Static code analysis tools for complex systems

Choose an analyzer by what it does with your code, your build and your pipeline. A feature list does not tell you that.

This page turns your priorities into questions for any vendor and shows how Visao, the analyzer in Midair, answers them. Our research compares eleven tools in detail.

Join the waitlist Choose your criteria
visao in CI · pull requestExample 
$visao --report-format sarif \
    --baseline main.sarif --fail-on high \
    compile_commands.json
toolarm-none-eabi-gcc · os baremetal
scan212 translation units
new otp.cpp:20:20 error arithm/integer/overflow
new otp.cpp:31:5  error cpp/string/no_null_terminator
base38 known findings hidden by the baseline
sarifvisao.sarif · 2 results
exit1  2 findings at or above high

What a static code analysis tool is.And where tools differ.

A static code analysis tool reads source code without running it and reports places where the program can fail or break a rule.

Tools differ in method. Some match patterns in the code. Most follow values and paths through functions and report likely defects for a person to review. A few are sound: under stated assumptions, they prove that a class of runtime errors cannot happen.

For embedded C and C++, the build matters more than the checker count. If the tool cannot reproduce your compiler, macros and target, its findings are about some other program.

What matters to you.Questions to ask any vendor.

Choose your criteria. For each one you get the questions to ask every vendor and how Visao answers them today, including where it falls short.

Your criteria

11 criteria

Choose at least one criterion to see its questions.

Few false positives

Ask any vendor

  1. On our code, what share of the findings did our engineers confirm?
  2. Can we record the existing findings as a baseline and see only new ones?
  3. Does a suppressed finding stay suppressed when the code around it moves?

How Visao answers

Visao can record its findings as a SARIF baseline and then report only new ones. It matches a finding by rule, file, message and source line, never by line number. We publish no false-positive rate: measure it on your own code.

MISRA C

Ask any vendor

  1. Which MISRA edition does the tool check, and which rules automatically?
  2. Does the report list the rules the tool does not check?
  3. How are deviations recorded and approved?

How Visao answers

Visao has a MISRA C:2012 profile that checks part of the rules. Its compliance summary names the rules it does not check. There is no MISRA C++, AUTOSAR C++ or CERT profile yet.

CI gating

Ask any vendor

  1. Does the tool exit with a non-zero code above a severity we choose?
  2. Can a pull request fail only on the findings it introduces?
  3. Which CI systems have a ready template?

How Visao answers

Visao runs as one command in the pipeline. The --fail-on option sets the severity that fails the job, and --baseline limits the gate to new findings. There are templates for GitHub Actions, GitLab CI and Jenkins.

SARIF and report formats

Ask any vendor

  1. Does the tool write SARIF 2.1.0?
  2. Does each finding name its rule and link to a description of it?
  3. Can we follow one finding across commits?

How Visao answers

Visao writes text, SARIF 2.1.0, JSON and the GitLab SAST format. Each finding names its rule and links to the rule page. A stable fingerprint in SARIF lets GitHub Code Scanning follow an alert across commits.

Cross-compilers and bare metal

Ask any vendor

  1. What share of our translation units does the tool analyze with the right configuration?
  2. Does it take the target, macros and include paths from our compiler?
  3. Is our compiler supported, or only GCC and Clang?

How Visao answers

Visao reads compile_commands.json and probes gcc, clang and clang-cl for the target, macros and include paths. You register a cross-compiler such as arm-none-eabi-gcc by its path, and there is a bare-metal target OS. Check IAR, TASKING or Green Hills builds in a trial.

Project-specific rules

Ask any vendor

  1. Can we describe our own APIs and the rules for using them?
  2. How long does it take to add one useful custom rule?

How Visao answers

Visao reads function contracts written in ACSL and runs project-specific detectors next to its built-in rules. A contract can also mark a function as banned by a coding standard.

Analysis depth

Ask any vendor

  1. Does a finding show the path and the values that lead to it?
  2. Is the tool sound for any class of errors, or does it report likely defects?

How Visao answers

Visao combines abstract interpretation over intervals, octagons, pointers and resource states with the Z3 and CVC5 solvers. It reports findings for review. It does not claim to prove that a class of errors is absent.

SBOM and dependencies

Ask any vendor

  1. Which SBOM formats does the tool write?
  2. Does it match components to known vulnerabilities and check licences?
  3. Can it compare the SBOMs of two releases?

How Visao answers

Visao writes an SBOM as CycloneDX 1.5 or SPDX 2.3 from the project manifests. It matches packages to OSV advisories, applies a licence policy and compares two SBOMs with --sbom-diff.

Code stays on premises

Ask any vendor

  1. Does the analyzer send anything over the network: telemetry, licence checks, code?
  2. Does it run on a machine with no network at all?
  3. Where are the findings stored?

How Visao answers

Visao has no network client. It sends no telemetry and makes no licence call, so it runs on a machine with no network. Midair, where findings are reviewed, also runs on your own servers with the Business plan.

Price

Ask any vendor

  1. What does the price include: languages, standards, server, CI use?
  2. Is it priced per user, per line of code or per project?
  3. What will triage cost in engineer hours?

How Visao answers

Visao is part of Midair, and the Midair plans are public, monthly and in euros. Community is free on a shared instance, Pro is €90 and Business is €990. Enterprise is quoted per customer.

Evidence for a safety project

Ask any vendor

  1. Is there a tool qualification kit for our standard and this tool version?
  2. Which reports will our assessor accept?

How Visao answers

Visao has no tool qualification kit for ISO 26262 or DO-178C. In Midair, a finding stays next to the test runs and the runtime evidence that check it.

How eleven tools compare on these points

How to run a fair trial.Five steps, same rules for every tool.

Vendor claims do not tell you how a tool behaves on your code. A short pilot does. Run every candidate through the same five steps.

01Pick representative code

Do
Take one component with target headers, build variants, generated code and a defect whose root cause you already know. A small demo project rewards quick setup and tells you little.
Record
The share of translation units each tool analyzed with the right configuration.
With Visao
Give Visao the compile_commands.json of the real build and the path of your cross-compiler.

02Write down the goal

Do
Decide what the trial tests: finding defects, MISRA rules, feedback on pull requests or custom rules. Each goal needs its own pass criteria, written before the first run.
Record
The goals and their pass criteria, the same for every tool.
With Visao
Choose the outputs now: SARIF for CI, the MISRA C:2012 profile if you need it.

03Measure the signal

Do
Review a sample of findings by hand and mark each one confirmed, irrelevant or uncertain. A higher warning count can also mean more noise.
Record
Confirmed findings, actionable findings divided by reviewed findings, and triage time per finding.
With Visao
The SARIF report names the rule, file and line of each finding, which makes the sample easy to share.

04Test the whole workflow

Do
Run a full analysis and then one on a small change. Connect the CI system, then try baselines, suppressions and the gate.
Record
Time from a code change to feedback, and whether unchanged findings stay stable across commits.
With Visao
Write a baseline on the main branch, then run a pull request with --baseline and --fail-on.

05Check the evidence

Do
For a regulated project, ask for the exact documents you get with the licence: rule coverage for your edition, deviation records, qualification material.
Record
Which documents exist for the tool version you would buy.
With Visao
Visao has a MISRA C:2012 compliance summary and no qualification kit. Say so in your evaluation.
1 / 5

Our comparison of eleven tools.From the research page.

The research is documentation-based: it compares what each vendor publishes, without scores. It sorts the tools into six groups.

Static analysis connected to tests and runtime evidence
Visao, as part of Midair
Enterprise defect and security platforms
Coverity, Klocwork, CodeSonar
Compliance and verification suites
Perforce QAC, Parasoft C/C++test
Proof-oriented analyzers
Polyspace Code Prover, Astrée
Developer-oriented commercial analysis
PVS-Studio
Open-source foundations
Cppcheck, Clang Static Analyzer

Interpretica makes Visao. The research applies the same criteria to Visao and says where its standards coverage is narrower.

Research · 2026Static analysis tools for embedded C and C++ (2026)Eleven analyzers compared by method, standards, compiler fit, workflow and best fit, with a pilot scorecard.

Questions.Short answers.

What is a static code analysis tool?

A static code analysis tool reads source code without running it and reports places where the program can fail or break a rule. Examples are integer overflow, an index past the end of an array and a resource that is never released.

Is static analysis the same as SAST?

Mostly. SAST (static application security testing) is the security name for it and looks for exploitable weaknesses. In embedded work, static analysis also covers coding standards such as MISRA C and proofs about runtime errors.

Which static analysis tools support MISRA C?

Our research lists Coverity, Polyspace Bug Finder, Klocwork, CodeSonar, Parasoft C/C++test, Perforce QAC, PVS-Studio and Cppcheck Premium as publishing MISRA capabilities. Visao has a MISRA C:2012 profile that checks part of the rules and names the rest. Coverage differs by edition and licence, so ask for the rule list.

Should a project use more than one analyzer?

Often, yes. Analyzers use different models and find different defects. A fast tool can run on every change and a heavier one on the main branch. Plan the overlap, or duplicate findings will cost triage time.

How do we compare false positives fairly?

Use the same code, build, rules and settings for every tool. Review a sample of findings by hand and mark each one confirmed, irrelevant or uncertain. A vendor-wide false-positive figure does not replace this.

Can Visao run without Midair?

Yes. In CI, Visao is one command that writes SARIF, JSON or a GitLab SAST report. Inside Midair, its findings sit next to the test runs and runtime evidence that check them.

Try it on your own code.One component, one build, one pipeline.

Compare the plans on the pricing page. Prices are monthly, in euros.

Join the waitlist