<p>What tools are there available for static analysis against C# code? I know about FxCop and StyleCop. Are there others? I've run across NStatic before but it's been in development for what seems like forever - it's looking pretty slick from what little I've seen of it, so it would be nice if it would ever see the light of day. </p>

<p>Along these same lines (this is primarily my interest for static analysis), tools for testing code for multithreading issues (deadlocks, race conditions, etc.) also seem a bit scarce. Typemock Racer just popped up so I'll be looking at that. Anything beyond this?</p>

<p>Real-life opinions about tools you've used are appreciated.</p>

[{'answer_id': 40063, 'author': 'Kris Erickson', 'author_id': 3798, 'author_profile': 'https://Stackoverflow.com/users/3798', 'pm_score': 1, 'selected': False, 'text': '<ul>\n<li><a href="http://www.mono-project.com/Gendarme" rel="nofollow noreferrer">Gendarme</a> is an open source rules based static analyzer (similar to FXCop, but finds a lot of different problems).</li>\n<li><a href="http://www.codeplex.com/CloneDetectiveVS" rel="nofollow noreferrer">Clone Detective</a> is a nice plug-in for Visual Studio that finds duplicate code.  </li>\n<li>Also speaking of Mono, I find the act of compiling with the Mono compiler (if your code is platform independent enough to do that, a goal you might want to strive for anyway) finds tons of unreferenced variables and other Warnings that Visual Studio completely misses (even with the warning level set to 4).</li>\n</ul>\n'}, {'answer_id': 100350, 'author': 'Julien Hoarau', 'author_id': 12248, 'author_profile': 'https://Stackoverflow.com/users/12248', 'pm_score': 9, 'selected': True, 'text': '<p><strong>Code violation detection Tools:</strong></p>\n<ul>\n<li><p><a href="https://msdn.microsoft.com/en-us/library/bb429476(v=vs.80).aspx" rel="noreferrer">FxCop</a>, excellent tool by Microsoft. Check compliance with .NET framework guidelines.</p>\n<p><strong>Edit October 2010:</strong> No longer available as a standalone download. It is now included in the <a href="http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6b6c21d2-2006-4afa-9702-529fa782d63b&amp;displaylang=en" rel="noreferrer">Windows SDK</a> and after installation can be found in <code>Program Files\\Microsoft SDKs\\Windows\\ [v7.1] \\Bin\\FXCop\\FxCopSetup.exe</code></p>\n<p><strong>Edit February 2018</strong>: This functionality has now been integrated into Visual Studio 2012 and later as <a href="https://learn.microsoft.com/en-gb/visualstudio/code-quality/code-analysis-for-managed-code-overview" rel="noreferrer">Code Analysis</a></p>\n</li>\n<li><p><a href="http://sharptoolbox.com/tools/clocksharp" rel="noreferrer">Clocksharp</a>, based on code source analysis (to C# 2.0)</p>\n</li>\n<li><p><a href="http://www.mono-project.com/Gendarme" rel="noreferrer">Mono.Gendarme</a>, similar to FxCop but with an open source licence (based on <a href="http://mono-project.com/Cecil" rel="noreferrer">Mono.Cecil</a>)</p>\n</li>\n<li><p><a href="http://code.google.com/p/smokey/" rel="noreferrer">Smokey</a>, similar to FxCop and Gendarme, based on <a href="http://mono-project.com/Cecil" rel="noreferrer">Mono.Cecil</a>. No longer on development, the main developer works with Gendarme team now.</p>\n</li>\n<li><p><a href="http://www.coverity.com/html/coverity-prevent-for-c%23.html" rel="noreferrer">Coverity Prevent™ for C#</a>, commercial product</p>\n</li>\n<li><p><a href="http://www.programmingresearch.com/products/qacsharp/" rel="noreferrer">PRQA QA·C#</a>, commercial product</p>\n</li>\n<li><p><a href="http://www.viva64.com/en/pvs-studio/" rel="noreferrer">PVS-Studio</a>, commercial product</p>\n</li>\n<li><p><a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=0178e2ef-9da8-445e-9348-c93f24cc9f9d&amp;displaylang=en" rel="noreferrer">CAT.NET</a>, visual studio addin that helps identification of security flaws <strong>Edit November 2019:</strong> Link is dead.</p>\n</li>\n<li><p><a href="http://submain.com/codeit.right" rel="noreferrer">CodeIt.Right</a></p>\n</li>\n<li><p><a href="http://research.microsoft.com/SpecSharp/" rel="noreferrer">Spec#</a></p>\n</li>\n<li><p><a href="http://research.microsoft.com/Pex/" rel="noreferrer">Pex</a></p>\n</li>\n<li><p><a href="https://www.sonarqube.org/" rel="noreferrer">SonarQube</a>, FOSS &amp; Commercial options to support writing cleaner and safer code.</p>\n</li>\n</ul>\n<p><strong>Quality Metric Tools:</strong></p>\n<ul>\n<li><a href="http://www.ndepend.com/" rel="noreferrer">NDepend</a>, great visual tool. Useful for code metrics, rules, diff, coupling and dependency studies.</li>\n<li><a href="http://www.nitriq.com" rel="noreferrer">Nitriq</a>, free, can easily write your own metrics/constraints, nice visualizations. <strong>Edit February 2018:</strong> download links now dead. <strong>Edit June 17, 2019: Links not dead.</strong></li>\n<li><a href="http://msquaredtechnologies.com/" rel="noreferrer">RSM Squared</a>, based on code source analysis</li>\n<li><a href="http://www.semanticdesigns.com/Products/Metrics/CSharpMetrics.html" rel="noreferrer">C# Metrics</a>, using a full parse of C#</li>\n<li><a href="http://www.campwoodsw.com/sourcemonitor.html" rel="noreferrer">SourceMonitor</a>, an old tool that occasionally gets updates</li>\n<li><a href="https://archive.codeplex.com/?p=codemetrics" rel="noreferrer">Code Metrics</a>, a <a href="http://www.red-gate.com/products/reflector/" rel="noreferrer"><em>Reflector</em></a> add-in</li>\n<li><a href="https://web.archive.org/web/20140310013820/http://www.1bot.com/index.html" rel="noreferrer">Vil</a>, old tool that doesn\'t support .NET 2.0. <strong>Edit January 2018:</strong> Link now dead</li>\n</ul>\n<p><strong>Checking Style Tools:</strong></p>\n<ul>\n<li><a href="https://github.com/StyleCop/StyleCop" rel="noreferrer">StyleCop</a>, Microsoft tool ( run from inside of Visual Studio or integrated into an MSBuild project). Also available <a href="https://visualstudiogallery.msdn.microsoft.com/cac2a05b-6eb6-4fa2-95b9-1f8d011e6cae" rel="noreferrer">as an extension</a> for Visual Studio 2015 and C#6.0</li>\n<li><a href="https://code.google.com/p/agentsmithplugin/" rel="noreferrer">Agent Smith</a>, code style validation plugin for <em>ReSharper</em></li>\n</ul>\n<p><strong>Duplication Detection:</strong></p>\n<ul>\n<li><a href="http://www.harukizaemon.com/simian/index.html" rel="noreferrer">Simian</a>, based on source code. Works with plenty languages.</li>\n<li><a href="http://www.semanticdesigns.com/Products/CloneDR" rel="noreferrer">CloneDR</a>, detects parameterized clones only on language boundaries (also handles many languages other than C#)</li>\n<li><a href="https://github.com/terrajobst/clonedetective-vs" rel="noreferrer">Clone Detective</a> a Visual Studio plugin (which uses <a href="https://www.cqse.eu/en/products/conqat/overview/" rel="noreferrer">ConQAT</a> internally)</li>\n<li><a href="http://www.getatomiq.com" rel="noreferrer">Atomiq</a>, based on source code, plenty of languages, cool &quot;wheel&quot; visualization</li>\n</ul>\n<p><strong>General Refactoring tools</strong></p>\n<ul>\n<li><a href="http://www.jetbrains.com/resharper/" rel="noreferrer">ReSharper</a> - Majorly cool C# code analysis and refactoring features</li>\n</ul>\n'}, {'answer_id': 123640, 'author': 'Hamish Smith', 'author_id': 15572, 'author_profile': 'https://Stackoverflow.com/users/15572', 'pm_score': -1, 'selected': False, 'text': '<p>I find the <a href="http://www.codeplex.com/reflectoraddins/Wiki/View.aspx?title=CodeMetrics&amp;referringTitle=Home" rel="nofollow noreferrer">Code Metrics</a> and <a href="http://www.tom-carter.net/" rel="nofollow noreferrer">Dependency Structure Matrix</a> add-ins for Reflector very useful.</p>\n'}, {'answer_id': 378417, 'author': 'Patrick from NDepend team', 'author_id': 27194, 'author_profile': 'https://Stackoverflow.com/users/27194', 'pm_score': 3, 'selected': False, 'text': '<p>The tool <a href="http://www.ndepend.com/" rel="nofollow noreferrer">NDepend</a> is quoted as <strong>Quality Metric Tools</strong> but it is pretty much also a <strong>Code violation detection</strong> tool. <em>Disclaimer: I am one of the developers of the tool</em></p>\n<p>With NDepend, one can write <a href="http://www.ndepend.com/Features.aspx#CQL" rel="nofollow noreferrer">Code Rule over LINQ Queries (what we call CQLinq)</a>. More than <a href="http://www.ndepend.com/DefaultRules/webframe.html" rel="nofollow noreferrer">200 CQLinq code rules</a> are proposed by default. The strength of CQLinq is that <em>it is straightforward to write a code rule</em>, and get <em>immediately</em> results. Facilities are proposed to browse matched code elements. For example:</p>\n<p><a href="https://i.stack.imgur.com/4U5IV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4U5IV.png" alt="NDepend static analyzer code rule" /></a></p>\n<p>Beside that, NDepend comes with many others <em>static analysis like</em> features. These include:</p>\n<ul>\n<li><a href="https://www.ndepend.com/sample-reports/" rel="nofollow noreferrer">Reporting from your CI/CD</a></li>\n<li><a href="https://www.ndepend.com/docs/azure-devops-tfs-vsts-integration-ndepend" rel="nofollow noreferrer">Azure DevOps Hub</a></li>\n<li><a href="https://www.ndepend.com/docs/ndepend-github-action" rel="nofollow noreferrer">GitHub Action</a></li>\n<li><a href="http://www.ndepend.com/features/technical-debt" rel="nofollow noreferrer">Smart Technical Debt Estimation</a></li>\n<li><a href="http://www.ndepend.com/Doc_Matrix.aspx" rel="nofollow noreferrer">Dependency Matrix</a></li>\n<li><a href="http://www.ndepend.com/Doc_VS_Diff.aspx" rel="nofollow noreferrer">Code Diff capabilities</a></li>\n<li><a href="http://www.ndepend.com/API/webframe.html" rel="nofollow noreferrer">NDepend.API</a> that lets write you own static analysis tool. With NDepend.APi we even developed a tool to detect code duplicate (details in this blog post: <a href="http://codebetter.com/patricksmacchia/2012/06/12/an-original-algorithm-to-find-net-code-duplicate/" rel="nofollow noreferrer">An Original Algorithm to Find .NET Code Duplicate</a>).</li>\n<li><a href="http://www.ndepend.com/Doc_VS_Arch.aspx" rel="nofollow noreferrer">Powerful Dependency Graph</a>\n<a href="https://i.stack.imgur.com/HXo0L.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HXo0L.png" alt="NDepend Dependency Graph" /></a></li>\n</ul>\n'}, {'answer_id': 764672, 'author': 'torial', 'author_id': 13990, 'author_profile': 'https://Stackoverflow.com/users/13990', 'pm_score': 0, 'selected': False, 'text': '<p>Aside from the excellent list by madgnome, I would add a duplicate code detector that is based off the command line (but is free):</p>\n\n<p><a href="http://sourceforge.net/projects/duplo/" rel="nofollow noreferrer">http://sourceforge.net/projects/duplo/</a></p>\n'}, {'answer_id': 909730, 'author': 'markdevilliers', 'author_id': 18913, 'author_profile': 'https://Stackoverflow.com/users/18913', 'pm_score': 1, 'selected': False, 'text': '<p>Have you seen <a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=0178e2ef-9da8-445e-9348-c93f24cc9f9d&amp;displaylang=en" rel="nofollow noreferrer">CAT.NET</a>?</p>\n\n<p>From the blurb -</p>\n\n<blockquote>\n  <p>CAT.NET is a binary code analysis tool\n  that helps identify common variants of\n  certain prevailing vulnerabilities\n  that can give rise to common attack\n  vectors such as Cross-Site Scripting\n  (XSS), SQL Injection and XPath\n  Injection.</p>\n</blockquote>\n\n<p>I used an early beta and it did seem to turn up a few things worth looking at.</p>\n'}, {'answer_id': 1750960, 'author': 'Mark Dalgarno', 'author_id': 50140, 'author_profile': 'https://Stackoverflow.com/users/50140', 'pm_score': -1, 'selected': False, 'text': '<p><a href="https://www.axivion.com/en/produkte-60" rel="nofollow noreferrer">Axivion Bauhaus Suite</a> is a static analysis tool that works with C# (as well as C, C++ and Java).</p>\n\n<p>It provides the following capabilities:</p>\n\n<ul>\n<li>Software Architecture Visualization (inlcuding dependencies)</li>\n<li>Enforcement of architectural rules e.g. layering, subsystems, calling rules</li>\n<li>Clone Detection - highlighting copy and pasted (and modified code)</li>\n<li>Dead Code Detection</li>\n<li>Cycle Detection</li>\n<li>Software Metrics</li>\n<li>Code Style Checks</li>\n</ul>\n\n<p>These features can be run on a one-off basis or as part of a Continuous Integration process. Issues can be highlighted on a per project basis or per developer basis when the system is integrated with a source code control system.</p>\n'}, {'answer_id': 2748614, 'author': 'Alen', 'author_id': 330198, 'author_profile': 'https://Stackoverflow.com/users/330198', 'pm_score': -1, 'selected': False, 'text': '<p>Klocwork has a static analysis tool for C#: <a href="http://www.klocwork.com" rel="nofollow noreferrer">http://www.klocwork.com</a></p>\n'}, {'answer_id': 7687873, 'author': 'Javier Salado', 'author_id': 984075, 'author_profile': 'https://Stackoverflow.com/users/984075', 'pm_score': -1, 'selected': False, 'text': '<p>Optimyth Software has just launched a static analysis service in the cloud <a href="http://www.checkinginthecloud.com" rel="nofollow">www.checkinginthecloud.com</a>. Just securely upload your code run the analysis and get the results. No hassles.</p>\n\n<p>It supports several languages including C# more info can be found at <a href="http://www.optimyth.com/en/products/checkinginthecloud/checking-in-the-cloud-sqa-service.html" rel="nofollow">wwww.optimyth.com</a></p>\n'}]
['https://Stackoverflow.com/questions/38635', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3656/']