model-checking/kani

Kani is a bit-precise model checker for Rust that automatically verifies safety and correctness properties of Rust code.

Kani addresses the challenge of ensuring that Rust programs are free from undefined behavior and satisfy correctness requirements. It works by exhaustively checking all possible inputs to a harness function you write, using the `kani::any()` construct to explore the input space. The tool automatically detects undefined behavior in unsafe code blocks, panics from operations like `unwrap()` on `None`, arithmetic overflows, and violations of custom correctness properties expressed as assertions or function contracts. Rather than relying on testing with specific inputs, Kani attempts to prove that all valid inputs produce safe and correct outputs.

Kani suits projects where safety guarantees matter, particularly those containing unsafe code blocks that the Rust compiler cannot fully verify. It works well for libraries and systems code where undefined behavior could have serious consequences, and for code where exhaustive correctness checking is more valuable than traditional testing. The tool integrates into CI pipelines through a GitHub Action, making it practical to run verification checks automatically.

The project maintains active regression testing and tracks compatibility with the latest version of CBMC, the underlying model-checking engine. Development includes ongoing work on experimental features such as function contracts for expressing specifications. The tool supports Rust 1.58 and later on Linux and Mac platforms, with installation and usage documented through a tutorial and comprehensive book.