- Home
- SAST Tools
- NaiveSystems Analyze
NaiveSystems Analyze
Shanghai, China
What it is
NaiveSystems Analyze is a static analysis tool for source code security checks and compliance with functional safety and coding standards. It analyzes code using syntax trees, symbolic execution, and context-sensitive data-flow analysis across procedures. The tool identifies issues such as null pointer dereferences, memory leaks, tainted data, and buffer overflows. Filters, suppressions, and baselines help teams prioritize defects, while diagnostics provide guidance for severe issues. Listed standards include MISRA C:2012, MISRA C++:2008, AUTOSAR C++14, the full CERT C and C++ rule set, CWE Top 25, and OWASP Top 10. GitHub, GitLab, Gerrit, Jenkins, and Buildbot are shown as DevOps pipeline integrations. Its free plan supports GCC and Clang, up to 100,000 lines of code, and up to four CPUs on one node. A free, open-source runner and containerized analyzers support on-premises deployment. Enterprise adds all available coding standards, unlimited lines, CPUs, and nodes, along with SSO and priority support. Windows and macOS are supported for Enterprise customers; analyzers for languages beyond C and C++ are in development.
For and against
For
- Free plan permits commercial or non-commercial use.
- On-premises deployment is supported by an open-source runner.
- Integrations include GitHub, GitLab, Gerrit, Jenkins, and Buildbot.
- Filters, suppressions, and baselines help target critical defects.
Against
- Free plan is limited to 100,000 lines of code.
- Free plan supports GCC and Clang only.
- Windows and macOS support is for Enterprise customers.
- Analyzers beyond C and C++ are in development.
The verdict
NaiveSystems Analyze combines code security checks with standards compliance and pipeline integrations. The free plan has defined code, CPU, compiler, and platform limits; broader capacity and standards are listed for Enterprise.
Who it suits
NaiveSystems Analyze is aimed at DevOps and DevSecOps teams, including those working on automotive, medical device, and embedded projects. It may suit teams that need source-code analysis aligned with listed coding and security standards.
Plans and prices
Free
FOSS on-premises runner · MISRA C/C++ · up to 100,000 lines · up to 4 CPUs on one node
Read 21 Oct 2026 · naive.systems
Enterprise
Everything in Free · all available coding standards · unlimited lines · unlimited CPUs and nodes
Read 21 Oct 2026 · naive.systems
On the record
- Analysis
- It uses syntax trees, symbolic execution, and context-sensitive interprocedural data-flow analysis to find issues including null pointer dereferences, memory leaks, tainted data, and buffer overflows.naive.systems · read 7 Oct 2026
- AUTOSAR
- AUTOSAR C++14 compliance checking is supported.naive.systems · read 21 Oct 2026
- Build requirements
- The source-build instructions specify Fedora 37, Go 1.18 or later, and Bazel 6.0 or later.github.com · read 21 Oct 2026
- Build support
- Makefiles, CMake projects, and Keil MDK projects are documented as supported workflows.github.com · read 21 Oct 2026
- CERT
- The vendor says the complete CERT C and CERT C++ rule sets are supported.naive.systems · read 21 Oct 2026
- Community operating system
- The Community Edition officially supports Linux with Podman; its published images are Fedora-based.github.com · read 21 Oct 2026
- Company financing
- The same recruitment page says the company had received angel investment from Huachuang Capital, Liuhe Ventures, and River Delta investors.xsb.seiee.sjtu.edu.cn · read 21 Oct 2026
- Company founder
- ChinaVenture identifies Jia Xiao as Naive Systems’ founder and CEO.chinaventure.com.cn · read 21 Oct 2026
- Company founding
- ChinaVenture reports that Naive Systems was founded in 2021.chinaventure.com.cn · read 21 Oct 2026
- Company location
- A Shanghai Jiao Tong University recruitment page identifies Shanghai Naive Systems Co., Ltd. and gives a Shanghai Minhang address.xsb.seiee.sjtu.edu.cn · read 21 Oct 2026
- Compilers and languages
- GCC and Clang are supported in Free; other compilers are supported in Enterprise, and the page says analyzers for languages beyond C and C++ are in development.naive.systems · read 7 Oct 2026
- Containers
- Community users can run published container images with Podman or Docker.github.com · read 21 Oct 2026
- CWE and OWASP
- The site lists CWE Top 25 and OWASP Top 10 coverage.naive.systems · read 21 Oct 2026
- CWE filtering
- MITRE’s compatibility record says findings can be filtered with CWE identifiers and linked from a finding to the corresponding CWE page.cwe.mitre.org · read 21 Oct 2026
- CWE update cadence
- The CWE compatibility submission says the analyzer is usually updated monthly and its CWE coverage representation is updated with it.cwe.mitre.org · read 21 Oct 2026
- Deployment and privacy
- Containerized static analyzers and a free, open-source runner support on-premises deployment, which the vendor says keeps source code and privacy under the user's control.naive.systems · read 7 Oct 2026
- Documentation depth
- The project wiki includes command-line flags, Windows and macOS instructions, CMake and Keil guides, and custom-checker guidance.github.com · read 21 Oct 2026
- G2 pricing disclosure
- G2 says pricing details are unavailable on its listing.g2.com · read 21 Oct 2026
