C++

C++ Static Analysis

clang-tidy, cppcheck, PVS-Studio, and include-what-you-use — compared on check depth, false-positive rate, CI fit, and cost.

Recommended stack

clang-tidy — primary linter, run on every PR.
cppcheck — fast pre-commit gate, catches memory bugs fast.
IWYU — periodic include cleanup, speeds up builds.

Comparison matrix

Propertyclang-tidycppcheckPVS-StudioIWYU
LicenseFree / Apache 2.0Free / GPL v3Commercial (free for OSS)Free / MIT
False positive rateLow–MediumVery lowMediumMedium
Analysis speedSlow (full AST parse)FastModerateModerate
CMake integration
Auto-fix
clang-tidy
Free / Apache 2.0

The standard choice. 400+ checks, AST-based, integrates with clangd for IDE hints, runs in CI.

Key checks

  • modernize-* (C++11/14/17/20 upgrades)
  • performance-* (inefficient STL use, pass-by-value)
  • readability-* (naming, identifier length)
  • bugprone-* (integer overflow, suspicious includes)
  • cppcoreguidelines-* (C++ Core Guidelines)
  • clang-analyzer-* (deep data-flow analysis)

Weaknesses

  • Slow — can double your CI build time
  • Requires compile_commands.json
  • Some checks are noisy by default
Full guide
cppcheck
Free / GPL v3

Fast, zero false-positives philosophy, finds memory errors and UB without a full compiler.

Key checks

  • Memory leaks, use-after-free
  • Out-of-bounds array access
  • Uninitialized variables
  • Null pointer dereference
  • Division by zero
  • Dead code, unused variables

Weaknesses

  • Fewer checks than clang-tidy
  • No autofix
  • Template analysis is limited
Full guide
PVS-Studio
Commercial (free for OSS)

Commercial-grade deep analysis. Best at finding bugs in large, complex codebases. MISRA certified.

Key checks

  • 64-bit portability issues
  • Micro-optimizations & inefficient code
  • Security vulnerabilities (OWASP Top 10)
  • MISRA C/C++ compliance
  • Deep inter-procedural analysis
  • Typos in code (copy-paste errors)

Weaknesses

  • Commercial license for closed-source
  • Requires PVS-Studio account
  • More false positives than cppcheck
IWYU
Free / MIT

Include What You Use — removes redundant #includes, speeds up compile times, enforces hygiene.

Key checks

  • Redundant #include directives
  • Missing direct includes (relying on transitive includes)
  • Forward declaration opportunities

Weaknesses

  • Some suggestions require manual review
  • Can break code relying on transitive includes
  • Limited to include hygiene only
Full guide

GitHub Actions CI — clang-tidy + cppcheck

- name: Run clang-tidy
  run: |
    cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
    run-clang-tidy -p build -checks='-*,modernize-*,bugprone-*,performance-*'

- name: Run cppcheck
  run: |
    cppcheck --enable=all --error-exitcode=1 \
             --suppress=missingIncludeSystem \
             --project=build/compile_commands.json

Deep-dive guides

clang-tidy

Static analysis and linting for C++ — checks for bugs, style issues, modernization opportunities, and performance problems.

Cppcheck — Static Analysis

Cppcheck for C++ — running checks, suppressing false positives, CMake integration, CI setup, and comparison with clang-tidy.

include-what-you-use (IWYU)

include-what-you-use tool — fixing redundant and missing includes, CMake integration, IWYU mappings, pragma directives, and CI integration.

Static Analysis Tools

C++ static analysis — clang-tidy, cppcheck, PVS-Studio, SonarQube, Coverity, compiler warnings, and CI integration.