Infer

Overview

Infer is a free static analyzer for developers who want potential bugs flagged in Java, C, C++, Objective-C, or Erlang before code ships. It is most compelling for teams with builds on Linux or macOS and an existing compilation workflow; its cross-file analysis is useful, but setup depends on capturing compilation and Windows is out.

Key features

Infer captures compilation commands, analyzes the files included in those builds, and writes reports that developers can explore with infer explore. Tying analysis to the build makes it practical to fit into established workflows, but creates a firm coverage boundary: a file that is not compiled is not analyzed. For CI, the recommended approach is to identify modified files and run reactive analysis from those files.

Its checks address different risks by language. For Java and Android, they cover null-pointer exceptions, resource leaks, annotation reachability, missing lock guards, and concurrency races. For C, C++, and Objective-C, they include null dereferences, memory leaks, coding conventions, and unavailable APIs. The ability to reason across functions or methods in different files helps with bugs that depend on interactions rather than a single local expression.

Pulse provides interprocedural memory-safety analysis, including null-dereference detection in Java, while RacerD focuses on thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family code. Hack support is experimental; cost analysis does not support Python, Rust, or Swift. These specialized analyses add value when those checks match a team's concerns, but they do not make Infer a universal analyzer across every language or concern.

Documented build integrations include ant, Buck, CMake, Gradle, Make, Maven, xcodebuild, and xctool, as well as compilation databases. Infer can be installed from binary releases, built from source, or run in Docker; a small browser example is available through Codeboard. Meta also uses Infer in its continuous-integration pipeline to verify selected properties of code changes across projects including Facebook, Messenger, Instagram, and WhatsApp. That deployment demonstrates a role in CI, not a guarantee that it will catch every defect.

Pricing

Infer is free: the Infer plan costs nothing and includes static analysis for supported programming languages. Users can choose a downloadable binary, a source build, or Docker, with no paid tier or seat quota to weigh against the core analysis.

The MIT license makes the repository broadly accessible, but enabling Java support may require GPL-licensed components. Teams that need Java analysis should account for that licensing caveat when choosing how to adopt Infer.

Platforms

Infer supports Linux and macOS, with self-hosted and web options also listed. The latest binary release is for Linux and macOS, and Infer is not supported on Windows. The documentation suggests using a Linux virtual machine if a project can compile on Linux, which makes Windows use possible only through that workaround rather than native support.

Support is available through GitHub issues and the #infer IRC channel on Libera Chat. That community-based route may suit teams comfortable troubleshooting in developer forums, but is a weaker fit for organizations that need a dedicated commercial support channel.

Who it's for

Infer is a strong candidate for engineering teams maintaining Java or C-family code that already builds on Linux or macOS and can capture compilation reliably. Its cross-function analysis, multiple build integrations, and reactive CI workflow suit teams that want static checks connected to code changes without a software subscription.

It is a less natural fit for Windows-only projects, builds that do not reliably compile all relevant files, or teams seeking analysis centered on Python, Rust, or Swift. The Erlang language is supported, though the described language-specific checks and cost-analysis coverage focus on Java and C-family code.

Pros and cons

• Pro: Cross-function and cross-file reasoning can surface bugs that depend on interactions across methods, rather than only local code patterns.
• Pro: Free distribution through binaries, source, and Docker removes a license fee as a barrier to evaluating it in existing workflows.
• Pro: Integrations for common build systems and a recommended reactive CI flow make it adaptable to both routine builds and change-focused analysis.
• Con: Compilation capture limits analysis to files actually compiled, so coverage depends on the build capturing the code a team intends to inspect.
• Con: No Windows support means Windows-oriented teams need a Linux VM and a project that can compile there.
• Con: Cost analysis has language gaps, and Java support may bring GPL-licensed components despite the repository's MIT license.

Alternatives

For broader comparison, see C and C++ Static Analysis Tools or Static Analysis Tools.

MATLAB Grader is the more relevant choice for MATLAB work; its free use requires a current MATLAB license under maintenance, and LMS integration requires a qualifying academic license.

CBMC is another free command-line option for readers who prefer a tool under a BSD 4-clause license.

Qodana may suit teams looking for a freemium static-analysis product with a free Community plan, a 30-day detailed history window, and unlimited lines of code and projects.

Semgrep Code is worth considering when a free tier with Code and Supply Chain coverage is a better match; its Free Edition is capped at 10 repositories, 10 contributors, and 60 AI credits.

Clang Static Analyzer is a free, open-source alternative for C, C++, and Objective-C code.

Flawfinder is another free option, distributed under GPL-2.0+.

Parasoft SOAtest offers tailored custom pricing for organizations seeking a paid product with a free plan and trial.

Squish is a paid alternative with a free trial for readers considering a commercial tool instead.

Verdict

Choose Infer if you need free static analysis for Java or C-family projects, can run builds on Linux or macOS, and want checks that reason across functions within an existing build or CI workflow. Its strongest case is broad bug analysis without a license fee; look elsewhere if Windows support, uncaptured-file coverage, or analysis for languages outside its practical strengths is essential.