cargo-audit logo

cargo-audit

MaintainedMaintained

Audit Cargo.lock for crates with security vulnerabilities reported to the RustSec Advisory Database.

Tutorials / Guides

  • cargo-audit screenshot
  • cargo-audit screenshot
  • cargo-audit screenshot
  • cargo-audit screenshot

36 Alternatives to cargo-audit

C2Rust

C2Rust helps you migrate C99-compliant code to Rust. The translator (or transpiler) produces unsafe Rust code that closely mirrors the input C code.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-bloat

Find out what takes most of the space in your executable. supports ELF (Linux, BSD), Mach-O (macOS) and PE (Windows) binaries.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-breaking

cargo-breaking compares a crate's public API between two different branches, shows what changed, and suggests the next version according to semver.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-call-stack

Whole program static stack analysis The tool produces the full call graph of a program as a dot file.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-deny

A cargo plugin for linting your dependencies. It can be used either as a command line too, a Rust crate, or a Github action for CI. It checks for valid license information, duplicate crates, security vulnerabilities, and more.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-expand

Cargo subcommand to show result of macro expansion and #[derive] expansion applied to the current crate. This is a wrapper around a more verbose compiler command.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-geiger

A cargo plugin for analysing the usage of unsafe Rust code Provides statistical output to aid security auditing

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-inspect

Inspect Rust code without syntactic sugar to see what the compiler does behind the curtains.

  • DeprecatedDeprecated
  • DeprecatedRust
  • Deprecatedcli
  • Deprecatedlinter

cargo-semver-checks

Scan your Rust crate releases for semver violations. It can be used either directly via the CLI, as a GitHub Action in CI, or via release managers like release-plz. It found semver violations in more than 1 in 6 of the top 1000 most-downloaded crates on crates.io.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-show-asm

cargo subcommand showing the assembly, LLVM-IR and MIR generated for Rust code

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-spellcheck

Checks all your documentation for spelling and grammar mistakes with hunspell (ready) and languagetool (preview)

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo udeps

Find unused dependencies in Cargo.toml. It either prints out a "unused crates" line listing the crates, or it prints out a line saying that no crates were unused.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-unused-features

Find potential unused enabled feature flags and prune them. You can generate a simple HTML report from the json to make it easier to inspect results. It removes a feature of a dependency and then compiles the project to see if it still compiles. If it does, the feature flag can possibly be removed, but it can be a false-positive.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

clippy

A code linter to catch common mistakes and improve your Rust code.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

diff.rs

Web application (WASM) to render a diff between Rust crate versions.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

dylint

A tool for running Rust lints from dynamic libraries. Dylint makes it easy for developers to maintain their own personal lint collections.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

electrolysis

A tool for formally verifying Rust programs by transpiling them into definitions in the Lean theorem prover.

  • DeprecatedDeprecated
  • DeprecatedRust
  • Deprecatedcli
  • Deprecatedlinter

herbie

Adds warnings or errors to your crate when using a numerically unstable floating point expression.

  • DeprecatedDeprecated
  • DeprecatedRust
  • Deprecatedcli
  • Deprecatedlinter

kani

The Kani Rust Verifier is a bit-precise model checker for Rust. Kani is particularly useful for verifying unsafe code blocks in Rust, where the "unsafe superpowers" are unchecked by the compiler. Kani verifies:

  • Memory safety (e.g., null pointer dereferences) * User-specified assertions (i.e., assert!(...)) * The absence of panics (e.g., unwrap() on None values) * The absence of some types of unexpected behavior (e.g., arithmetic overflows)
  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

linter-rust

Linting your Rust-files in Atom, using rustc and cargo.

  • DeprecatedDeprecated
  • DeprecatedRust
  • Deprecatedcli
  • Deprecatedlinter

lockbud

Statically detects Rust deadlocks bugs. It currently detects two common kinds of deadlock bugs: doublelock and locks in conflicting order. It will print bugs in JSON format together with the source code location and an explanation of each bug.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

MIRAI

And abstract interpreter operating on Rust's mid-level intermediate language, and providing warnings based on taint analysis.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

prae

Provides a convenient macro that allows you to generate type wrappers that promise to always uphold arbitrary invariants that you specified.

  • DeprecatedDeprecated
  • DeprecatedRust
  • Deprecatedcli
  • Deprecatedlinter

Prusti

A static verifier for Rust, based on the Viper verification infrastructure. By default Prusti verifies absence of panics by proving that statements such as unreachable!() and panic!() are unreachable.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

Rudra

Rust Memory Safety & Undefined Behavior Detection. It is capable of analyzing single Rust packages as well as all the packages on crates.io.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

rust-audit

Audit Rust binaries for known bugs or security vulnerabilities. This works by embedding data about the dependency tree (Cargo.lock) in JSON format into a dedicated linker section of the compiled executable.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

rustfix

Read and apply the suggestions made by rustc (and third-party lints, like those offered by clippy).

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

RustViz

RustViz is a tool that generates visualizations from simple Rust programs to assist users in better understanding the Rust Lifetime and Borrowing mechanism. It generates SVG files with graphical indicators that integrate with mdbook to render visualizations of data-flow in Rust programs.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

warnalyzer

Show unused code from multi-crate Rust projects

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

cargo-careful

Execute Rust code carefully, with extra checking along the way. It builds the standard library with debug assertions. Here are some of the checks this enables:

  • get_unchecked in slices performs bounds checks * copy, copy_nonoverlapping, and write_bytes check that pointers are aligned and non-null and (if applicable) non-overlapping {NonNull,NonZero*,...}::new_unchecked check that the value is valid * plenty of internal consistency checks in the collection types * mem::zeroed and the deprecated mem::uninitialized panic if the type does not allow that kind of initialization
  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

hyperfine

A command-line benchmarking tool It features statistical analysis across multiple runs, support for arbitrary shell commands, constant feedback about the benchmark progress and current estimates, warmup runs, a simple and expressive syntax, and more.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

loom

Concurrency permutation testing tool for Rust. It runs a test many times, permuting the possible concurrent executions of that test.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

MIRI

An interpreter for Rust's mid-level intermediate representation, which can detect certain classes of undefined behavior like out-of-bounds memory accesses and use-after-free.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

puffin

Instrumentation profiler for Rust.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

rust-san

How-to sanitize your Rust code with built-in Rust dynamic analyzers

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

stuck

provides a visualization for quickly identifying common bottlenecks in running, asynchronous, and concurrent applications.

  • MaintainedMaintained
  • MaintainedRust
  • Maintainedcli
  • Maintainedlinter

15 Multi-Language Tools

autocorrect

A linter and formatter to help you to improve copywriting, correct spaces, words, punctuations between CJK (Chinese, Japanese, Korean).

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • MaintainedlinterMaintainedformatter

callGraph

Statically generates a call graph image and displays it on screen.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

Corrode

Semi-automatic translation from C to Rust. Could reveal bugs in the original implementation by showing Rust compiler warnings and errors. Superseded by C2Rust.

  • DeprecatedDeprecated
  • DeprecatedMulti-Language
  • Deprecatedcli
  • Deprecatedlinter

lizard

Lizard is an extensible Cyclomatic Complexity Analyzer for many programming languages including C/C++ (doesn't require all the header files or Java imports). It also does copy-paste detection (code clone detection/code duplicate detection) and many other forms of static code analysis. Counts lines of code without comments, CCN (cyclomatic complexity number), token count of functions, parameter count of functions.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

Mega-Linter

Mega-Linter can handle any type of project thanks to its 70+ embedded Linters, its advanced reporting, runnable on any CI system or locally, with assisted installation and configuration, able to apply formatting and fixes

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

ShiftLeft Scan

Scan is a free open-source DevSecOps platform for detecting security issues in source code and dependencies. It supports a broad range of languages and CI/CD pipelines.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter

Sigrid

Sigrid helps you to improve your software by measuring your system's code quality, and then compares the results against a benchmark of thousands of industry systems to give you concrete advice on areas where you can improve.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • MaintainedcliMaintainedservice
  • Maintainedlinter

StaticReviewer

Static Reviewer executes code checks according to the most relevant Secure Coding Standards, OWASP, CWE, CVE, CVSS, MISRA, CERT, for 40+ programming languages, using 1000+ built-in validation rules for Security, Deadcode & Best Practices Available a module for Software Composition Analysis (SCA) to find vulnerabilities in open source and third party libraries.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

todocheck

Linter for integrating annotated TODOs with your issue trackers

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

trivy

A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

trunk

Modern repositories include many technologies, each with its own set of linters. With 30+ linters and counting, Trunk makes it dead-simple to identify, install, configure, and run the right linters, static analyzers, and formatters for all your repos.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • MaintainedlinterMaintainedformatter

allocscope

allocscope is a tool for tracking down where the most egregiously large allocations are occurring in a C, C++ or Rust codebase. It is particularly intendend to be useful for developers who want to get a handle on excessive allocations and are working in a large codebase with multiple contributors with allocations occuring in many modules or libraries.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

bytehound

A memory profiler for Linux. Can be used to analyze memory leaks, see where exactly the memory is being consumed, identify temporary allocations and investigate excessive memory fragmentation.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

CASR

Crash Analysis and Severity Report.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • Maintainedlinter

Sydr

Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle.

  • MaintainedMaintained
  • MaintainedMulti-Language
  • Maintainedcli
  • MaintainedlinterMaintainedfuzzer

Our Sponsors

This website is completely open source. To fund our work, we fully rely on sponsors. Thanks to them, we can keep the site free for everybody. Please check out their offers below.

  • Bearer
  • BugProve
  • CodeScene
  • semgrep
  • Offensive 360