CBMC vs GitHub CodeQL
CBMC
cprover.org
GitHub CodeQL
codeql.github.comSide by side
| Figure | CBMC | GitHub CodeQL |
|---|---|---|
| Price from | Free | $30/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 5 |
| Spec score · C and C++ Static Analysis Tools | 8.7 (#2) | 8.5 (#4) |
| Purpose | CBMC is a bounded model checker for C and C++ programs. | CodeQL is a language and toolchain for code analysis that treats code as data. |
| Supported languages | It supports C89, C99, most of C11/C17, and many compiler extensions from GCC, Clang, and Visual Studio. | CodeQL supports C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
CBMC
CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows. It checks memory safety, including array bounds and pointer use, along with several forms of undefined behavior and user-specified assertions. Its language range includes C89, C99, most of C11 and C17, and extensions from GCC, Clang, and Visual Studio. CBMC verifies by unwinding program loops and passing the resulting equation to a decision procedure. It can check C and C++ I/O equivalence with languages such as Verilog, and generate test cases for branch, decision, path, and MC/DC coverage. Listed language features include arrays, dynamic memory, nondeterminism, assumptions, assertions, and selected C++ features such as classes, templates, and STL containers. A MiniSat-based bit-vector solver is included; Boolector, CVC5, and Z3 are supported but must be installed separately. CBMC is free at free under a BSD 4-clause license. The Windows and macOS distributions are command-line tools without a GUI.
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.