List of tools for static code analysis

Multi-language

• Apache Yetus – A collection of build and release tools. Included is the 'precommit' module that is used to execute full and partial/patch CI builds that provides static analysis of code via other open source tools as part of a configurable report. Built-in support for C, C++, Java, Perl, Python, Ruby, Shell, and XML. May be extended via a plug-in framework.
• App-Ray – Tool for automated discovery of security and privacy vulnerabilities in mobile apps using static and dynamic analysis. Supports Android and iOS apps, i.e. bytecode (Java, Kotlin) and ARM binaries (Swift, Objective-C).
• APPscreener – static code analysis tool for binaries and source code across 15 languages: Java/Scala, Javascript, C, C++, Objective-C, C#, PHP, T-SQL/PL/SQL, Python, Visual Basic, Ruby, Swift, ABAP, Delphi, HTML 5, Solidity. Decompiles binaries and reconstructs vulnerable source code. Jenkins and Jira out of the box integration for continuous development process.
• Application Inspector – static, dynamic and interactive analysis software for web and mobile applications. SCA,CI\CD integration based on Jenkins and VCS integration. Generates exploits and exploitation conditions to reduce false positives.
• Axivion Bauhaus Suite – A static code analysis tool suite for Ada, C, C++, C#, and Java code that performs various analyses such as architecture checking, interface analyses, MISRA checking, and clone detection.
• Blu Age Analyzer – A graph-based code and data analysis tool suite for legacy programming languages such as COBOL, PL/I, RPG400, Powerbuilder. It collects and analyzes information on source code assets, data structures, use cases and functional interdependencies. It provides various graphics and tables that present program calls, control flows, dependencies, metrics, optimization suggestions of the legacy source code and data structure in order to simplify maintenance and improve performance.
• CAST Application Intelligence Platform by CAST – Detailed, audience-specific dashboards to measure quality and productivity. Cross-tier, cross-technology analysis of 50+ languages, C, C++, Java, .NET, Oracle, PeopleSoft, SAP, Siebel, Spring, Struts, Hibernate and all major databases.
• Checkmarx SAST Static Code Analyser – Identifies vulnerabilities in over 20 languages including C, C#, Apex, Scala, Swift, Python, Ruby, .NET, PHP, Java and Javascript. Integrates with Jenkins and other build servers and IDEs like Visual Studio and IntelliJ to enable continuous integration.
• Cigital SecureAssist – A lightweight IDE plugin that points out common security vulnerabilities in real time as the developer is coding. Supports Java, .NET, and PHP.
• CM evolveIT – Static code analyzer with code slicing. Supports COBOL, HL ASM, Java, JCL, SQL, IMS, CICS. Provides component connectivity, code metrics, clone detection, style checking, and data lineage.
• Code Dx – Software application vulnerability correlation and management system that consolidates and normalizes software vulnerabilities detected by multiple static application security testing (SAST) and dynamic application security testing (DAST) tools, as well as the results of manual code reviews. Supports C, C++, C#, Java, JavaScript, JSP, PHP, Python, Rails, Ruby, Scala, VB.NET and XML/XSL.^[1]
• CodeScan - A continuous inspection engine specialized in Salesforce languages Apex, Visualforce and Lightning, Javascript and CSS.
• Compuware Topaz for Program Analysis – A static code analysis for PL/I and COBOL. Produces visual displays of structure charts and logic/data flow and shows dependencies across programs.
• ConQAT – Continuous quality assessment toolkit that allows flexible configuration of quality analyses (architecture conformance, clone detection, quality metrics, etc.) and dashboards. Supports Java, C#, C++, JavaScript, ABAP, Ada and many other languages.
• Coverity – A static analysis tool for C, C++, C#, Objective-C, Java, Javascript, node.JS, Ruby, PHP, & Python.
• DefenseCode ThunderScan – A static source code security analysis tool for C#, Java, PHP, Ruby, Python, VB.Net, JavaScript, Android Java, Objective-C, PL/SQL, ASP Classic, VBScript and Visual Basic.
• Micro Focus Fortify Software Static Code Analyzer – Helps developers identify software security vulnerabilities in C, C++, Java, JSP, .NET, ASP.NET, classic Active Server Pages (ASP), ColdFusion, PHP, Visual Basic 6, VBScript, JavaScript, PL/SQL, T-SQL, Python, Objective-C, ABAP and COBOL and configuration files.
• Micro Focus Enterprise Analyzer and COBOL Analyzer. Static code analysis and visualization tools for legacy and mainframe applications. Analyze code in different languages including COBOL, PL/I, Natural, RPG, Java, Assembler, Easytrieve, VB, C/C++, PL/SQL, C#, VB.NET, KornShell, Job schedulers and more.
• Gamma – An intelligent software analytics platform that identifies issues from multiple lenses: Design issues, code issues, duplication and metrics. Available for Java, C, C++, C#, Objective-C, JavaScript, TypeScript and Python.
• GrammaTech CodeSonar – Defect detection (buffer overruns, memory leaks, etc.), concurrency and security checks, architecture visualization and software metrics for C, C++, Objective-C, and Java source code.
• IBM Security AppScan (formerly known as IBM Rational AppScan) Source Edition – Analyzes source code to identify security vulnerabilities while integrating security testing with software development processes and systems. Supports C, C++, .NET, Java, JSP, JavaScript, ColdFusion, Classic ASP, PHP, Perl, Visual Basic 6, PL/SQL, T-SQL, and COBOL
• Facebook Infer – A tool for Java C, C++, and Objective-C. Targets null pointer problems, leaks, concurrency issues and API usage for Facebook's mobile apps. Available as open source on github.
• Imagix 4D – Identifies problems in variable use, task interaction and concurrency, especially in embedded applications, as part of an overall system for understanding, improving and documenting C, C++ and Java code.
• Kiuwan – Software Analytics end-to-end platform for static code analysis and automated code review. It covers defect detection, application security & IT Risk Management, with enhanced life cycle and application governance features. Support for over 20 languages, including Objective-C, Java, JSP, JavaScript, PHP, C, C++, ABAP, COBOL, JCL, C#, PL/SQL, Transact-SQL, SQL, Visual Basic, Visual Basic .NET, Android (operating system).
• Klocwork – Provides security vulnerability, standards compliance (MISRA, ISO 26262 and others), defect detection and build-over-build trend analysis for C, C++, C#, Java.
• Lint, as supplied with the Android SDK.
• LDRA Testbed – A software analysis and testing tool suite for C, C++, Ada83, Ada95 and Assembler (Intel, Freescale, Texas Instruments).
• MALPAS – A software static analysis toolset for a variety of languages including Ada, C, Pascal and Assembler (Intel, PowerPC and Motorola). Used primarily for safety critical applications in Nuclear and Aerospace industries.
• Moose – Moose started as a software analysis platform with many tools to manipulate, assess or visualize software. It can evolve to a more generic data analysis platform. Supported languages are C, C++, Java, Smalltalk, .NET, more may be added.
• Parasoft – Provides static analysis (pattern-based, flow-based, in-line, metrics) for C, C++, Java, .NET (C#, VB.NET, etc.), JSP, JavaScript, XML, and other languages for standards like MISRA, CWE, OWASP, and CERT. Through a Development Testing Platform, static code analysis functionality is integrated with unit testing, peer code review, runtime error detection and traceability.
• Copy/Paste Detector (CPD) – PMDs duplicate code detection for (e.g.) Java, JSP, C, C++, ColdFusion, PHP and JavaScript^[2] code.
• Polyspace – Uses abstract interpretation to detect and prove the absence of certain run time errors in source code for C, C++, and Ada
• Pretty Diff – A language-specific code comparison tool that features language-specific analysis reporting in addition to language-specific minification and beautification algorithms.
• Protecode – Analyzes the composition of software source code and binary files, searches for open source and third party code and their associated licensing obligations. Can also detect security vulnerabilities.
• PVS-Studio – A software analysis tool for C, C++, C++/CLI, C++/CX (Component Extensions), C#.
• RSM – a source code metrics and quality analysis tool. It provides a standard method for analyzing C, ANSI C++, C# and Java source code across operating systems.
• Rogue Wave Software OpenLogic – Scans source code and binaries to identify open source code and licenses, manages open source policies and approvals, reports security vulnerabilities, and provides open source technical support.
• Semmle – Supports C, C++, C#, Java, JavaScript, Objective-C, Python and Scala.
• SideCI – Static code analysis based automated code review tool for Ruby, Python, PHP, JavaScript, CoffeeScript and Go. Checks style, quality, dependencies, security and bugs.
• Silverthread – Provides design quality and technical health solutions for software code
• SnappyTick (SAST) – Snappy Tick is Static application security tool, It help to identify the Vulnerability in Source code, supports widely used languages for desktop, web and mobile applications.
• SofCheck Inspector – Static detection of logic errors, race conditions, and redundant code for Ada and Java; automatically extracts pre-postconditions from code.
• Softagram Analyzes dependencies and provides a visualization experience and integrated Pull Request review visualization of source code. Supports C, C++, C#, Go, Java, JavaScript, Objective-C, Python, PHP and Scala.
• Sonargraph – Supports Java, C# and C/C++ with a focus on dependency analysis, automated architecture check, metrics and the ability to add custom metrics and code-checkers.
• SonarQube – A continuous inspection engine to manage the technical debt: unit tests, complexity, duplication, design, comments, coding standards and potential problems. Supports languages: ABAP, Android (Java), C, C++, CSS, Objective-C, COBOL, C#, Flex, Forms, Groovy, Java, JavaScript, Natural, PHP, PL/SQL, Swift, Visual Basic 6, Web, XML, Python.
• Sotoarc-Sotograph – Architecture and quality in-depth analysis and monitoring for C, C++, C#, Java, ABAP.
• SourceMeter - A platform-independent, command-line static source code analyzer for Java, C, C++, RPG IV (AS/400) and Python.
• SQuORE is a multi-purpose and multi-language monitoring tool^[3] for software projects.
• SPARROW – Detects run-time errors (null dereferences, buffer overruns, etc.), security vulnerabilities (SQL injections, command injections, information leaks, etc.), coding style violations, and software metics for ABAP, Android (Java), C, C++, Objective-C, C#, Java, JavaScript, PHP, Swift, XML, Python and others.
• Understand – A multi-platform tool for code analysis and comprehension of large code bases. Supported languages include Ada, Cobol, Ansi C, K&R C, Ansi C++, C#, FORTRAN, Java, Jovial, Pascal, PL/M, Python, VHDL, Objective C, Objective C++, HTML, PHP, JavaScript, and XML.
• Veracode – Finds security flaws in application binaries and bytecode without requiring source. Supported languages include C, C++, .NET (C#, C++/CLI, VB.NET, ASP.NET), Java, JSP, ColdFusion, PHP, Ruby on Rails, JavaScript and TypeScript (including AngularJS, Node.js and Jquery), Python, Perl, Scala, Objective-C, Swift, Active Server Pages, Visual Basic 6, COBOL, and IBM RPG, including mobile applications on the Android and iOS platforms and written in JavaScript cross platform frameworks.^[4]
• Yasca – Yet Another Source Code Analyzer, a plugin-based framework to scan arbitrary file types, with plugins for C, C++, Java, JavaScript, ASP, PHP, HTML-CSS, ColdFusion, COBOL, and other file types. It integrates with other scanners, including FindBugs, PMD, and Pixy.
• Application Analyzer – MasterCraft (TCS product) – Tata Consultancy Services (TCS) MasterCraft is a brand of IT Process Automation and Management software tools from Tata Consultancy Services Limited. Application Analyzer is a static code analyzer which supports COBOL, RPG, PL/I, Java, Javascript, .NET, VB,
• CodeMR is a software quality, static code analysis, measurement and visualization tool that integrated with Eclipse and IntelliJ IDEA. Supports Java, Scala and C++ languages.

.NET

• .NET Compiler Platform (Codename Roslyn) – Open-source compiler framework for C# and Visual Basic .NET developed by Microsoft .NET. Provides an API for analyzing and manipulating syntax.
• CodeIt.Right – Combines static code analysis and automatic refactoring to best practices which allows automatic correction of code errors and violations; supports C# and VB.NET.
• CodeRush – A plugin for Visual Studio which alerts users to violations of best practices.
• Designite – A software design quality assessment tool for C#. It computes various Software metrics and detects 37 code smells and design smell. It offers an extension to Visual Studio.
• FxCop – Free static analysis for Microsoft .NET programs that compiles to CIL. Standalone and integrated in some Microsoft Visual Studio editions; by Microsoft.
• NDepend – Simplifies managing a complex .NET code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and by comparing different versions of the code. Integrates into Visual Studio.
• Parasoft dotTEST – A static analysis, unit testing, and code review plugin for Visual Studio; works with languages for Microsoft .NET Framework and .NET Compact Framework, including C#, VB.NET, ASP.NET and Managed C++.
• Sonargraph – Supports C#, Java and C/C++ with a focus on dependency analysis, automated architecture check, metrics and the ability to add custom metrics and code-checkers.
• StyleCop – Analyzes C# source code to enforce a set of style and consistency rules. It can be run from inside of Microsoft Visual Studio or integrated into an MSBuild project.

Ada

• SPARK Toolset – Verification tools for SPARK 2014 – a subset of Ada 2012 that leverages Ada's support for contracts. Designed to offer soundness, depth, modularity and efficiency of verification.
• AdaControl – A tool to control occurrences of various entities or programming patterns in Ada code, used for checking coding standards, enforcement of safety related rules, and support for various manual inspections. Features automatic fixing of violations.
• CodePeer – An advanced static analysis tool that detects potential run-time logic errors in Ada programs.
• Fluctuat – Abstract interpreter for the validation of numerical properties of programs.
• LDRA Testbed – A software analysis and testing tool suite for Ada83/95.
• Polyspace – Uses abstract interpretation to detect and prove the absence of certain run time errors in source code.
• SofCheck Inspector – (Bought by AdaCore) Static detection of logic errors, race conditions, and redundant code for Ada; automatically extracts pre-postconditions from code.

C, C++

• AdLint is an open source and free source code static analyzer for ANSI C89 / ISO C90 and partly ISO C99.
• Astrée – finds all potential runtime errors and data races by abstract interpretation, can prove their absence, and can prove functional assertions; tailored towards safety-critical C code (e.g. avionics and automotive). Includes MISRA checker.
• Axivion Bauhaus Suite – A static code analysis tool suite that performs various analyses such as architecture checking, interface analyses, MISRA checking, and clone detection.
• BLAST – (Berkeley Lazy Abstraction Software verification Tool) – An open-source software model checker for C programs based on lazy abstraction (follow-on project is CPAchecker.^[5]).
• Cppcheck – Open-source tool that checks for several types of errors, including use of STL.
• cpplint – An open-source tool that checks for compliance with Google's style guide for C++ coding.
• Clang – An open-source compiler that includes a static analyzer.
• Coccinelle – An open-source source code pattern matching and transformation.
• Coverity – A static analysis tool for C/C++.
• Cppdepend – Simplifies managing a complex C/C++ code base by analyzing and visualizing code dependencies, by defining design rules, by doing impact analysis, and comparing different versions of the code.
• ECLAIR – A platform for the automatic analysis, verification, testing and transformation of C and C++ programs.
• Eclipse (software) – An open-source IDE that includes a static code analyzer.
• Flawfinder – an open source tool that examines C/C++ source code and reports possible security weaknesses (“flaws”) sorted by risk level.
• Fluctuat – Abstract interpreter for the validation of numerical properties of programs.
• Frama-C – An open-source static analysis framework for C.
• Goanna – A software analysis tool for C/C++.
• GrammaTech CodeSonar – A static program analysis tool for C/C++, see above.
• IKOS – an open-source static analysis of C and C++ code.
• Infer – Developed by an engineering team at Facebook with open-source contributors. Targets null pointer and other memory problems. Available as open source on github.
• Klocwork Static Code Analysis – A static analysis tool for C/C++.
• Lint – The original, from 1978, static code analyzer for C.
• LDRA Testbed – A software analysis and testing tool suite for C/C++.
• OCLint – Clang based, only runs on Linux and Mac OS X.
• Parasoft C/C++test – A C/C++ tool that does static analysis, unit testing, code review, and runtime error detection; plugins available for Visual Studio and Eclipse-based IDEs.
• PC-Lint – A software analysis tool for C with partial support for C++2011.
• Polyspace – Uses abstract interpretation to detect and prove the absence of run time errors, Dead Code in source code as well as used to check all MISRA (2004, 2012) rules (directives, non directives).
• PRQA QA·C and QA·C++ – Deep static analysis of C/C++ for quality assurance and guideline/coding standard enforcement with MISRA support.
• SLAM project – a project of Microsoft Research for checking that software satisfies critical behavioral properties of the interfaces it uses.
• Sparse – An open-source tool designed to find faults in the Linux kernel.
• Splint – An open-source evolved version of Lint, for C.
• Visual Studio – An IDE that provides static code analysis for C/C++ both in the editor environment and from the compiler command line.

Elixir

• Credo – A static code analysis tool for the Elixir language with a focus on code consistency and teaching.

Fortran

• i-Code CNES for Fortran  – An open-source static analysis tool for Fortran 77 and Fortran 90.

Java

JavaScript

• DeepScan – A static code analyzer for JavaScript, TypeScript, React and Vue. Targets runtime errors and quality issues rather than coding conventions.
• StandardJS – JavaScript Style Guide, with linter & automatic code fixer
• ESLint – A modern, pluggable linting utility for JavaScript
• Google's Closure Compiler – JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions.
• JSHint – A community driven fork of JSLint.
• JSLint – JavaScript syntax checker and validator.

Objective-C, Objective-C++

• Clang – The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode.^[9]
• Infer – Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github.
• GrammaTech CodeSonar – A static program analysis tool for C,C++, Objective-C..., see above.

Opa

• Opa includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as XSS attacks and database code injections.

Packaging

• Lintian – Checks Debian software packages for common inconsistencies and errors.
• Rpmlint – Checks for common problems in rpm packages.

Perl

• Perl::Critic – A tool to help enforce common Perl best practices. Most best practices are based on Damian Conway's Perl Best Practices book.
• Devel::Cover – This tool provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code.
• PerlTidy – Program that acts as a syntax checker and tester/enforcer for coding practices in Perl.
• Padre – An IDE for Perl that also provides static code analysis to check for common beginner errors.
• Kritika – Cloud based Static Code Analysis suite for Perl built on top of available packages such as Perl::Critic, but improvised further. http://kritika.io/

PHP

• Progpilot – A static analysis tool for security purposes.
• PHPMD – PHP Mess Detector.
• RIPS – A static code analyzer and audit framework for vulnerabilities in PHP applications.
• Phlint – PHP Linter, Code Analyzer and Tester

PL/SQL

• ClearSQL^[10]  – A tool to audit, review, and format PL/SQL code, detect and fix errors, and generate interactive visuals, with a particular focus on legacy software.
• TOAD – A PL/SQL development environment with a Code xPert component that reports on general code efficiency as well as specific programming issues.
• Visual Expert – A PL/SQL code analysis tool^[11] that reports on programming issues and helps understand and maintain complex code (Impact Analysis, Source Code documentation, Call trees, CRUD matrix, etc.).
• PITSS.CON^[12] – PL/SQL static code analysis tool that extracts and displays business logic, complexities, and dependencies from Oracle Forms and Reports applications.

Python

• Bandit  – AST-based static analyzer from OpenStack Security Group, with a focus on security alerts
• PyCharm – Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project.
• Pychecker – similar to Pylint
• PyDev – Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time.
• Pyflakes – fast AST-based static analyzer
• Pylint – Static code analyzer. Quite stringent; includes many stylistic warnings as well.

R

• lintr  – An R package that checks adherence to a given style, syntax errors and possible semantic issues.

Ruby

• Flay – Checks for structural similarities and detects code duplication.
• Flog – Detects complex classes and methods using ABC metrics.
• Reek – Checks for higher level code smells.
• RuboCop – Style checker based on the community driven Ruby Style Guide.

Solidity

• Slither Slither uses refinement parsing and its own IR to automatically check smart contracts for vulnerabilities and bad practices.
• SmartCheck – SmartCheck automatically checks smart contracts for vulnerabilities and bad practices, highlights them in the code and gives a detailed explanation of the problem.^[13]

Shell script

• i-Code CNES for Shell  – An open-source static analysis tool for Shell.
• ShellCheck – ShellCheck is a tool that gives warnings and suggestions for bash/sh shell scripts^[14]
• Shellharden – A tool to improve shell scripts with proper use of quotes. The tool can suggest and make the required changes.^[15]

TIBCO

• BW Code Scanner – BW Code Scanner contains a set of tools for automated code review of TIBCO BusinessWorks - BW5, BW6/BWCE and BusinessEvents (BE) projects or EAR files. It checks for vulnerabilities, best practices and potential bugs and provides description of how to fix in Excel, PDF or XML formats.

Transact-SQL

• Visual Expert – A SQLServer code analysis tool^[16] that reports on programming issues and helps understand and maintain complex code (Impact Analysis, Source Code documentation, Call trees, CRUD matrix, etc.).