GitHub CodeQL vs Infer
GitHub CodeQL
codeql.github.comInfer
fbinfer.comSide by side
| Figure | GitHub CodeQL | Infer |
|---|---|---|
| Price from | $30/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 1 |
| Spec score · C and C++ Static Analysis Tools | 8.5 (#4) | 8.5 (#5) |
| Spec score · Static Analysis Tools | 8.5 (#8) | 8.5 (#9) |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | Infer is a static analysis tool that produces a list of potential bugs from Java or C/C++/Objective-C code. |
| Supported languages | CodeQL supports C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. | Infer is a static program analyzer for Java, C, C++, Objective-C, and Erlang, written in OCaml. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
Infer
Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs before release. Its checks include null pointer problems, resource or memory leaks, coding conventions, unavailable APIs, and concurrency issues such as data races. Some analyses can follow an issue across multiple functions or methods and files. Pulse provides memory-safety analysis, while RacerD checks thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family languages; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and writes reports that can be reviewed with `infer explore`; files that are not compiled are not analyzed. Integrations are documented for build tools including Buck, CMake, Gradle, Make, Maven, Xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker. The free plan costs nothing. Infer runs on Linux and macOS, with web and self-hosted options; Windows is not supported.