This is a list of notable tools for static program analysis (program analysis is a synonym for code analysis).
Static code analysis tools
Tool Latest release Free software Languages supported NotesAda C, C++, C#, JVMJavaScript, TypeScript.NET, VB.NETPython Other languagesAstrée 2024-10 (24.10) ; proprietary C, C++ Axivion Suite2025-05-19 (7.10) ; proprietary C, C++, C# QML, Axivion CUDA BLAST (retired) 2015-10-30 (2.7.3) ; ASL 2 C Clang () ; ASL 2 with LLVM Exceptions C, C++, Objective-C Coccinelle 2021-09-06 (1.1.1) ; GPLv2 C Code Dx (Defunct 2021) 2015-01-15 ; proprietary C, C++, C# Java, JSP, Scala JavaScript VB.NET Python PHP, Rails, Ruby, XML CodePeer 2021-05-07 (21) ; proprietary Ada CodeScene 2023-10-13 (6.3.5) ; proprietary C, C++, C#, Objective-C Java, Groovy, Scala JavaScript, TypeScript VB.NET Python Swift, Go, PHP, Ruby CodeQL 2026-02-05 (CLI: 2.24.1) ; proprietary C, C++, C# Java, Kotlin JavaScript, TypeScript .NET Python Swift, Go, Ruby, Rust ConQAT (retired) 2015-02-01 ; ASL 2 Ada C#, C++ Java JavaScript ABAP Coverity 2023-04-29 (2022.12) ; proprietary C, C++, C#, Objective-C Java JavaScript, TypeScript Python Ruby, PHP ECLAIR 2025-05-12 (3.14.0) ; proprietary C, C++ CPAchecker 2022-01-24 (2.1.1) ; ASL 2 C Cppcheck 2025-02-23 (2.17) ; framework is GPL v3, with some proprietary features C, C++ Cppdepend 2023-03-01 (2023.1) ; proprietary C, C++ Cpplint 2020-07-29 ; CC-BY-3.0 C++ Fluctuat 2001 ; proprietary Ada95 C Fluid Attacks2026-01-07 ; proprietary C# Java, Kotlin, Scala JavaScript, TypeScript Python PHP, Dart, Go, HCL, HTML, JSON, Ruby, Swift, XML, YAML Frama-C 2022-06-21 ; LGPL v2.1, BSD, QPL C AdaCore CodeSonar 2020-06-01 (5.3) ; proprietary C, C++, Objective-C Java GCC 2023-4-26 (13.1); GPLv3+ with GCC Runtime Library Exception C HCL Security AppScan Source 2020-12-01 (10.0.3) ; proprietary C, C++ Java, JSP JavaScript .NET Python ColdFusion, ASP, PHP, Perl, Visual Basic 6, PL/SQL, T-SQL, COBOL Helix QAC 2023-04 (2023.1) ; proprietary C, C++ Infer Static Analyzer () ; MIT C, C++, Objective-C Java Imagix 4D 2020-10-01 (10.1.0) ; proprietary C, C++ Java Kiuwan 2020-07-22 ; proprietary C, C++, C#, Objective-C Java, JSP JavaScript VB.NET ABAP, COBOL, PHP, PL/SQL, T-SQL, SQL, Visual Basic, Android Klocwork 2023-04-04 (2023.1) ; proprietary C, C++, C# Java JavaScript Python Kotlin Lint 1978-07-26 ; permissive BSD-like C MALPAS ; proprietary Ada C Pascal, Assembler (Intel, PowerPC and Motorola) Moose 2021-01-21 (7.0.3) ; MIT C, C++ Java .NET Smalltalk NDepend 2022-03-16 (2022.1) ; proprietary C# VB.NET .NET .NET Compiler Platform (Roslyn) () ; MIT C# VB.NET Parasoft C/C++test 2024-12-03 (2024.2) ; proprietary C, C++ Parasoft Jtest 2024-12-03 (2024.2) ; proprietary Java PC-lint Plus 2022-08-02 (2.0 Beta 2) ; proprietary C, C++ PMD 2025-11-28 (7.19.0) ; BSD-like C, C++ Java, Kotlin, Scala, JSP, Apache Velocity Template Language (VTL) JavaScript Apex, ColdFusion, HTML, PHP, PLSQL, Swift, Visualforce, XML, Maven POM, WSDL, XSL Polyspace 2022-09-15 ; proprietary Ada C, C++ Pretty Diff () ; CC0 JavaScript, TypeScript Markup, script and style languages (like XML, CSS) PVS-Studio () ; proprietary C, C++, C++/CLI, C++/CX, C# Java Qodana 2023-07-23 (2023.2) ; proprietary C# Java, Kotlin JavaScript, TypeScript VB.NET Python Go, HTML, PHP, CSS, Android, Vue.js RIPS 2020-02-17 (3.4) ; proprietary Java PHP Semgrep () ; LGPL v2.1 Java JavaScript, TypeScript Python Go, JSON, PHP, Ruby, language-agnostic mode Sider 2021-02-02 ; proprietary JavaScript, CoffeeScript Python Ruby, PHP, Go SLAM project 2010-07-14 ; proprietary C SofCheck Inspector, Codepeer 2020-08-24 (21.x) ; proprietary Ada Java SonarQube 2024-02-05 (10.4) ; framework is LGPL v3.0, but some features can be proprietary C, C#, C++, Objective-C Java, Kotlin, Scala JavaScript, TypeScript VB.NET Python ABAP, Apex, CSS, COBOL, Flex, Go, HTML, PHP, PLI, PL/SQL, Ruby, Swift, TSQL, Visual Basic 6, XML SourceMeter 2016-12-16 (8.2) ; proprietary C, C++ Java Python RPG IV (AS/400) Sourcetrail (retired) 2021-04 (2021.4.19) ; GPL C, C++ Java Python Perl Sparse 2021-09-06 (0.6.4) ; MIT C GCC extensions Splint 2007-07-12 (3.1.2) ; GPLv2 C StyleCop 2016-05-02 (2016.1.0) ; Ms-PL C# .NET Squore 2020-11-27 (20.1) ; proprietary Ada C, C++, C#, Objective-C Java JavaScript, TypeScript VB.NET Python Fortran, PHP, PL/SQL, Swift, T-SQL, XAML Understand 2023-01-19 (6.3) ; proprietary Ada C, C++, C#, Objective-C Java JavaScript Python FORTRAN, Jovial, Pascal, VHDL, HTML, PHP, XML Visual Expert2021-09-10 ; proprietary PowerBuilder, Oracle PL/SQL, SQL Server Transact-SQL (T-SQL) Visual Studio 2021-10-12 (16.11) ; proprietary C, C++, C# VB.NET Yasca (retired) 2010-11-01 (2.21) ; multiple licenses C, C++ Java JavaScript ASP, PHP, HTML, CSS, ColdFusion, COBOL Tool Release Free software Languages supported Notes
Languages
Ada
C, C++
Axivion Suite (Bauhaus)
C#
Axivion Suite (Bauhaus)
Fluid Attacks
IEC 61131-3 CODESYS Static Analysis integrated add-on for CODESYS (application code realized e.g. in ST, FBD, LD)
Java Tool Latest release Free software Duplicatecode NotesCheckstyle 2020-01-26 ; LGPL Besides some static code analysis, it can be used to show violations of a configured coding standard. Duplicate code detection was removed from Checkstyle.Eclipse 2017-06-28 ; EPL Cross-platform IDE with own set of several hundred code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. Plugins for Checkstyle, FindBugs, and PMD.FindBugs 2015-03-06 ; LGPL Based on Jakarta BCEL from the University of Maryland. SpotBugs is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community.IntelliJ IDEA 2021-04-06 ; ASL 2 A leading Java IDE with built-in code inspection and analysis. Plugins for Checkstyle, FindBugs, and PMD.JArchitect 2017-06-11 ; proprietary Simplifies managing a complex code base by analyzing and visualizing code dependencies, defining design rules, doing impact analysis, and by comparing different versions of the code.Jtest 2024-11-01 (2024.2) ; proprietary Testing and static code analysis product by Parasoft.Soot 2020-10-28 ; LGPL A language manipulation and optimization framework consisting of intermediate languages.PMD 2025-11-28 ; BSD License Static code analyzer with support for plugins, including CPD. PMD supports checking of several languages.Squale 2011-05-26 ; LGPL A platform to manage software quality.ThreadSafe 2014-03-28 ; proprietary A static analysis tool focused on finding concurrency bugs.
Fluid Attacks
JavaScript ESLint JavaScript syntax checker and formatter. Google's Closure Compiler JavaScript optimizer that rewrites code to be faster and smaller, and checks use of native JavaScript functions. CodeScene Behavioral analysis of code. Fluid Attacks JSHint A community driven fork of JSLint. JSLint JavaScript syntax checker and validator.
Semgrep A static analysis tool that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
Objective-C, Objective-C++ Clang The free Clang project includes a static analyzer. As of version 3.2, this analyzer is included in Xcode. Infer Developed by an engineering team at Facebook with open-source contributors. Targets null pointers, leaks, API usage and other lint checks. Available as open source on github.
Opa Opa includes its own static analyzer. As the language is intended for web application development, the strongly statically typed compiler checks the validity of high-level types for web data, and prevents by default many vulnerabilities such as XSS attacks and database code injections.
Packaging Lintian Checks Debian software packages for common inconsistencies and errors. Rpmlint Checks for common problems in rpm packages.
Perl Perl::Critic A tool to help enforce common Perl best practices. Most best practices are based on Damian Conway's Perl Best Practices book. PerlTidy Program that acts as a syntax checker and tester/enforcer for coding practices in Perl. Padre An IDE for Perl that also provides static code analysis to check for common beginner errors.
PL/SQL TOAD A PL/SQL development environment with a Code xPert component that reports on general code efficiency as well as specific programming issues. Visual Expert A PL/SQL code analysis tool that reports on programming issues and helps understand and maintain complex code (Impact Analysis, Source Code documentation, Call trees, CRUD matrix, etc.).
PowerBuilder, PowerScript Visual Expert A tool scanning PowerBuilder libraries (PBLs) for code inspection, Impact Analysis, Source Code documentation, Call trees, CRUD matrix.
Python PyCharm Cross-platform Python IDE with code inspections available for analyzing code on-the-fly in the editor and bulk analysis of the whole project. PyDev Eclipse-based Python IDE with code analysis available on-the-fly in the editor or at save time. Pylint Static code analyzer. Quite stringent; includes many stylistic warnings as well. Fluid Attacks
Semgrep Static code analyzer that helps expressing code standards and surfacing bugs early. A CI service and a rule library is also available.
Transact-SQL Visual Expert A SQLServer code analysis tool that reports on programming issues and helps understand and maintain complex code (Impact Analysis, source code documentation, call trees, CRUD matrix, etc.).
Tools with duplicate code detection
Axivion Suite (Bauhaus)
Formal methods tools Tools that use sound, i.e. over-approximating a rigorous model, formal methods approach to static analysis (e.g., using static program assertions). Sound methods contain no false negatives for bug-free programs, at least with regards to the idealized mathematical model they are based on (there is no "unconditional" soundness). Note that there is no guarantee they will report all bugs for buggy programs, they will report at least one.
Astrée finds all potential runtime errors by abstract interpretation, can prove the absence of runtime errors and can prove functional assertions; tailored towards safety-critical C code (e.g. avionics). CodePeer Statically determines and documents pre- and post-conditions for Ada subprograms; statically checks preconditions at all call sites. ECLAIR Uses formal methods-based static code analysis techniques such as abstract interpretation and model checking combined with constraint satisfaction techniques to detect or prove the absence of certain run time errors in source code. ESC/Java and ESC/Java2 Based on Java Modeling Language, an enriched version of Java Frama-C An open-source analysis framework for C, based on the ANSI/ISO C Specification Language (ACSL). Its main techniques include abstract interpretation, deductive verification and runtime monitoring. KeY analysis platform for Java based on theorem proving with specifications in the Java Modeling Language; can generate test cases as counterexamples; stand-alone GUI or Eclipse integration MALPAS A formal methods tool that uses directed graphs and regular algebra to prove that software under analysis correctly meets its mathematical specification. Polyspace Uses abstract interpretation, a formal methods based technique, to detect and prove the absence of certain run time errors in source code for C/C++, and Ada SPARK Toolset including the SPARK Examiner Based on the SPARK language, a subset of Ada.
See also Automated code review Best Coding Practices List of software development philosophies Dynamic program analysis Software metrics Integrated development environment (IDE) and comparison of integrated development environments. IDEs will usually come with built-in support for static program analysis, or with an option to integrate such support. Eclipse offers such integration mechanism for most different types of extensions (plug-ins).
References
External links