Ericsson/codechecker

CodeChecker is a static analysis infrastructure built on the LLVM/Clang Static Analyzer toolchain that replaces scan-build in Linux and macOS development environments.

The tool addresses the challenge of running multiple static analyzers across C and C++ codebases and managing their results. It works by executing various analyzers—including Clang-Tidy, Clang Static Analyzer with Cross-Translation Unit analysis, Cppcheck, GCC Static Analyzer, and Facebook Infer—against code. It creates JSON compilation databases by wiretapping build processes, automatically detects and handles GCC cross-compiled projects, and supports incremental analysis so only changed files and their dependencies are reanalyzed. Results can be suppressed with review comments and viewed either from the command line or in static HTML.

Teams working on C and C++ projects should consider CodeChecker if they want to consolidate multiple analyzer tools into a single workflow rather than running each analyzer separately. It suits projects where build integration is straightforward and where teams need a centralized way to track and review static analysis findings across the codebase. The tool provides both command-line and web-based interfaces for result inspection, making it adaptable to different team workflows.

The project maintains active test coverage through continuous integration workflows. Documentation is kept current and accessible through a dedicated documentation site. The codebase shows ongoing maintenance with security scorecard tracking in place.