffer overruns, memory leaks, etc.), concurrency and security checks, architecture visualization and software metrics. |
| GCC | 2023-4-26 (13.1) | Yes; GPLv3+ with GCC Runtime Library Exception | — | C | — | — | — | — | — | Compiling with -fanalyzer flag (available from GCC 10) enables the static analyzer functionality [9] |
| HCL Security AppScan Source | 2020-12-01 (10.0.3) | No; proprietary | — | C, C++ | Java, JSP | JavaScript | .NET | Python | ColdFusion, ASP, PHP, Perl, Visual Basic 6, PL/SQL, T-SQL, COBOL | Analyzes source code to identify security vulnerabilities while integrating security testing with software development processes and systems. |
| Helix QAC | 2023-04 (2023.1) | No; proprietary | — | C, C++ | — | — | — | — | — | Formerly PRQA QA·C and QA·C++, deep static analysis of C/C++ for quality assurance and guideline/coding standard enforcement with MISRA support. |
| Infer Static Analyzer | 2024-06-21 (1.2.0) | Yes; MIT | — | C, C++, Objective-C | Java | — | — | — | — | Targets null pointer problems, leaks, concurrency issues and API usage for Facebook's mobile apps. Available as open source on GitHub. Sometimes referred as Facebook Infer. |
| Imagix 4D | 2020-10-01 (10.1.0) | No; proprietary | — | C, C++ | Java | — | — | — | — | Windows and Linux versions. |
| Kiuwan | 2020-07-22 | No; proprietary | — | C, C++, C#, Objective-C | Java, JSP | JavaScript | VB.NET | — | ABAP, COBOL, PHP, PL/SQL, T-SQL, SQL, Visual Basic, Android | Software Analytics end-to-end platform for static code analysis and automated code review. It covers defect detection, application security & IT Risk Management, with enhanced life cycle and application governance features. Support for over 20 languages. |
| Klocwork | 2023-04-04 (2023.1) | No; proprietary | — | C, C++, C# | Java | JavaScript | — | Python | Kotlin | Provides security vulnerability, standards compliance (MISRA, ISO 26262 and others), defect detection and build-over-build trend analysis |
| LDRA Testbed | 2021-05-07 (v9.8.6) | No; proprietary | Ada83, Ada95 | C, C++ | — | — | — | — | Assembler (Intel, Freescale, Texas Instruments) | A software analysis and testing tool suite, that performs static analysis, standards enforcement (eg. MISRA C/C++), dynamic analysis, unit testing and requirements traceability. |
| Lint | 1978-07-26 | Yes; permissive BSD-like [10] | — | C | — | — | — | — | — | The original, from 1978, static code analyzer for C. |
| MALPAS | No; proprietary | Ada | C | — | — | — | — | Pascal, Assembler (Intel, PowerPC and Motorola) | A software static analysis toolset for a variety of languages. Used primarily for safety critical applications in Nuclear and Aerospace industries. | |
| Moose | 2021-01-21 (7.0.3) | Yes; MIT | — | C, C++ | Java | — | .NET | — | Smalltalk | Moose started as a software analysis platform with many tools to manipulate, assess or visualize software. It can evolve to a more generic data analysis platform. |
| NDepend | 2022-03-16 (2022.1) [11] | No; proprietary | — | — | — | — | C# VB.NET .NET | — | — | Simplifies managing a complex .NET code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and by comparing different versions. Integrates into Visual Studio. |
| .NET Compiler Platform (Roslyn) | 2020-12-08 (3.8.0) | Yes; MIT | — | C# | — | — | VB.NET | — | — | Open-source compiler framework for C# and Visual Basic .NET developed by Microsoft .NET. Provides an API for analyzing and manipulating syntax. FxCop rules were implemented into Roslyn. |
| Parasoft C/C++test | 2020-11-12 (2020.2) | No; proprietary | — | C, C++ | — | — | — | — | — | A C/C++ tool that does static analysis, unit testing, code review, and runtime error detection; plugins available for Visual Studio and Eclipse-based IDEs. |
| PC-lint Plus | 2022-08-02 (2.0 Beta 2) | No; proprietary | — | C, C++ | — | — | — | — | — | A static analysis tool used to detect a wide range of defects, identify suspicious code, enforce various coding standards (MISRA/AUTOSAR/etc), calculate and report complex metrics, and implement user-defined checks. |
| PMD | 2023-2-25 (6.55.0) | Yes; BSD-like | — | C, C++ | Java, JSP | JavaScript | — | — | ColdFusion, PHP | duplicate code detection (e.g.) [12] code. |
| Polyspace | 2022-09-15 | No; proprietary | Ada | C, C++ | — | — | — | — | — | Uses abstract interpretation to detect and prove the absence of certain run time errors and dead code in source code as well as used to check all MISRA (2004, 2012) rules (directives, non directives). |
| Pretty Diff | 2019-04-21 (101.0.0) | Yes; CC0 | — | — | — | JavaScript, TypeScript | — | — | Markup, script and style languages (like XML, CSS) | A language-specific code comparison tool that features language-specific analysis reporting in addition to language-specific minification and beautification algorithms. |
| PVS-Studio | 2024-08-16 (7.32) | No; proprietary | — | C, C++, C++/CLI, C++/CX, C# | Java | — | — | — | — | A software analysis tool. |
| Qodana | 2023-07-23 (2023.2) | No; proprietary | — | C# | Java, Kotlin | JavaScript, TypeScript | VB.NET | Python | Go, HTML, PHP, CSS, Android, Vue.js | A code quality analysis tool that uses static code analysis. |
| RIPS | 2020-02-17 (3.4) | No; proprietary | — | — | Java | — | — | — | PHP | A static code analysis solution with many integration options for the automated detection of complex security vulnerabilities. |
| SAST Online | 2022-03-07 (1.1.0) | No; proprietary | — | — | Java | — | — | — | Kotlin, APK | Check the Android Source code thoroughly to uncover and address potential security concerns and vulnerabilities. Static application security testing (Static Code Analysis) tool Online |
| Semgrep | 2025-01-29 (1.106.0) | Yes; LGPL v2.1 | — | — | Java | JavaScript, TypeScript | — | Python | Go, JSON, PHP, Ruby, language-agnostic mode | A static analysis tool that helps expressing code standards and surfacing bugs early. It also has experimental support for eleven other languages. A CI service and a rule library is also available. |
| Sider | 2021-02-02 | No; proprietary | — | — | — | JavaScript, CoffeeScript | — | Python | Ruby, PHP, Go | Static code analysis based automated code review tool working on GitHub and GitLab. Checks style, quality, dependencies, security and bugs. It integrates a number of open source static analysis tools. |
| SLAM project | 2010-07-14 | No; proprietary | — | C | — | — | — | — | — | A project of Microsoft Research for checking that software (drivers) satisfies critical behavioral properties of the interfaces it uses. |
| SofCheck Inspector, Codepeer | 2020-08-24 (21.x) | No; proprietary | Ada | — | Java | — | — | — | — | Static detection of logic errors, race conditions, and redundant code. automatically extracts pre-postconditions from code. |
| SonarQube | 2024-02-05 (10.4) | Partly; framework is LGPL v3.0, but some features can be proprietary | — | C, C#, C++, Objective-C | Java, Kotlin, Scala | JavaScript, TypeScript | VB.NET | Python | ABAP, Apex, CSS, COBOL, Flex, Go, HTML, PHP, PLI, PL/SQL, Ruby, Swift, TSQL, Visual Basic 6, XML | A continuous inspection engine that finds vulnerabilities, bugs and code smells. Also tracks code complexity, unit test coverage and duplication. Offers branch analysis and C/C++/Objective-C support via commercial licenses. |
| SourceMeter | 2016-12-16 (8.2) | No; proprietary | — | C, C++ | Java | — | — | Python | RPG IV (AS/400) | A platform-independent, command-line static source code analyzer. Integrates with PMD and SpotBugs. |
| Sourcetrail (retired) | 2021-04 (2021.4.19) | Yes; GPL | — | C, C++ | Java | — | — | Python | Perl | An open-source source code explorer that provides interactive dependency graphs and supports multiple programming languages. |
| Sparse | 2021-09-06 (0.6.4) | Yes; MIT | — | C | — | — | — | — | GCC extensions | An open-source tool designed to find faults in the Linux kernel. |
| Splint | 2007-07-12 (3.1.2) | Yes; GPLv2 | — | C | — | — | — | — | — | An open-source tool statically checking C programs for security vulnerabilities and coding mistakes. |
| StyleCop | 2016-05-02 (2016.1.0) | Yes; Ms-PL | — | C# | — | — | .NET | — | — | Analyzes C# source code to enforce a set of style and consistency rules. It can be run from inside of Microsoft Visual Studio or integrated into an MSBuild project. |
| Squore | 2020-11-27 (20.1) | No; proprietary | Ada | C, C++, C#, Objective-C | Java | JavaScript, TypeScript | VB.NET | Python | Fortran, PHP, PL/SQL, Swift, T-SQL, XAML | A multi-purpose and multi-language monitoring tool for software projects. It integrates with other scanners. |
| Understand | 2023-01-19 (6.3) | No; proprietary | Ada | C, C++, C#, Objective-C | Java | JavaScript | — | Python | FORTRAN, Jovial, Pascal, VHDL, HTML, PHP, XML | A multi-platform tool for code analysis and comprehension of large code bases. Can recognize multiple dialects of C, C++ and C# like ANSI, K&R and Objective C++. |
| Visual Expert | 2021-09-10 | No; proprietary | — | — | — | — | — | — | PowerBuilder, Oracle PL/SQL, SQL Server Transact-SQL (T-SQL) | Continuous Code inspection, reports on quality and security issues, helps understand complex code (cross-references, source code documentation, code comparison, code performance analysis). |
| Visual Studio | 2021-10-12 (16.11) | No; proprietary | — | C, C++, C# | — | — | — | — | VB.NET | An IDE that provides static code analysis for C/C++ both in the editor environment and from the compiler command line. Also includes the .NET Compiler Platform (Roslyn) which provides C# and VB.NET analysis. |
| Yasca (retired) | 2010-11-01 (2.21) | Yes; multiple licenses | — | C, C++ | Java | JavaScript | — | — | ASP, PHP, HTML, CSS, ColdFusion, COBOL | Yet Another Source Code Analyzer, a plugin-based framework to scan arbitrary file types, with plugins. It integrates with other scanners, including FindBugs, PMD, and Pixy. |
| Tool | Release | Free software | Supported languages | Notes | ||||||
| Tool | Latest release | Free software | Duplicate code | Notes |
|---|---|---|---|---|
| Checkstyle | 2020-01-26 | Yes; LGPL | No | Besides some static code analysis, it can be used to show violations of a configured coding standard. Duplicate code detection was removed [13] from Checkstyle. |
| Eclipse | 2017-06-28 | Yes; EPL | No | Cross-platform IDE with own set of several hundred code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. Plugins for Checkstyle, FindBugs, and PMD. |
| FindBugs | 2015-03-06 | Yes; LGPL | Based on Jakarta BCEL from the University of Maryland. SpotBugs is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community. | |
| IntelliJ IDEA | 2021-04-06 | Yes; ASL 2 | Yes | A leading Java IDE with built-in code inspection and analysis. Plugins for Checkstyle, FindBugs, and PMD. |
| JArchitect | 2017-06-11 | No; proprietary | Simplifies managing a complex code base by analyzing and visualizing code dependencies, defining design rules, doing impact analysis, and by comparing different versions of the code. | |
| Jtest | 2019-05-21 | No; proprietary | Yes | Testing and static code analysis product by Parasoft. |
| Soot | 2020-10-28 | Yes; LGPL | A language manipulation and optimization framework consisting of intermediate languages. | |
| PMD | 2021-01-30 | Yes; BSD License | Yes | Static code analyzer with support for plugins, including CPD. PMD supports checking of several languages. |
| Squale | 2011-05-26 | Yes; LGPL | A platform to manage software quality. | |
| ThreadSafe | 2014-03-28 | No; proprietary | A static analysis tool focused on finding concurrency bugs. |
Tools that use sound, i.e. over-approximating a rigorous model, formal methods approach to static analysis (e.g., using static program assertions). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report all bugs for buggy programs, they will report at least one.