I believe clang-tidy or cppcheck engine does line by line analysis. Klocwork engine in other hand, does inter procedural analysis. Klocwork can detect file dependent issues as well what most of other tool cant detect. Klocwork is very powerful in finding critical detects like memory leaks, Buffer Overflow, NULL exceptions, Dead Lock, concurrency issues, etc..,
we have evaluated multiple Static code analysers and ended with Klocwork.
I will tell you why we have chosen Klocwork than any other SCA tools,
- Number of Checkers to detect possible vulnerabilities. Klocwork has
more than 1000+ checkers to detect coding defects/issues.
- Klocwork can work at developer desktop. So it makes the code bug
free at the time of development. (It has post check-in capability as
well)
- klocwork has direct plugin available for Visual Studio, Eclipse,
Intellij IDEA, Wind River, CCS and Eclipse based IDEs. Klocwork has
its own IDE as well. (If you are using any other IDEs than what
Klocwork plugin supports, you can use Klocwork IDE. Klocwork IDE can
work with any Editor or IDE you have)
- Klocwork supports checking almost all industry standards like Misra,
Autosar, CERT, CWE, DISA-STIG, OWASP, etc..,
- You can write your own checkers in Klocwork to maintain/check your
internal coding guidelines.
- Effectiveness in finding the Vulnerabilities issues .
- Reporting and Metrics (100+ reporting formats and 400+ metrics)
- Filtering the issues – remove 3rd party code in report, create
module report, team report, etc..,
- Fast – Though they create AST based on your native build settings
still Klocwork engine is fast and effective.
- Automation – Automation – Automation. Klocwork build can be
automated as it has rich command line tools. Plus, Klocwork has
direct plugin available for Jenkins and Teamcity.
- Simple Deployment – Client server architecture
- Documentation – Documentation and Demo videos of Klocwork is
available online (Open). You just open google and say, “Klocwork C
and C++ checker list” you will get the list of Klocwork checkers
with proper explanation.
- Support – Klocwork support team is very user friendly.
- Licensing – Simple licensing. No hidden charges.
I would say, take up a free evaluation of Klocwork and test it on your project. I am sure you will love it.