Cppcheck vs PMD
Cppcheck
cppcheck.comPMD
pmd.github.ioSide by side
| Figure | Cppcheck | PMD |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 8 | 1 |
| Spec score · Linters | 8.8 (#1) | 8.3 (#6) |
| Spec score · Static Analysis Tools | 8.7 (#3) | 8.2 (#12) |
| IDE integrations | Officially listed integrations include Visual Studio, VS Code, Keil, Eclipse, CLion, Qt Creator and C++ Builder. | The project lists integrations for Eclipse, IntelliJ IDEA, and Visual Studio Code, among other IDEs. |
| Purpose | Cppcheck is a static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs. | PMD is an extensible cross-language static code analyzer that finds common programming flaws. |
| Support | Enterprise includes onboarding and configuration support and access to an enterprise support portal; Project includes onboarding support and prioritized second-line support. | The project directs users to Stack Overflow for questions, GitHub issues for suspected bugs or requests, and Gitter for quick questions. |
Plans
Cppcheck
- Cppcheck Premium trialFree
- Open-sourceFree
- Open-source CppcheckFree
- EnterprisePriced on request
- Enterprise LicensePriced on request
- IndividualPriced on request
- ProjectPriced on request
- Project LicensePriced on request
In their own words
Cppcheck
Cppcheck is a static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs. It can analyze non-standard syntax commonly found in embedded projects. The tool fully supports C++11, C++14, and C++17, with partial support for C++20, and lists integrations with Visual Studio, VSCode, Keil, Eclipse, CLion, Qt Creator, and C++ Builder. Its Soundy mode is intended to help find hard-to-find bugs discovered during testing. The free Open-source plan provides core static analysis. Premium adds checks for safety and security standards, with compliance reports for supported standards; the maker describes Premium as TÜV SÜD certified for safety-critical development. A three-week free trial is offered without a credit card or commitment. Individual licensing excludes CI environments, virtual machines, and containers, while Enterprise supports those environments and air-gapped use. Project requires at least five users and one Git repository. Paid plan prices are available by tailored quotation.
PMD
PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.