cppcheck Integration Guide

Integrate cppcheck with Vulnetix. Detect bugs, undefined behaviour, and security issues in C/C++ code with SARIF output.

Install & scan

$ uv run --with cppcheck cppcheck --version
$ uv run --with cppcheck cppcheck --output-format=sarif --output-file=cppcheck.sarif src/

Run cppcheck in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run cppcheck
  run: |
    pip install cppcheck
    cppcheck --output-format=sarif --output-file=cppcheck.sarif src/
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cppcheck
    path: cppcheck.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under cppcheck's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace cppcheck. Keep running it. Vulnetix sits on top of cppcheck (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

cppcheck is strongest at its core category and also carries features in Compliance & Policy Engines, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What cppcheck does well

• Deep C/C++ analysis that works without a full build environment and tolerates non-standard/embedded syntax
• Bidirectional data-flow analysis with a design goal of very few false positives - trusted enough to be run in strict CI gates
• Catches real memory-safety CVE classes: buffer overflows, null-pointer dereference, uninitialized variables, integer overflow, use-after-free, resource/FD leaks
• Standards compliance for safety-critical code via the free misra.py addon (MISRA C 2012); Premium extends to MISRA C++, CERT C/C++ and AUTOSAR

Where Vulnetix adds to it: Vulnetix does SAST but does not run cppcheck's C/C++ memory-safety or MISRA/CERT analysis; the two do not overlap on that native depth. Better together: Vulnetix ingests cppcheck SARIF/XML output into its single deduplicated queue and adds what cppcheck has no concept of - cross-scanner correlation, EPSS/KEV/LEV exploit-intel prioritisation, reachability, versioned VEX + audit, and SSVC/EOL policy.

No migration, no rip-and-replace. cppcheck keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise cppcheck results in Vulnetix

Upload cppcheck SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

cppcheck documentation ↗  ·  Source repository ↗

Wire cppcheck into your CI/CD pipeline →