infer

Infer reads your code without running it and tells you where it will crash. Meta built it to catch null pointer bugs, memory leaks, and data races in Java, C, C++, and Objective-C before they ever hit production, then open-sourced the whole thing under MIT. It runs from the command line and hooks into your build, so it sees exactly what your compiler sees.

There's no server and no subscription. You grab a prebuilt binary or build it from OCaml source, wire it into your build system, and it runs in CI like any other check. The real work isn't infrastructure, it's tuning. Infer is an interprocedural analyzer, meaning it traces bugs across function boundaries, and out of the box it will surface findings you'll need to triage and quiet down. Budget time for that first pass.

This runs in production at Meta, Amazon, Uber, and Spotify, so the engine is proven. Solo devs on a small codebase probably won't feel the need. Where it earns its keep is on large C/C++/Objective-C or Android codebases, where a single null deref can ship to millions of devices. If you're paying for Coverity, or leaning on SonarCloud's paid tier mainly for deep bug detection, Infer covers a lot of that for free.

The catch is scope. Infer is a specialist, not a platform. It finds a specific class of correctness and concurrency bugs extremely well, but it won't give you the security rule packs, quality-gate dashboards, or broad language coverage that a SonarQube or Snyk sells. It's a sharp knife, not a Swiss Army one.