18.3
Semgrep Code is a static application security testing product that scans source code for vulnerabilities and helps developers fix them.
Free planOpen sourceWebAPIExtension
Alternatives to Infer
Infer gives development teams free static analysis for Java, C, C++, Objective-C, and Erlang. It reports potential bugs such as null dereferences, memory or resource leaks, unavailable APIs, coding issues, and data races, including problems that cross functions or files. Pulse covers memory and value analysis, RacerD checks thread safety, and cost analysis measures asymptotic complexity for supported languages. Build integrations, CI workflows, custom rules, and Linux or…
27.9
Qodana is a static code analysis tool that checks projects from the IDE through CI for code smells, duplication, complexity, vulnerabilities, and license issues.
Free planWebAPIExtension
37.5
GitHub CodeQL is a language and toolchain for analyzing code as data.
Free planWebExtensionLinux
- 4
Understand
Understand is a static analysis and code-comprehension tool that builds a cross-referenced model of source code without executing it.
APIExtensionLinuxmacOS7.2From $100 a month - 5
CBMC
CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows.
Free planLinuxmacOSWindows6.5Free plan - 6
CppDepend
CppDepend analyzes C, C++, Java, and Rust codebases to visualize architecture, detect issues, enforce coding standards, and help prevent technical debt.
LinuxmacOSWindows6.3$599 one-time - 7
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code.
Free planLinuxmacOSSelf-hostedWindows6.3Free plan - 8
Clang Static Analyzer
Clang Static Analyzer finds selected bugs in C, C++, and Objective-C programs by using symbolic execution to examine execution paths across function calls.
Free planLinuxmacOSWindows6.2Free plan - 9
CPAchecker
CPAchecker is a configurable software verification tool for analyzing programs.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 10
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 11
CodeChecker
CodeChecker is open-source static analysis infrastructure built on the LLVM and Clang Static Analyzer toolchain.
WebAPIExtensionLinux5.9 - 12
Frama-C
Frama-C is a plug-in platform for analyzing C programs and checking for bugs.
LinuxmacOSWindows5.9 - 13
Astrée
Astrée is paid static-analysis software for Linux and Windows that examines C code for possible run-time errors.
LinuxWindows5.8 - 14
LDRA Tool Suite
LDRA Tool Suite brings verification, testing, and requirements traceability together for safety-, security-, and mission-critical software development.
LinuxmacOSSelf-hostedWindows5.8 - 15
SeaHorn
SeaHorn is an open-source framework for analyzing LLVM-based programs, developed mainly for research in automated verification.
LinuxmacOSSelf-hosted5.8 - 16
Imagix 4D
Imagix 4D helps C, C++, and Java developers understand, document, review, and improve complex source code, including legacy and third-party software.
LinuxWindows5.7 - 17
Ultimate Automizer
Ultimate Automizer is a free software model checker and a toolchain in the Ultimate program analysis framework.
WebLinuxWindows5.7 - 18
TrustInSoft Analyzer
TrustInSoft Analyzer is a static-analysis product for detecting memory-safety issues and runtime errors in source code.
LinuxmacOS5.3 - 19
Axivion Suite
WebLinuxmacOSWindows5.2 - 20
Fortify Static Code Analyzer
Fortify Static Code Analyzer is a paid software product from OpenText for finding security vulnerabilities during application development.
LinuxSelf-hostedWindows5.2 - 21
Klocwork
WebLinuxWindows5.2 - 22
Polyspace
WebLinuxmacOSWindows5.2 - 23
Perforce QAC (formerly Helix QAC)
WebLinuxWindows5.0 - 24
Parasoft C/C++test
LinuxWindows4.7