Blog
A List of Static Analysis Tools
Open-Source Static Analysis Programs
GitHub — CodeQL
Company: GitHub
Product: CodeQL
Type: Query-based static analysis and security vulnerability detection
Open Source: MIT — CodeQL CLI; query libraries have their own licenses
Commercial: Yes
Programming Languages: C, C++, C#, Java, JavaScript, Python, and more
Feature: Dedicated query language and database representation for writing sophisticated, reusable program analyses
Integrations: GitHub Actions; Visual Studio Code
If you use GitHub, then you’ve probably run into CodeQL. This database system can be queried to find vulnerability patterns, unsafe data flows, and other defects. That makes it different from most of the SAST and SCA tools, as it’s complementary to these tools.
Semgrep — Semgrep Community Edition
Company: Semgrep
Product: Semgrep Community Edition
Type: Pattern-based static analysis and SAST
Open Source: LGPL-2.1 — engine
Commercial: Yes
Programming Languages: Java, JavaScript, TypeScript, Python, Go, C, and more
Feature: Accessible custom rule development using code-shaped patterns
Integrations: GitHub Actions; GitLab CI
Semgrep CE is the base for Semgrep’s commercial tool. It doesn’t have all of the bells and whistles of the latter, but is more than sufficient for doing a good bug finding job. It can handle CI/CD pipelines as well as perform custom coding-standard enforcement.
LLVM Project — Clang Static Analyzer
Company: LLVM Project
Product: Clang Static Analyzer
Type: Path-sensitive static bug analysis
Open Source: Apache-2.0 with LLVM exceptions
Commercial: No
Programming Languages: C, C++, Objective-C
Feature: Path-sensitive symbolic execution integrated with the Clang compiler ecosystem
Integrations: CMake; Xcode
LLVM is the base for a class of compilers including major embedded languages: C and C++. It also handles Objective-C. The Clang Static Analyzer uses symbolic execution and path-sensitive reasoning to find defects. It handles the typical static analysis checks like null-pointer dereferences.
Cppcheck — Cppcheck
Company: Cppcheck project
Product: Cppcheck
Type: C/C++ static defect analysis
Open Source: GPL-3.0 — community edition
Commercial: Yes
Programming Languages: C, C++
Feature: Lightweight C/C++ analysis designed to complement compiler warnings
Integrations: CMake; Jenkins, CodeChecker
Cppcheck focuses on C and C++. It started as an open-source project and evolved into a commercial version as well. The tool is designed to minimize false positives. It can handle standards like MISRA C 2023, MISRA C++ 2023, MISRA C 2025, and AUTOSAR C++ 2014. Also addressed are security standards like CERT C, CERT C++, and Top 25 CWE.
Meta — Infer
Company: Meta
Product: Infer
Type: Static program analysis using symbolic reasoning
Open Source: MIT
Commercial: No
Programming Languages: Java, C, C++, Objective-C
Feature: Interprocedural analysis intended to identify certain defects without requiring exhaustive execution of the program
Integrations: Buck; Maven, CodeChecker
Infer is open source and written in OCaml, a functional programming language. A tool used by Meta, it leverages bi-abductive, interprocedural analysis to identify potential defects instead of relying solely on pattern matching. It doesn’t focus on compliance standards like MISRA C. Infer is good at doing data flow analysis.
SpotBugs community — SpotBugs
Company: SpotBugs community
Product: SpotBugs
Type: Java bytecode static analysis
Open Source: LGPL-2.1
Commercial: No
Programming Languages: Java
Feature: Bytecode-based bug detection that can analyze compiled classes independently of a particular source-code editor
Integrations: Maven; Gradle
SpotBugs focuses on Java. It deals with compiled Java bytecode to idenfity common bug patterns, suspicious control flow, and potential correctness problems. It’s the community-supported successor to FindBugs.
Python Code Quality Authority — Bandit
Company: Python Code Quality Authority
Product: Bandit
Type: Python security static analysis
Open Source: Apache-2.0
Commercial: No
Programming Languages: Python
Feature: Plug-in-based security checks focused specifically on Python source code
Integrations: pre-commit; GitHub Actions
Python has been important for web-based solutions, but it has also become the darling for AI management and configuration. So, keeping bugs out of these applications is important.
Bandit only handles Python source code and focuses on SAST. It parses code into abstract syntax trees and applies security checks to detect potentially risky function calls, insecure configurations, and other common coding problems.
Brakeman project — Brakeman
Company: Brakeman project
Product: Brakeman
Type: Ruby on Rails security static analysis
Open Source: MIT
Commercial: No
Programming Languages: Ruby
Feature: Framework-aware security analysis specifically designed for Ruby on Rails
Integrations: GitHub Actions; Jenkins
Ruby on Rails use is common for SaaS platforms and web applications. It’s not really used in embedded applications. Brakeman provides SAST functionality looking for security vulnerabilities. Its framework-specific rules let developers target risks associated with Rails conventions and web-application development.
Frama-C community — Frama-C
Company: Frama-C community
Product: Frama-C
Type: C program analysis and formal verification
Open Source: LGPL-2.1-or-later for the open-source core; component-specific terms may vary
Commercial: Yes
Programming Languages: C
Feature: Plug-in architecture supporting formal verification against program specifications
Integrations: Why3; GCC
Frama-C focuses on analyzing and verifying C programs. The plug-in architecture can be customized by developers. It supports value analysis, formal specification, and deductive verification. It’s been used for certification of some projects that needed to meet DO-178, IEC 60880, and Common Criteria EAL 6-7 requirements. More details can be found in the book, Guide to Software Verification with Frama-C.
CodeChecker project — CodeChecker
Company: CodeChecker project
Product: CodeChecker
Type: Static analysis result management and defect triage
Open Source: Apache-2.0
Commercial: No
Programming Languages: C, C++ (through compatible analysis engines)
Feature: Centralized review and comparison of analysis results from compatible underlying analyzers
Integrations: Clang Static Analyzer; Cppcheck
CodeChecker builds on the Clang Static Analyzer mentioned earlier. It’s more of a tool for helping teams collect, compare, review, and manage static analysis results. It supports other tools like CppCheck and Infer.
OpenGrep community — OpenGrep
Company: OpenGrep community
Product: OpenGrep
Type: Pattern-based static analysis and security scanning
Open Source: LGPL-2.1 — verify the current repository for applicable components and versions
Commercial: No
Programming Languages: Java, JavaScript, TypeScript, Python, Go, C, and more, subject to current compatibility
Feature: Community-governed alternative in the Semgrep-compatible static-analysis ecosystem
Integrations: GitHub Actions; GitLab CI
OpenGrep is a community-governed fork of Semgrep’s open-source engine. It’s intended for teams that want an open implementation of pattern-based code analysis and reusable security rules. It handles a range of programming languages.
Flawfinder project — Flawfinder
Company: Flawfinder project
Product: Flawfinder
Type: C/C++ security source-code scanner
Open Source: GPL-2.0-or-later
Commercial: No
Programming Languages: C, C++
Feature: Risk-ranked detection of potentially dangerous C/C++ functions with minimal setup
Integrations: GitHub Actions; Jenkins
Flawfinder scans C and C++ source code for potentially dangerous functions and security weaknesses, including unsafe string operations and risky command execution. It assigns risk levels to findings and is best treated as a supplementary scanner.
