Splint is described as 'Tool for statically checking C programs for security vulnerabilities and coding mistakes. With minimal effort, Splint can be used as a better lint. If additional effort is invested adding annotations to programs, Splint can perform stronger checking than can be done' and is an app in the development category. There are eight alternatives to Splint for a variety of platforms, including Windows, Linux, Web-based, BSD and PortableApps.com apps. The best Splint alternative is Shellcheck, which is both free and Open Source. Other great apps like Splint are Cppcheck, Coverity Scan, Flawfinder and EDoC++.
Shellcheck is the most popular Web-based alternative to Splint.
Shellcheck is the most popular Open Source & free alternative to Splint.
Cppcheck is an static analysis tool for C/C++ code. Unlike C/C++ compilers and many other analysis tools it does not detect syntax errors in the code. Cppcheck primarily detects the types of bugs that the compilers normally do not detect.
Cppcheck is the most popular Windows & Linux alternative to Splint.
Coverity Scan Static Analysis allows to find and fix defects in your Java, C/C++ or C# open source project for free.
Coverity Scan is the most popular Mac alternative to Splint.
Flawfinder examines C/C++ source code and reports possible security weaknesses ("flaws'') sorted by risk level. It's very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public.
Is actively maintained and really fast. Works out of the box without configuration.
EDoC++ is a C++ source analysis tool designed to identify problems associated with the use of exceptions in C++ code. Additionally EDoC++ can be used to generate detailed documentation
Parasoft’s C/C++test is the fully-integrated software testing solution for embedded safety-critical industries. Its automated software testing capabilities are also made for today’s high-velocity Agile DevOps environments.
Parasoft C/C++test is the most popular commercial alternative to Splint.
Facebook Infer is a static analysis tool - if you give Infer some Objective-C, Java, or C code, it produces a list of potential bugs.
VCG is an automated code security review tool that handles C/C++, Java, C#, VB and PL/SQL. It has a few features that should hopefully make it useful to anyone conducting code security reviews, particularly where time is at a premium:
Norway
Sweden
EU
United States
Shellcheck is for shell scripts, and cannot be used for C code, and splint is the opposite.