CodeChecker
CodeChecker is open-source static analysis infrastructure built on the LLVM and Clang Static Analyzer toolchain.
What CodeChecker is
CodeChecker is open-source static analysis infrastructure built on the LLVM and Clang Static Analyzer toolchain. Its command-line tools run supported analyzers against a JSON compilation database and produce results for review. The web interface can store, filter, compare, and visualize reports, including code bug paths; users can comment and set review status there. Analysis can be restricted to changed files and their dependencies. Listed analyzer coverage includes C/C++, C#, Java, Python, JavaScript, TypeScript, Go, and Markdown. The documentation describes Gerrit and GitLab review integrations, a reusable GitHub Actions workflow, and a Visual Studio Code extension that can run analysis, reanalyze a saved file, and browse reports. Users can run the web and storage server locally or deploy it with Docker, using PostgreSQL or SQLite. Analysis runs locally and can only be invoked from the command line; sending reports to a server also requires the command line. Windows installation is available through pip, but build logging is unavailable on Windows. CodeChecker requires Python 3.11 or later.
Good
- Open-source static analysis infrastructure
- Supports multiple listed programming languages
- Reports can be filtered and compared in a web interface
- Visual Studio Code extension can run analysis
- Local or Docker server deployment
Watch out
- Analysis can only be invoked from the command line
- Server report storage also requires the command line
- Windows build logging is unavailable
- Requires Python 3.11 or later
Who it suits
CodeChecker suits developers and teams seeking open-source static analysis, report review, and CI or editor integrations. It is relevant to projects using its listed languages and able to work with its command-line workflow.
Verdict
CodeChecker combines local analyzer runs with web-based report review and integrations for development workflows. Its command-line requirements and Windows build-logging limitation are important constraints to account for.
The facts
Each one read from CodeChecker's own pages, with the date it was checked.
What it does
- Access control
- The server supports authentication and permissions scoped globally or by product; the documentation also describes LDAP and PAM as external authentication methods.checked 3 Oct 2026
- Analysis
- Its command-line tools run supported analyzers against a JSON compilation database and produce analysis results.checked 3 Oct 2026
- Analysis limitation
- Analysis runs locally and can only be invoked from the command line; storing reports to a server also requires the command line.checked 3 Oct 2026
- Analyzer support
- It runs Clang-Tidy, Clang Static Analyzer, Cppcheck, GCC Static Analyzer and Facebook Infer for command-line C/C++ analysis.checked 3 Oct 2026
- Authentication
- Server authentication options include dictionary credentials, PAM, LDAP and OAuth, with OAuth templates documented for GitHub, Google Workspace and Microsoft Entra.checked 3 Oct 2026
- Broader analyzer support
- The supported analyzer list includes tools for C/C++, C#, Java, Python, JavaScript, TypeScript, Go and Markdown.checked 3 Oct 2026
- Deployment
- The web server can be deployed using Docker, and the documentation links to a CodeChecker server container on Docker Hub.checked 3 Oct 2026
- Editor extension
- The Visual Studio Code extension can run analysis, reanalyze a file when saved, and browse reports in the editor.checked 3 Oct 2026
- Incremental analysis
- CodeChecker can limit reanalysis to changed files and their dependencies.checked 3 Oct 2026
- Integrations
- The documentation describes Gerrit and GitLab review integrations and a reusable GitHub Actions workflow.checked 3 Oct 2026
- Purpose
- CodeChecker is static analysis infrastructure built on the LLVM/Clang Static Analyzer toolchain.checked 3 Oct 2026
- Report management
- The web interface can store, filter, compare, and visualize analyzer reports, including bug paths in code.checked 3 Oct 2026
- Review workflow
- Users can comment on reports and set review status in the web GUI.checked 3 Oct 2026
- Runtime requirement
- The packaging requirements specify Python 3 version 3.11 or later.checked 3 Oct 2026
- Storage
- The web application supports PostgreSQL or SQLite backends.checked 3 Oct 2026
- Supported analyzers
- The documentation lists analyzers for C/C++, C#, Java, Python, JavaScript, TypeScript, Go, and Markdown.checked 3 Oct 2026
Where it runs
- Platform limitation
- The documentation says Windows installation is available through pip, but build logging is unavailable on Windows.checked 3 Oct 2026
Alternatives to CodeChecker
- 1
Semgrep Code
Free planOpen sourceWebAPIExtensionLinux8.3From $15 a month - 2
Qodana
Free planWebAPIExtensionLinux7.9From $5 a month - 3
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 4
Understand
APIExtensionLinuxmacOS7.2From $100 a month - 5
Infer
Free planWebLinuxmacOSSelf-hosted6.7Free plan - 6
CBMC
Free planLinuxmacOSWindows6.5Free plan