· Real run · header ·
Firmlint runs deterministic static analysis on your C and C++ code, explains each finding in plain English, and proposes a fix. Every fix is re-applied to a copy of your file, re-analysed and compile-checked before you see it. Nothing is trusted without verification.
Standard analyzers find the issues. The AI layer helps engineers understand them. A verification loop decides which fixes are safe to show as verified.
cppcheck and clang-tidy check your code against MISRA, AUTOSAR, CERT and CWE rule sets.
For each finding, the model writes a plain-English explanation specific to your code, a concrete risk statement, and a proposed fix.
The fix is applied to a copy, re-analysed and compile-checked. Only fixes that pass are marked verified. The rest go to a human.
Every finding is exported to SARIF, HTML and JSON, with the file hash, tool versions, model name and timestamp. The screenshots below are real Firmlint runs on sample code, cropped without edits.
The summary. Notice the honest count: Fixes verified: 0. The tool doesn't claim verified work it hasn't actually verified.
Rule, location, analyzer, explanation, risk. This is the shape every finding takes.
Findings outside the AI review limit are still reported. The tool never hides a violation — it labels what got AI review and what did not.
Provenance. Exact tool versions, exact timestamps, SHA-256 of every analysed file. This is what an auditor will ask to see — and most vendors don't publish it.
Fixes that look right are not the same as fixes that are right. Firmlint checks each one before it reaches a reviewer.
Rule-based checks for C in safety-critical embedded code.
Current MISRA guidance for modern C++ in automotive and industrial systems.
Coding guidelines used across AUTOSAR-based software platforms.
Secure coding rules covering undefined behaviour and common vulnerabilities.
The most dangerous software weaknesses, mapped to your findings.
Paste this into any terminal with Docker installed. The image is public — no signup, no account, no email required.
The deterministic layer (cppcheck, clang-tidy) runs locally. The AI layer is optional and uses local inference via Ollama by default — no code leaves your workstation.
Ships as a Docker image. Runs on an engineer's laptop or an internal CI runner.
Each run produces the artefacts an assessor expects.
days · your code · your machine
We'll reply within one business day. No sales call unless you ask for one.