18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to CBMC
CBMC is a free checker for C and C++ that unwinds loops and passes the resulting equations to a decision procedure. It can verify memory safety, including array bounds and pointer use, check several forms of undefined behavior and user assertions, and test I/O equivalence with languages such as Verilog. Its language support includes C89, C99, most C11/C17, and compiler extensions. It runs on Linux, macOS, and Windows, but its macOS and Windows distributions are command-line…
27.9
Qodana is a static code analysis tool that checks projects from the IDE through CI for code smells, duplication, complexity, vulnerabilities, and license issues.
Free planWebAPIExtension
37.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
- 4
Understand
Understand is a static analysis and code-comprehension tool that builds a cross-referenced model of source code without executing it.
APIExtensionLinuxmacOS7.2From $100 a month - 5
Infer
Infer is a free static analyzer that reports potential bugs in source code before it ships.
Free planWebLinuxmacOSSelf-hosted6.7Free plan - 6
CppDepend
CppDepend analyzes C, C++, Java, and Rust codebases to visualize architecture, detect issues, enforce coding standards, and help prevent technical debt.
LinuxmacOSWindows6.3$599 one-time - 7
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 8
Clang Static Analyzer
Clang Static Analyzer finds selected bugs in C, C++, and Objective-C programs by using symbolic execution to examine execution paths across function calls.
Free planLinuxmacOSWindows6.2Free plan - 9
CPAchecker
CPAchecker is a configurable software verification tool for analyzing programs.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 10
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 11
CodeChecker
CodeChecker is open-source static analysis infrastructure built on the LLVM and Clang Static Analyzer toolchain.
WebAPIExtensionLinux5.9 - 12
Frama-C
Frama-C is a plug-in platform for analyzing C programs and checking for bugs.
LinuxmacOSWindows5.9 - 13
Astrée
Astrée is paid static-analysis software for Linux and Windows that examines C code for possible run-time errors.
LinuxWindows5.8 - 14
LDRA Tool Suite
LDRA Tool Suite brings verification, testing, and requirements traceability together for safety-, security-, and mission-critical software development.
LinuxmacOSSelf-hostedWindows5.8 - 15
SeaHorn
SeaHorn is an open-source framework for analyzing LLVM-based programs, developed mainly for research in automated verification.
LinuxmacOSSelf-hosted5.8 - 16
Imagix 4D
Imagix 4D helps C, C++, and Java developers understand, document, review, and improve complex source code, including legacy and third-party software.
LinuxWindows5.7 - 17
Ultimate Automizer
Ultimate Automizer is a free software model checker and a toolchain in the Ultimate program analysis framework.
WebLinuxWindows5.7 - 18
TrustInSoft Analyzer
TrustInSoft Analyzer is a static-analysis product for detecting memory-safety issues and runtime errors in source code.
LinuxmacOS5.3 - 19
Axivion Suite
WebLinuxmacOSWindows5.2 - 20
Fortify Static Code Analyzer
Fortify Static Code Analyzer is a paid software product from OpenText for finding security vulnerabilities during application development.
LinuxSelf-hostedWindows5.2 - 21
Klocwork
WebLinuxWindows5.2 - 22
Polyspace
WebLinuxmacOSWindows5.2 - 23
Perforce QAC (formerly Helix QAC)
WebLinuxWindows5.0 - 24
Parasoft C/C++test
LinuxWindows4.7