This is a roundup of most of the available static analysis tools for popular programming languages like C, C++, Java, and so on. Add a comment if you find one we missed. The tools are grouped by open source and commercial licensing as that often dictates which tool you might want to use. We also provide this information in tabluar form (PDF and Excel format).

The initial list was created using AI chatbots, but then I vetted and annotated the tables. You can jump down to the Table of Contents if you just want to check out individual products. 

We're interested in what you know or if you use static analysis tools, so take our quick poll below. You can also add a comment (see the tiny icon above or scroll way past the end of the article till you see Comment About the Article.

Why Static Analysis is Important

Compilers do basic static analysis all the time. Some do more advanced analysis these days, such as checking if a variable is used before it's initialized. Typically, these checks are based on implicit information. However, some programming languages provide explicit information like type information that the compiler uses to make sure the programmer isn't providing erroneous code. Static analysis, static application security testing (SAST), and software composition analysis (SCA) tools are designed to identify problems before a program even runs. 

Some programming languages provide even more explicit information, such as Ada contracts. This allows a programmer to specify function parameter and result conditions that are checked at compile time. Most other programming languages need to resort to runtime checks if they want to do something similar.

Note, this isn't the same thing as using something like C's assert, which validates compile time expressions. C++26 has added a form of contracts to the language. Contracts allow static analysis to essentially prove the operation of a program at compile time. SPARK is a version of Ada that can perform these proofs, significantly reducing the possiblities of errors in an application. 

Standards like MISRA C/C++ place additional restrictions on programs that can be checked by static analysis tools. For example, MISRA C has rules that must be followed; for example, using arrays instead of pointers for accessing data. This approach typically allows programmers to indicate that a particular rule will not be followed, but then it's up to the programmer to check for errors that might occur because the recommendations are being ignored. 

Who Should Be Using Static Analysis?

In a word, everyone. 

Anyone who thinks they can generate code without errors has probably done very little coding or simply ignores the bugs in their code. Bugs come in all shapes and sizes, and a lot of them can be detected and prevented using static analysis. Static analysis will not catch all bugs, but it will prevent a significant number of them from showing up in your code if you use the tools. 

The challenge with using static analysis tools concerns the amount of information returned by the tools as well as false positive and false negative results. It can also be a challenge to start using the tools with existing code because of the number of potential bugs that it finds. The larger the application, the larger the error list will be if these tools aren't used from the beginning. 

Static Analysis and AI

Believers in vibe coding often talk about doing away with programmers. In a simlar vein, using AI to check your application might be a good idea given how many bugs AI has found in applications to date. You don't want to depend on AI for everything, though, as it tends to be inefficient compared to static analysis tools for finding particular bugs.

In general, the compiler, static analsys tools, and AI evaluation of your code should be the mix used to check for errors before even running the code. Then you need to move on to things like unit checks and fuzzing for run-time analysis. 

AI is actually playing a big part in static analysis after the tools find errors. AI can provide context about the identified problem along with recommendations on how to fix the issue. It can help identify results like false positives. 

Product Table of Contents

This next section is a list of tools that you should consider for your development projects. The programming languages you use may dictate which tools are viable for you. 

• Commercial Static Analysis Products (download PDF, Excel)
  • Sonar — SonarQube
  • BlackDuck — Coverity
  • OpenText — Fortify Static Code Analyzer
  • Checkmarx — Checkmarx SAST
  • Veracode — Veracode Static Analysis
  • Snyk — Snyk Code
  • Perforce Software — Klocwork
  • PVS-Studio — PVS-Studio
  • Semgrep — Semgrep AppSec Platform
  • Parasoft — C/C++test
• Open-Source Static Analysis Programs (download PDF, Excel)
  • GitHub — CodeQL
  • Semgrep — Semgrep Community Edition
  • LLVM Project — Clang Static Analyzer
  • Cppcheck — Cppcheck
  • Meta — Infer
  • SpotBugs community — SpotBugs
  • Python Code Quality Authority — Bandit
  • Brakeman project — Brakeman
  • Frama-C community — Frama-C
  • CodeChecker project — CodeChecker
  • OpenGrep community — OpenGrep
  • Flawfinder project — Flawfinder

Commercial Static Analysis Products

Sonar — SonarQube

Company: Sonar
Product: SonarQube Server / SonarQube Cloud
Type: General-purpose static code analysis, code quality, and SAST
Open Source: Yes — Community Build
Commercial: Yes
Programming Languages: Java, C#, C++, Python, JavaScript, TypeScript, and more
Feature: Quality gates, maintainability metrics, and configurable code-quality policies
Integrations: GitHub; GitLab

SonarQube has a cloud and server-based solution that can be useful for large projects. It enforces code-quality criteria in CI/CD pipelines and code reviews. Its Advanced Security version will help secure open-source code with SAST and SCA support. 

Back to Table of Contents

BlackDuck — Coverity

Company: BlackDuck
Product: Coverity
Type: Deep static defect analysis and application security testing
Open Source: No
Commercial: Yes
Programming Languages: 22 languages including C, C++, Java, C#, JavaScript, and Python
Feature: Deep defect analysis designed for complex codebases and enterprise-scale defect management
Integrations: Jenkins; GitHub

Coverity detects programming defects and security weaknesses in large codebases. It can handle standards like MISRA, ISO 26262, and ISO/IEC TS 17961.

Back to Table of Contents

OpenText — Fortify Static Code Analyzer

Company: OpenText
Product: Fortify Static Code Analyzer
Type: Enterprise application security static analysis (SAST)
Open Source: No
Commercial: Yes
Programming Languages: Java, C, C++, C#, JavaScript, Python, and more
Feature: Enterprise security governance and vulnerability-management workflows
Integrations: Jenkins; GitHub

Focusing on security vulnerabilities in application code, Fortify is designed to reduce false positives. It supports over 250 frameworks. The tool is designed for integration with CI/CD pipelines and addresses industry security standards.

Back to Table of Contents

Checkmarx — Checkmarx SAST

Company: Checkmarx
Product: Checkmarx SAST
Type: Enterprise static application security testing
Open Source: No
Commercial: Yes
Programming Languages: Java, C#, JavaScript, TypeScript, Python, C++, and more
Feature: Enterprise-oriented application security workflows for managing findings across development teams
Integrations: GitHub; GitLab

Checkmarx SAST is one of many hybrid scanning engines for Checkmarx One and Checkmarx Fusion. Checkmarx One includes AI agents for development, triage, and remediation, as well as an MCP server for integration with your LLM.

Back to Table of Contents

Veracode — Veracode Static Analysis

Company: Veracode
Product: Veracode Static Analysis
Type: Application security static analysis (SAST)
Open Source: No
Commercial: Yes
Programming Languages: Java, C, C++, C#, JavaScript, Python, and more
Feature: Hosted application-security workflows and centralized reporting across application portfolios
Integrations: Jenkins; GitHub

Veracode provides a range of tools, including SAST and SCA. There's also Veracode DAST (dynamic application security testing) for real-time web-based applications. SAST support is designed to integrate with CI/CD pipelines. It covers over 100 languages and frameworks. The real-time IDE scan works with IDEs to help fix detected flaws. 

Back to Table of Contents

Snyk — Snyk Code

Company: Snyk
Product: Snyk Code
Type: Developer-oriented SAST
Open Source: No
Commercial: Yes
Programming Languages: Java, JavaScript, TypeScript, Python, C#, Go, and more
Feature: Developer-focused security feedback and remediation guidance integrated into coding workflows
Integrations: GitHub; GitLab

Snyk Code focuses on bugs and security issues. It's one of the security engines that also includes Snyk Open Source to address open-source vulnerablilities and Snyk Container for securing container images. Snyk Secrets is designed to prevent hardcoded secrets in an application. 

Back to Table of Contents

Perforce Software — Klocwork

Company: Perforce Software
Product: Klocwork
Type: Static defect analysis, coding-standard compliance, and security testing
Open Source: No
Commercial: Yes
Programming Languages: C, C++, C#, Java, JavaScript, and Python, subject to version and edition
Feature: Coding-standard compliance and analysis of large embedded and enterprise codebases
Integrations: Jenkins; Visual Studio

Perforce Software's Static Analysis Tools includes Klocwork SAST. Combined with Perforce QAC quality and compliance software, it forms Perforce Validate for generating compliance and security reports. Klocwork can be integrated with CI/CD pipelines to shorten development cycles. 

Back to Table of Contents

PVS-Studio — PVS-Studio

Company: PVS-Studio
Product: PVS-Studio
Type: Static code analysis and SAST
Open Source: No
Commercial: Yes
Programming Languages: C, C++, C#, Java, Go, JavaScript, and more
Feature: Broad language coverage spanning native, managed, and web development
Integrations: Visual Studio; Jenkins

PVS-Studio focuses on static analysis. It can support standards like MISRA. The tool has a different licensing terms, including a free one for open-source projects. Sounds like a good way to improve an open-source project's reliability. 

Back to Table of Contents

Semgrep — Semgrep AppSec Platform

Company: Semgrep
Product: Semgrep AppSec Platform / Semgrep Code
Type: Static application security testing and code security
Open Source: Yes — LGPL-2.1 for the separate Community Edition engine
Commercial: Yes
Programming Languages: Java, JavaScript, TypeScript, Python, Go, C, and more
Feature: Custom rule writing using patterns designed to resemble the target programming language
Integrations: GitHub; GitLab

Semgrep has a Community Edition that works with macOS, Windows, and Linux. There's also a Docker version. The commercial version adds features and support where Semgrep Code is just part of the solution that focuses on SAST. The solutions support agentic AI workflows. 

Back to Table of Contents

Parasoft — C/C++test

Company: Parasoft
Product: C/C++test
Type: C/C++ static analysis, coding-standard compliance, and software testing
Open Source: No
Commercial: Yes
Programming Languages: C, C++, Java (via Jtest)
Feature: Combines static analysis with a broader C/C++ verification workflow for demanding development environments
Integrations: Eclipse; Jenkins

Parasoft. which focuses on just C and C++, supports embedded and safety-critical projects that must enforce coding standards and meet safety and security requirements. C/C++test CT adds code coverage suport. Java is handled by a separate tool named Jtest that provides similar features. 

Back to Table of Contents

Open-Source Static Analysis Programs

GitHub — CodeQL

Company: GitHub
Product: CodeQL
Type: Query-based static analysis and security vulnerability detection
Open Source: MIT — CodeQL CLI; query libraries have their own licenses
Commercial: Yes
Programming Languages: C, C++, C#, Java, JavaScript, Python, and more
Feature: Dedicated query language and database representation for writing sophisticated, reusable program analyses
Integrations: GitHub Actions; Visual Studio Code

If you use GitHub, then you've probably run into CodeQL. This database system can be queried to find vulnerability patterns, unsafe data flows, and other defects. That makes it different from most of the SAST and SCA tools, as it's complementary to these tools.

Back to Table of Contents

Semgrep — Semgrep Community Edition

Company: Semgrep
Product: Semgrep Community Edition
Type: Pattern-based static analysis and SAST
Open Source: LGPL-2.1 — engine
Commercial: Yes
Programming Languages: Java, JavaScript, TypeScript, Python, Go, C, and more
Feature: Accessible custom rule development using code-shaped patterns
Integrations: GitHub Actions; GitLab CI

Semgrep CE is the base for Semgrep's commercial tool. It doesn't have all of the bells and whistles of the latter, but is more than sufficient for doing a good bug finding job. It can handle CI/CD pipelines as well as perform custom coding-standard enforcement.

Back to Table of Contents

LLVM Project — Clang Static Analyzer

Company: LLVM Project
Product: Clang Static Analyzer
Type: Path-sensitive static bug analysis
Open Source: Apache-2.0 with LLVM exceptions
Commercial: No
Programming Languages: C, C++, Objective-C
Feature: Path-sensitive symbolic execution integrated with the Clang compiler ecosystem
Integrations: CMake; Xcode

LLVM is the base for a class of compilers including major embedded languages: C and C++. It also handles Objective-C. The Clang Static Analyzer uses symbolic execution and path-sensitive reasoning to find defects. It handles the typical static analysis checks like null-pointer dereferences.

Back to Table of Contents

Cppcheck — Cppcheck

Company: Cppcheck project
Product: Cppcheck
Type: C/C++ static defect analysis
Open Source: GPL-3.0 — community edition
Commercial: Yes
Programming Languages: C, C++
Feature: Lightweight C/C++ analysis designed to complement compiler warnings
Integrations: CMake; Jenkins, CodeChecker

Cppcheck focuses on C and C++. It started as an open-source project and evolved into a commercial version as well. The tool is designed to minimize false positives. It can handle standards like MISRA C 2023, MISRA C++ 2023, MISRA C 2025, and AUTOSAR C++ 2014. Also addressed are security standards like CERT C, CERT C++, and Top 25 CWE.

Back to Table of Contents

Meta — Infer

Company: Meta
Product: Infer
Type: Static program analysis using symbolic reasoning
Open Source: MIT
Commercial: No
Programming Languages: Java, C, C++, Objective-C
Feature: Interprocedural analysis intended to identify certain defects without requiring exhaustive execution of the program
Integrations: Buck; Maven, CodeChecker

Infer is open source and written in OCaml, a functional programming language. A tool used by Meta, it leverages bi-abductive, interprocedural analysis to identify potential defects instead of relying solely on pattern matching. It doesn't focus on compliance standards like MISRA C. Infer is good at doing data flow analysis.

Back to Table of Contents

SpotBugs community — SpotBugs

Company: SpotBugs community
Product: SpotBugs
Type: Java bytecode static analysis
Open Source: LGPL-2.1
Commercial: No
Programming Languages: Java
Feature: Bytecode-based bug detection that can analyze compiled classes independently of a particular source-code editor
Integrations: Maven; Gradle

SpotBugs focuses on Java. It deals with compiled Java bytecode to idenfity common bug patterns, suspicious control flow, and potential correctness problems. It's the community-supported successor to FindBugs.

Back to Table of Contents

Python Code Quality Authority — Bandit

Company: Python Code Quality Authority
Product: Bandit
Type: Python security static analysis
Open Source: Apache-2.0
Commercial: No
Programming Languages: Python
Feature: Plug-in-based security checks focused specifically on Python source code
Integrations: pre-commit; GitHub Actions

Python has been important for web-based solutions, but it has also become the darling for AI management and configuration. So, keeping bugs out of these applications is important. 

Bandit only handles Python source code and focuses on SAST. It parses code into abstract syntax trees and applies security checks to detect potentially risky function calls, insecure configurations, and other common coding problems.

Back to Table of Contents

Brakeman project — Brakeman

Company: Brakeman project
Product: Brakeman
Type: Ruby on Rails security static analysis
Open Source: MIT
Commercial: No
Programming Languages: Ruby
Feature: Framework-aware security analysis specifically designed for Ruby on Rails
Integrations: GitHub Actions; Jenkins

Ruby on Rails use is common for SaaS platforms and web applications. It's not really used in embedded applications. Brakeman provides SAST functionality looking for security vulnerabilities. Its framework-specific rules let developers target risks associated with Rails conventions and web-application development.

Back to Table of Contents

Frama-C community — Frama-C

Company: Frama-C community
Product: Frama-C
Type: C program analysis and formal verification
Open Source: LGPL-2.1-or-later for the open-source core; component-specific terms may vary
Commercial: Yes
Programming Languages: C
Feature: Plug-in architecture supporting formal verification against program specifications
Integrations: Why3; GCC

Frama-C focuses on analyzing and verifying C programs. The plug-in architecture can be customized by developers. It supports value analysis, formal specification, and deductive verification. It's been used for certification of some projects that needed to meet DO-178, IEC 60880, and Common Criteria EAL 6-7 requirements. More details can be found in the book, Guide to Software Verification with Frama-C. 

Back to Table of Contents

CodeChecker project — CodeChecker

Company: CodeChecker project
Product: CodeChecker
Type: Static analysis result management and defect triage
Open Source: Apache-2.0
Commercial: No
Programming Languages: C, C++ (through compatible analysis engines)
Feature: Centralized review and comparison of analysis results from compatible underlying analyzers
Integrations: Clang Static Analyzer; Cppcheck

CodeChecker builds on the Clang Static Analyzer mentioned earlier. It's more of a tool for helping teams collect, compare, review, and manage static analysis results. It supports other tools like CppCheck and Infer. 

Back to Table of Contents

OpenGrep community — OpenGrep

Company: OpenGrep community
Product: OpenGrep
Type: Pattern-based static analysis and security scanning
Open Source: LGPL-2.1 — verify the current repository for applicable components and versions
Commercial: No
Programming Languages: Java, JavaScript, TypeScript, Python, Go, C, and more, subject to current compatibility
Feature: Community-governed alternative in the Semgrep-compatible static-analysis ecosystem
Integrations: GitHub Actions; GitLab CI

OpenGrep is a community-governed fork of Semgrep's open-source engine. It's intended for teams that want an open implementation of pattern-based code analysis and reusable security rules. It handles a range of programming languages. 

Back to Table of Contents

Flawfinder project — Flawfinder

Company: Flawfinder project
Product: Flawfinder
Type: C/C++ security source-code scanner
Open Source: GPL-2.0-or-later
Commercial: No
Programming Languages: C, C++
Feature: Risk-ranked detection of potentially dangerous C/C++ functions with minimal setup
Integrations: GitHub Actions; Jenkins

Flawfinder scans C and C++ source code for potentially dangerous functions and security weaknesses, including unsafe string operations and risky command execution. It assigns risk levels to findings and is best treated as a supplementary scanner.

Back to Table of Contents