analysis-tools-dev/static-analysisCurated directory of static analysis (SAST) tools and linters for programming languages, configs, build tools, and CI, focused on improving code quality.
This repository lists static analysis tools for all programming languages, build tools, config files and more. The focus is on tools which improve code quality such as linters and formatters. The official website, analysis-tools.dev is based on this repository and adds rankings, user comments, and additional resources like videos for each tool.
Thank you to CodeRabbit for sponsoring this project, and to everyone who has supported it over the years.
Support this project through GitHub Sponsors or Open Collective.
Contributions are welcome for tools that already meet the contribution criteria: at least six months of history, 20 GitHub stars, and more than one human contributor. Please do not submit tools before they qualify. Pull requests with verified criteria failures will be closed; you are welcome to resubmit once all criteria are met.
Also check out the sister project, awesome-dynamic-analysis.
abaplint — Linter for ABAP, written in TypeScript.
abapOpenChecks — Enhances the SAP Code Inspector with new and customizable checks.
Polyspace for Ada ©️ — Provide code verification that proves the absence of overflow, divide-by-zero, out-of-bounds array access, and certain other run-time errors in source code.
SPARK ©️ — Static analysis and formal verification toolset for Ada.
Astrée ©️ — Astrée automatically proves the absence of runtime errors and invalid concurrent behavior in C/C++ applications. It is sound for floating-point computations, very fast, and exceptionally precise. The analyzer also checks for MISRA/CERT/CWE/Adaptive Autosar coding rules and supports qualification for ISO 26262, DO-178C level A, and other safety standards. Jenkins and Eclipse plugins are available.
CBMC — Bounded model-checker for C programs, user-defined assertions, standard assertions, several coverage metric analyses.
clang-tidy — Clang-based C++ linter tool with the (limited) ability to fix issues, too.
clazy — Qt-oriented static code analyzer based on the Clang framework. clazy is a compiler plugin which allows clang to understand Qt semantics. You get more than 50 Qt related compiler warnings, ranging from unneeded memory allocations to misusage of API, including fix-its for automatic refactoring.
codechecker — A defect database and viewer extension for the Clang Static Analyzer with web GUI.
CPAchecker — A tool for configurable software verification of C programs. The name CPAchecker was chosen to reflect that the tool is based on the CPA concepts and is used for checking software programs.
cppcheck — Static analysis of C/C++ code.
CppDepend ©️ — Measure, query and visualize your code and avoid unexpected issues, technical debt and complexity.
cpplint — Automated C++ checker that follows Google's style guide.
CScout — Complexity and quality metrics for C and C preprocessor code.
