Clang Static Analyzer vs PMD

Clang Static Analyzer finds selected bugs in C, C++, and Objective-C programs. It uses symbolic execution to examine paths through code across function calls, and is part of the open-source Clang project. The analyzer is also implemented as a reusable C++ library for other tools and applications. Official releases include scan-build, a command-line tool for analyzing a codebase. On macOS, users can invoke it from Xcode; it can also run alongside clang-tidy when clang-analyzer checks are enabled. Clang-based IDEs may integrate the analyzer directly, and the documentation covers scan-build and CodeChecker. It runs on Linux, macOS, and Windows, and is self-hosted. The tool only detects bugs it has been designed to find, and analysis can take much longer than compilation. Some algorithms have exponential worst-case time, and results may include false positives. The listed free plan costs nothing.

PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.