Side by side
CBMC vs Semgrep Code
Both stand on c and c++ static analysis tools. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacWindows
CBMC provides program checks and test generation as a free command-line tool. Users who need external solvers must install them separately, and Windows and macOS users should expect no graphical interface.
Visit CBMC
Free plan Open source APIExtensionLinux+4
Semgrep Code pairs static analysis with AI analysis and remediation guidance for findings. The Free Edition has repository and contributor caps; paid options include Teams at $30/month/contributor and an Enterprise plan with no repository or contributor limit.
Visit Semgrep CodeThe facts
| CBMC | Semgrep Code | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Windows | API, Extension, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Teams Secrets: $15 per contributor a month |
| Plans published | 1 | 6 |
| Maker | Not published | Not published |
| Website | cprover.org | semgrep.dev |
| On c and c++ static analysis tools | #2 of 25 | #1 of 25 |
CBMC: what it does well
- Checks array bounds and safe pointer use.
- Supports C89, C99, and most C11/C17.
- Can generate tests for four coverage criteria.
- Free under a BSD 4-clause license.
What to know first
- Windows and macOS releases have no GUI.
- External Boolector, CVC5, and Z3 solvers require separate installation.
- Windows release runs from Visual Studio Command Prompt.
Semgrep Code: what it does well
- Supports 35+ programming languages.
- Provides remediation instructions in pull requests.
- Integrates with source-control and CI tools.
- Free Edition allows up to 10 repositories.
- Local and fully CI-based scans keep code in the user's environment.
What to know first
- Free Edition allows a maximum of 10 contributors.
- Teams is limited to 500 private repositories.
- AI processing sends part of a finding's file to a model.
Alternatives to CBMC Alternatives to Semgrep Code The whole list