What are the best static code analysis tools?

# Best Static Code Analysis Tools

## Multi-Language Tools

| Tool | Languages | Notes |

|------|-----------|-------|

| **SonarQube** | 30+ languages | Most popular, free community edition |

| **Semgrep** | 30+ languages | Fast, customizable rules |

| **CodeClimate** | 10+ languages | Cloud-based, good CI integration |

| **Coverity** | C/C++, Java, C# | Enterprise-grade, Synopsys product |

## Language-Specific Tools

### JavaScript/TypeScript

- **ESLint** - Most widely used, highly configurable

- **JSHint** - Lightweight alternative

- **Prettier** - Code formatting focused

### Python

- **Pylint** - Comprehensive, strict

- **Flake8** - Lightweight, fast

- **Bandit** - Security-focused

- **mypy** - Type checking

### Java

- **SpotBugs** (FindBugs successor)

- **PMD** - Code quality rules

- **Checkstyle** - Style enforcement

### C/C++

- **Clang-Tidy** - Part of LLVM

- **Cppcheck** - Free, lightweight

- **PVS-Studio** - Commercial, thorough

### C#/.NET

- **Roslyn Analyzers** - Built into .NET

- **ReSharper** - JetBrains product

## Security-Focused Tools

- **Snyk** - Vulnerability scanning

- **Checkmarx** - Enterprise SAST

- **Fortify** - HP/Micro Focus product

- **Brakeman** - Ruby on Rails specific

## Key Considerations When Choosing

1. **Language support** - Does it cover your stack?

2. **CI/CD integration** - GitHub Actions, Jenkins, etc.

3. **False positive rate** - Too many = ignored warnings

4. **Cost** - Open source vs. commercial

5. **Rule customization** - Can you tune it?

6. **IDE integration** - Real-time feedback

## Recommended Starting Points

- **Open source projects** → SonarQube + ESLint/Pylint

- **Security-focused** → Semgrep + Snyk

- **Enterprise** → Checkmarx or Coverity

- **Quick setup** → CodeClimate

Would you like details on any specific tool or language?