- Home
- C and C++ Static Analysis Tools
- CodeChecker
CodeChecker
What it is
CodeChecker is free, open-source static analysis infrastructure built around LLVM and Clang Static Analyzer tooling. Command-line tools run supported analyzers against a JSON compilation database and generate reports. Its web interface stores, filters, compares, and visualizes findings, including bug paths, while reviewers can comment and assign review status. Reanalysis can be limited to changed files and their dependencies. Documented language coverage includes C/C++, C#, Java, Python, JavaScript, TypeScript, Go, and Markdown, with command-line support for tools such as Clang-Tidy, Clang Static Analyzer, Cppcheck, GCC Static Analyzer, and Facebook Infer. Gerrit and GitLab integrations, GitHub Actions, and a Visual Studio Code extension are listed. Users can run the server locally or deploy it with Docker, using PostgreSQL or SQLite. Authentication options include dictionary credentials, PAM, LDAP, and OAuth. CodeChecker requires Python 3.11 or later.
For and against
For
- Open-source and free to use
- Covers multiple programming and markup languages
- Provides report filtering and comparison
- Supports Gerrit, GitLab, and GitHub Actions
- Offers Visual Studio Code integration
Against
- Analysis runs only from the command line
- Server report uploads also require command line
- Windows build logging is unavailable
- Requires Python 3.11 or later
The verdict
CodeChecker combines local analyzer execution with web-based report management and review workflows. Its integrations and language coverage are broad, while command-line operation remains central to analysis and storage.
Who it suits
It suits development teams that need open-source analysis, report review, and CI/CD or editor integrations. It is relevant to projects using the listed programming languages and analyzers.
On the record
- Access control
- The server supports authentication and permissions scoped globally or by product; the documentation also describes LDAP and PAM as external authentication methods.codechecker.readthedocs.io · read 3 Oct 2026
- Analysis
- Its command-line tools run supported analyzers against a JSON compilation database and produce analysis results.codechecker.readthedocs.io · read 3 Oct 2026
- Analysis limitation
- Analysis runs locally and can only be invoked from the command line; storing reports to a server also requires the command line.codechecker.readthedocs.io · read 3 Oct 2026
- Analyzer support
- It runs Clang-Tidy, Clang Static Analyzer, Cppcheck, GCC Static Analyzer and Facebook Infer for command-line C/C++ analysis.codechecker.readthedocs.io · read 3 Oct 2026
- Authentication
- Server authentication options include dictionary credentials, PAM, LDAP and OAuth, with OAuth templates documented for GitHub, Google Workspace and Microsoft Entra.codechecker.readthedocs.io · read 3 Oct 2026
- Broader analyzer support
- The supported analyzer list includes tools for C/C++, C#, Java, Python, JavaScript, TypeScript, Go and Markdown.codechecker.readthedocs.io · read 3 Oct 2026
- Deployment
- The web server can be deployed using Docker, and the documentation links to a CodeChecker server container on Docker Hub.codechecker.readthedocs.io · read 3 Oct 2026
- Editor extension
- The Visual Studio Code extension can run analysis, reanalyze a file when saved, and browse reports in the editor.codechecker.readthedocs.io · read 3 Oct 2026
- Incremental analysis
- CodeChecker can limit reanalysis to changed files and their dependencies.codechecker.readthedocs.io · read 3 Oct 2026
- Integrations
- The documentation describes Gerrit and GitLab review integrations and a reusable GitHub Actions workflow.codechecker.readthedocs.io · read 3 Oct 2026
- Platform limitation
- The documentation says Windows installation is available through pip, but build logging is unavailable on Windows.codechecker.readthedocs.io · read 3 Oct 2026
- Purpose
- CodeChecker is static analysis infrastructure built on the LLVM/Clang Static Analyzer toolchain.codechecker.readthedocs.io · read 3 Oct 2026
- Report management
- The web interface can store, filter, compare, and visualize analyzer reports, including bug paths in code.codechecker.readthedocs.io · read 3 Oct 2026
- Review workflow
- Results can be filtered, compared between analyses, and reviewed with comments and false-positive suppression.codechecker.readthedocs.io · read 3 Oct 2026
- Runtime requirement
- The packaging requirements specify Python 3 version 3.11 or later.codechecker.readthedocs.io · read 3 Oct 2026
- Storage
- The web application supports PostgreSQL or SQLite backends.codechecker.readthedocs.io · read 3 Oct 2026
- Supported analyzers
- The documentation lists analyzers for C/C++, C#, Java, Python, JavaScript, TypeScript, Go, and Markdown.codechecker.readthedocs.io · read 3 Oct 2026
