Cppcheck
Swedish maker of Cppcheck, the open-source C and C++ analyser, with a commercial Premium edition for safety and security compliance
Quick Overview
| Company | Cppcheck Solutions AB |
|---|---|
| Category | Static Code Analysis Tools |
| Headquarters | Stockholm, Sweden |
| Founded | 2021 |
| EU Presence | Yes - Sweden (EU) |
| Data Location | Runs locally, no data leaves your machine |
| Open Source | Open-source edition (free); Premium is commercial |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - runs locally and air-gapped |
| Main Features | C and C++ analysis, MISRA C 2023 and 2025, MISRA C++ 2023, AUTOSAR C++ 2014, CERT C and C++, Top 25 CWE, compliance reports |
| Pricing | Open-source edition free; Premium Project license (minimum 5 users) and Enterprise license (minimum 25 users) on request |
| Best For | C and C++ and embedded teams needing MISRA or CERT evidence |
| Replaces | Veracode (C/C++ scanning), Coverity, Klocwork |
Detailed Review
Cppcheck is one of the most used open-source static analysers for C and C++, and its maker, Cppcheck Solutions AB, sells Cppcheck Premium for compliance work. The company page says it was founded in 2021 by Daniel Marjamaki, Par Jelger and Magnus Janagard.
The vendor stresses a low false-positive rate, local and air-gapped operation with no license servers, and support answered by developers.
Open source core, paid compliance
The open-source version stays free. Premium adds checks for MISRA C 2023, MISRA C++ 2023, MISRA C 2025 and AUTOSAR C++ 2014, plus CERT C, CERT C++ and the CWE Top 25, with compliance reports.
Licensing
License tiers are Individual, Project (one Git repository with submodules, minimum 5 users) and Enterprise (unlimited projects, minimum 25 users, supports air-gapped environments). Prices are quoted through sales, and a three-week free trial is offered.
Scope
Cppcheck concentrates on C and C++. It is a sharp tool for that job rather than a multi-language application security platform.
Limitations to Consider
Cppcheck covers C and C++ only, so it does not replace a multi-language security platform such as Veracode. Premium prices are not published. The Project license is not for air-gapped environments, which needs the Enterprise tier with a 25-user minimum.
Who Should Use Cppcheck
Embedded and systems teams writing C or C++ that need MISRA, AUTOSAR or CERT checks from a Swedish vendor and want an open-source starting point.
Pros and Cons
Pros
- Open-source core
- MISRA, AUTOSAR and CERT checkers in Premium
- Runs locally and air-gapped
- Stockholm-based vendor
- Three-week free trial
Cons
- C and C++ only
- Premium prices not published
- Air-gapped use needs the Enterprise license
- Small vendor, founded 2021
Alternatives to Cppcheck
Other European static code analysis tools worth comparing before you decide:
SonarQube
Switzerland · Swiss code-quality platform with SAST, secrets detection and AI fixes
Qodana
Czech Republic · JetBrains code quality platform that runs the IDE inspections in CI
Teamscale
Germany · Software quality platform covering code, tests, security and architecture
Codacy
Portugal · Automated code review and quality gates with AI-assisted fixes
See all European static code analysis tools or compare them directly against Veracode (C/C++ scanning) on our alternatives page.
Frequently Asked Questions
The open-source edition is free. Cppcheck Premium is a commercial product with Individual, Project and Enterprise licenses.
Yes. The vendor says it runs locally and air-gapped, although the Project license is not for air-gapped environments.
MISRA C 2023, MISRA C++ 2023, MISRA C 2025, AUTOSAR C++ 2014, CERT C and C++ and the Top 25 CWE.