Static Code Analysis
lastmod 2025-11-05created 2015-05-155 edits
Static program analysis (Static Code Analysis) is one method of analyzing computer software in which the programs built from that software are analyzed without actually running them. (Analyzing a program by running it is dynamic program analysis.) In most cases the analysis is performed on source code, but sometimes it is performed on object code. Generally, analysis performed by a person with some understanding of the program using automated tools is called static program analysis.
The sophistication of the analysis varies by tool, from analyzing individual statements and declarations to analyzing the program's entire source code. How the analyzed information is used also varies, from flagging possible coding errors to formal methods that mathematically prove that a program satisfies certain properties (e.g., checking whether the program's behavior matches a given specification).
Categories
- Globstar - Open-source static analysis toolkit
Tables
| Multi-language | Axivion Bauhaus Suite, Black Duck Suite, BugScout, CAST Application Intelligence Platform, ChecKing, Coverity Static Analysis (formerly Coverity Prevent), DevPartner, DMS Software Reengineering Toolkit, Compuware DevEnterprise, GrammaTech CodeSonar, HP Fortify Source Code Analyzer, IBM Rational AppScan Source Edition, Imagix 4D, JustCode, Klocwork Insight, LDRA Testbed, MALPAS, Micro Focus, Moose, Parasoft, Copy/Paste Detector (CPD), Polyspace, ProjectCodeMeter, Protecode, Rational Software Analyzer, ResourceMiner, SofCheck Inspector, Sonar, Sotoarc/Sotograph, SPARROW, Syhunt Sandcat, Understand, Veracode, Visual Studio Team System, Yasca, RATS |
| .NET | FxCop, Gendarme, StyleCop, CodeIt.Right, CodeRush, Parasoft dotTEST, JustCode, NDepend, ReSharper, Kalistick |
| ActionScript | Apparat |
| Ada | AdaControl, AdaCore CodePeer, LDRA Testbed, Polyspace, SofCheck Inspector |
| BLAST, CppCheck, cpplint, Clang, Coccinelle, Eclipse (software), Flawfinder, Frama-C, FlexeLint, Green Hills Software DoubleCheck, Intel, Lint, LDRA Testbed, Monoidics INFER, Parasoft C/C++test, PC-Lint, Polyspace, PVS-Studio, QA-C (QA-C++), Red Lizard's Goanna, Lint, SLAM project, Sparse, Splint | |
| AgileJ StructureViews, Checkstyle, FindBugs, Hammurapi, PMD, Soot, Squale, Jtest, LDRA Testbed, SemmleCode, SonarJ, Kalistick | |
| Closure Compiler, JSLint, JSHint | |
| Perl::Critic, PerlTidy, Padre | |
| Pychecker, Pylint | |