Infer

Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs. Its checks include null pointer problems, resource or memory leaks, concurrency issues, coding conventions, and unavailable APIs. Some analyses trace issues across functions or methods in different files. Pulse handles memory safety and value analysis, while RacerD focuses on thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family code; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and produces reports that can be explored with infer explore. Files not compiled are not analyzed. Documented build integrations include ant, Buck, CMake, Gradle, Make, Maven, xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker, and a small browser example is available through Codeboard. Infer is free and listed for Linux, macOS, web, and self-hosted use; Windows is not supported.

Infer offers a broad set of static checks for supported codebases, with analysis that can cross function and file boundaries. Its coverage depends on compilation capture, and Windows users need another supported environment.

Infer suits developers working with its supported languages who want static checks in a build or CI workflow. Its documented integrations and reports may also suit teams that want to inspect potential issues in compiled files.

Overview

Infer is a free static analyzer for teams building Java, C, C++, Objective-C, or Erlang software who want potential defects identified before release. It is especially suitable for projects with established Linux or macOS builds and CI pipelines. Its strongest case is finding bugs whose effects cross methods and files, while its build-capture workflow and lack of Windows support narrow its fit.

Key features

Infer records compilation commands, analyzes the files included in that compilation, and produces reports that developers can inspect with infer explore. This approach fits existing builds and supports reactive CI analysis focused on modified files. It also creates a hard boundary: uncompiled files receive no analysis, so incomplete or unusual build paths can leave blind spots.

Language-specific checks cover practical correctness and safety concerns. In Java and Android projects, Infer checks null-pointer exceptions, resource leaks, annotation reachability, missing lock guards, and concurrency races. For C, C++, and Objective-C, it checks null-pointer dereferences, memory leaks, coding conventions, and unavailable APIs. Cross-function and cross-file reasoning is valuable when a defect depends on interactions that a line-by-line checker cannot see.

Pulse adds interprocedural memory-safety and value analysis, including Java null-dereference detection. RacerD concentrates on thread-safety analysis. Cost analysis estimates asymptotic function complexity for Java and C-family code; Hack support is experimental, and Python, Rust, and Swift are outside that analysis coverage. The documented language set is Java, C, C++, Objective-C, and Erlang.

Build integrations include ant, Buck, CMake, Gradle, Make, Maven, xcodebuild, xctool, and compilation databases. Infer can be installed from binary releases, built from source, or run in Docker. A small browser example through Codeboard offers a low-commitment way to see the workflow. CI use is a proven part of its design, with deployment in Meta’s pipeline across projects including Facebook, Messenger, Instagram, and WhatsApp.

Pricing

Infer (free) — free. The plan provides static analysis for supported programming languages, with a downloadable binary, source-build option, or Docker image. There are no paid tiers or seat charges stated, making it practical for individual developers and teams that can operate the tooling themselves. The trade-off is that the offering is the analyzer rather than a priced hosted service: setup, build integration, report handling, and CI operation remain part of your environment.

Platforms

Infer supports Linux, macOS, self-hosted deployments, and web access for its browser example. The current binary release targets Linux and macOS. Windows is not supported; projects that can compile on Linux are directed toward using a Linux virtual machine, so Windows-first teams should expect additional environment work.

Who it's for

Choose Infer for engineering teams maintaining Java or C-family codebases that already use one of its supported build systems and want security and correctness checks in CI. It is a good match when cross-file reasoning, thread-safety checks, memory analysis, or complexity estimates matter more than a hosted, graphical workflow. It is less suitable for Windows-only development, languages outside its supported analyzers, or repositories where compilation capture cannot reliably include the files you care about.

Pros and cons

• Pros: Free to use, with source, binary, and Docker installation choices.
• Pros: Interprocedural analysis can expose null dereferences, races, and related defects spanning functions and files.
• Pros: Broad integrations cover common Java, C/C++, and Apple build systems and support CI workflows.
• Pros: Pulse, RacerD, and cost analysis address memory safety, thread safety, and algorithmic complexity.
• Cons: Only files captured during compilation are analyzed, so build omissions become analysis omissions.
• Cons: No Windows support; a Linux virtual machine may be required.
• Cons: Cost analysis has limited language coverage, with Hack experimental and no Python, Rust, or Swift support.

Alternatives

For a broad directory of C and C++ options, see C and C++ Static Analysis Tools; for a wider survey across languages and approaches, see Static Analysis Tools.

Parasoft SOAtest is the better choice when you need Android, API, iOS, Linux, macOS, self-hosted, or Windows coverage and are prepared for tailored paid pricing with a trial.

Squish suits teams seeking an enterprise testing product across desktop, mobile, web, and API platforms, with a trial but no free plan.

CBMC is a free command-line alternative for C and C++ on Linux, macOS, and Windows.

MATLAB Grader is free with a MATLAB license under maintenance and targets coursework workflows with LMS integration.

Clang Static Analyzer is a free, fully open-source choice for C, C++, and Objective-C on Linux, macOS, and Windows.

Qodana is worth considering for a freemium, web-connected workflow with Windows support and a free Community tier.

Semgrep Code fits teams wanting a hosted or self-hosted paid platform with a free edition capped at 10 repositories and 10 contributors.

CPAchecker is another free software option for Linux, macOS, self-hosted, and Windows environments.

Verdict

Infer is a strong recommendation for Java and C-family teams that want no-cost, CI-friendly static analysis with cross-function and cross-file reasoning. Choose it for the depth of its bug checks and build integrations; look elsewhere if Windows support, broader language coverage, or a managed hosted experience is essential.