Which Static Analyzer Should I Use?

Quick answer

Decision flow

Budget?
├── Free / open source
│   ├── Already using Clang/LLVM?
│   │   └── YES → clang-tidy (best tool selection, CMake integration)
│   │
│   ├── Need dataflow analysis (null deref, resource leaks)?
│   │   └── YES → cppcheck or Facebook Infer
│   │
│   └── Everything → clang-tidy + cppcheck (complementary)
│
└── Commercial
    ├── Need certified MISRA/AUTOSAR compliance?
    │   └── YES → QA-C, Polyspace, or Axivion
    │
    ├── Very large codebase (millions of LOC)?
    │   └── YES → Coverity (scales well, trusted in aerospace/auto)
    │
    └── Good precision, reasonable price → PVS-Studio

clang-tidy

Best for: everyday C++ quality checks, modernization, bug detection.

• 300+ checks: bugprone-*, modernize-*, performance-*, cppcoreguidelines-*
• Auto-fixes for many checks (clang-tidy --fix)
• Integrates with CMake: CMAKE_CXX_CLANG_TIDY
• Fast, runs per translation unit
• Free, part of LLVM

# .clang-tidy
Checks: >
  bugprone-*,
  modernize-use-nullptr,
  modernize-use-override,
  performance-*,
  -modernize-use-trailing-return-type
WarningsAsErrors: 'bugprone-*'

Limitation: limited inter-procedural analysis; misses some cross-TU bugs.

cppcheck

Best for: finding real bugs through dataflow analysis without a compile step.

• Detects null pointer dereferences, out-of-bounds, uninitialized variables, resource leaks
• Works on code that doesn't compile (partial analysis possible)
• Low false positive rate by design
• Free, open source

cppcheck --enable=all --std=c++20 --error-exitcode=1 src/
cppcheck --enable=warning,style,performance,portability src/

Limitation: may miss complex bugs that require full symbol resolution.

PVS-Studio

Best for: teams needing commercial precision with good IDE/CI integration.

• Deep inter-procedural analysis with low false positive rate
• Supports C, C++, C#, Java, Kotlin
• IDE plugins (VS, CLion, Qt Creator), CI integration (GitHub Actions, Jenkins)
• Good at finding: 64-bit issues, copy-paste errors, micro-optimizations
• Commercial (free for open source projects)

pvs-studio-analyzer analyze -o pvs.log -- cmake --build .
plog-converter -a GA:1,2 -t errorfile pvs.log

Coverity (Synopsys)

Best for: large codebases in regulated industries (aerospace, medical, automotive).

• Industry-standard tool; many safety standards require it
• Very low false positive rate (tuned over many years)
• Interprocedural, cross-file analysis
• Detects: memory leaks, concurrency bugs, injection vulnerabilities
• Commercial, cloud or on-premises

Used by major open source projects (Linux kernel, Firefox, LibreOffice) via free scan service.

Facebook Infer

Best for: finding resource leaks, null dereferences through bi-abduction.

• Open source (MIT license)
• Originally for Java/Android but supports C/C++ via clang
• Finds: memory leaks, null dereferences, buffer overflows
• Used at Meta, Amazon, Mozilla at scale

infer run -- make

Limitation: C++ support is less mature than Java; may struggle with complex templates.

SonarQube / SonarCloud

Best for: unified security + quality dashboard across languages.

• Combines static analysis with security vulnerability detection (OWASP rules)
• Dashboard with history, quality gates, and PR decoration
• Supports C++ (via its own engine + clang integration)
• Commercial (SonarCloud free for public repos)

Running multiple analyzers

clang-tidy and cppcheck complement each other — they find different bugs:

# GitHub Actions — run both
- name: clang-tidy
  run: |
    cmake -DCMAKE_CXX_CLANG_TIDY=clang-tidy -B build
    cmake --build build 2>&1 | grep "warning:"

- name: cppcheck
  run: |
    cppcheck --enable=all --error-exitcode=1 \
             --suppress=missingInclude src/

MISRA and safety-critical

For ISO 26262 (automotive), DO-178C (avionics), or IEC 62443 (industrial):

clang-tidy has cert-* and cppcoreguidelines-* checks that overlap with MISRA but are not a certified MISRA checker.

Complementary tools (not static analyzers but often used together)