- Home
- Static Analysis Tools
- Coverity Scan
Coverity Scan
What it is
Coverity Scan provides cloud static analysis for registered open source projects. It examines source code without executing it and can trace possible execution paths to identify defects. Examples include resource leaks, null pointer dereferences, memory corruption, buffer overruns, concurrency issues and insecure data handling. For each defect, it explains the root cause to help developers address the problem. The listed languages are Java, C, C++, C#, JavaScript, Ruby and Python. Users can sign in with GitHub and import projects for analysis; the sign-in page also describes automating builds with Travis CI. Registered Eclipse Foundation projects can use a Coverity Scan plugin on a Hudson server to send build and source-control information for cloud analysis. Use is limited to registered open source projects, though projects initiated and maintained by for-profit corporations may be approved at Black Duck’s discretion. Detailed results are generally limited to project members approved by the project administrator, under a responsible disclosure policy. Coverity Scan is free. Build allowances vary by project size, with weekly limits from 7 to 28 and daily limits from 1 to 4; excess weekly requests are rejected.
For and against
For
- Analyzes code without executing it.
- Explains the root cause of each defect.
- Supports seven listed programming languages.
- GitHub projects can be imported for analysis.
- The service is free.
Against
- Use is limited to registered open source projects.
- Build limits vary by project size.
- Excess weekly build requests are rejected.
- Only the latest two tool releases are supported.
The verdict
Coverity Scan offers free static analysis with defect explanations and integrations described for GitHub, Travis CI and certain Eclipse Foundation projects. Eligibility, build allowances and supported tool releases are constraints to check before relying on it.
Who it suits
Coverity Scan suits developers maintaining registered open source projects who want static analysis for supported languages. Projects initiated and maintained by for-profit corporations may be considered for approval at Black Duck’s discretion.
Plans and prices
Coverity Scan
Registered open source projects only · Build frequency varies by project size
Read 7 Oct 2026 · scan.coverity.com
On the record
- Analysis
- Its static analysis examines source code without executing it and can follow possible execution paths through the code.scan.coverity.com · read 7 Oct 2026
- Build limits
- Weekly build limits range from 7 to 28 per project depending on lines of code, with daily limits from 1 to 4; excess weekly requests are rejected.scan.coverity.com · read 7 Oct 2026
- Defects
- Examples of issues it finds include resource leaks, null pointer dereferences, memory corruption, buffer overruns, concurrency issues, and insecure data handling.scan.coverity.com · read 7 Oct 2026
- Eclipse integration
- Registered Eclipse Foundation projects can use a Coverity Scan plugin on a Hudson server to send build and source control information for cloud analysis.scan.coverity.com · read 7 Oct 2026
- Eligibility
- Use is limited to registered open source projects, though projects initiated and maintained by for-profit corporations may be approved at Black Duck's discretion.scan.coverity.com · read 7 Oct 2026
- GitHub
- Users can sign in with GitHub and import GitHub projects for analysis.scan.coverity.com · read 7 Oct 2026
- Languages
- The site lists Java, C/C++, C#, JavaScript, Ruby, and Python as supported languages.scan.coverity.com · read 7 Oct 2026
- Project access
- Access to detailed results is generally limited to project members approved by the project administrator, and the service follows responsible disclosure.scan.coverity.com · read 7 Oct 2026
- Purpose
- Coverity Scan provides static analysis results for registered open source projects.scan.coverity.com · read 7 Oct 2026
- Results
- The site says the root cause of each defect is explained to help developers fix bugs.scan.coverity.com · read 7 Oct 2026
- Support policy
- The site says only the latest two tool releases are supported and projects should expect to update approximately once a year or more often.scan.coverity.com · read 7 Oct 2026
- Travis CI
- The sign-in page says users can automate Coverity Scan builds with Travis CI.scan.coverity.com · read 7 Oct 2026
- Upload API
- The site announced a new API endpoint for uploading builds larger than the previous 500 MB request limit.scan.coverity.com · read 7 Oct 2026
