Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Alternatives to CodeChecker
Qodana is a static code analysis tool that checks projects from the IDE through CI for code smells, duplication, complexity, vulnerabilities, and license issues.
GitHub CodeQL is a language and toolchain for analyzing code as data.
- 4

Understand
Understand is a static analysis and code-comprehension tool that builds a cross-referenced model of source code without executing it.
APIExtensionLinuxmacOS7.2From $100 a month - 5
Infer
Infer is a free static analyzer that reports potential bugs in source code before it ships.
Free planWebLinuxmacOSSelf-hosted6.7Free plan - 6
CBMC
CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows.
Free planLinuxmacOSWindows6.5Free plan - 7

CppDepend
CppDepend analyzes C, C++, Java, and Rust codebases to visualize architecture, detect issues, enforce coding standards, and help prevent technical debt.
LinuxmacOSWindows6.3$599 one-time - 8

Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 9
Clang Static Analyzer
Clang Static Analyzer finds selected bugs in C, C++, and Objective-C programs by using symbolic execution to examine execution paths across function calls.
Free planLinuxmacOSWindows6.2Free plan - 10
CPAchecker
CPAchecker is a configurable software verification tool for analyzing programs.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 11

PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 12
Frama-C
Frama-C is a plug-in platform for analyzing C programs and checking for bugs.
LinuxmacOSWindows5.9 - 13
Astrée
Astrée is paid static-analysis software for Linux and Windows that examines C code for possible run-time errors.
LinuxWindows5.8 - 14

LDRA Tool Suite
LDRA Tool Suite brings verification, testing, and requirements traceability together for safety-, security-, and mission-critical software development.
LinuxmacOSSelf-hostedWindows5.8 - 15
SeaHorn
SeaHorn is an open-source framework for analyzing LLVM-based programs, developed mainly for research in automated verification.
LinuxmacOSSelf-hosted5.8 - 16
Imagix 4D
Imagix 4D helps C, C++, and Java developers understand, document, review, and improve complex source code, including legacy and third-party software.
LinuxWindows5.7 - 17
Ultimate Automizer
Ultimate Automizer is a free software model checker and a toolchain in the Ultimate program analysis framework.
WebLinuxWindows5.7 - 18
TrustInSoft Analyzer
TrustInSoft Analyzer is a static-analysis product for detecting memory-safety issues and runtime errors in source code.
LinuxmacOS5.3 - 19
Axivion Suite
WebLinuxmacOSWindows5.2 - 20
Fortify Static Code Analyzer
Fortify Static Code Analyzer is a paid software product from OpenText for finding security vulnerabilities during application development.
LinuxSelf-hostedWindows5.2 - 21

Klocwork
WebLinuxWindows5.2 - 22

Polyspace
WebLinuxmacOSWindows5.2 - 23

Perforce QAC (formerly Helix QAC)
WebLinuxWindows5.0 - 24
Parasoft C/C++test
LinuxWindows4.7


