SqC Developer Guide
SqC (Software Code Quality) is a terminal-based static analysis tool that validates C code compliance with SEI CERT C Coding Standards. It implements 285 rules across 17 CERT C categories, using tree-sitter for fast AST-based analysis with cross-file context, control-flow graphs, and inter-procedural reasoning.
This guide covers advanced usage, CI/CD integration, the interactive console UI, testing methodology, project internals, and contributing.
Contents
- Advanced CLI Usage
- Suppression System
- Configuration
- CI/CD Integration
- Interactive Console UI
- Testing Methodology
- Juliet Benchmark History
- Benchmark Environment
- FP Reduction History (Full Round List)
- Per-Round Fix Details
- v0.3.19 — Fast Benchmark Mode + CWE-78 Taint Tracking
- v0.3.17 — CWE-78 Macro Alias Resolution + CWE-253 Incorrect Return Check
- v0.3.14 — EXP33-C, INT30-C, EXP34-C FP Fixes (Full Suite)
- v0.3.9 — P3214 Real-World FP Fixes (12-CWE Subset)
- v0.3.8 — STR31-C, API00-C, EXP34-C, EXP33-C FP Fixes (12-CWE Subset)
- v0.3.5 — Struct Field Type Resolution, Real-World FP Fixes
- v0.2.25 — ARR32-C Tightening, Rule Removals, Value-Range FP Fixes
- v0.2.23 — INT32-C Const-Eval for Allocation/Memory/Abs + INT30-C Built-in Macros
- v0.2.16 — EXP34-C: Call-Site Null Propagation (Phase 2)
- v0.2.21 — Const-Eval Value-Range Analysis + Real-World Round 6 FP Fixes
- v0.2.20 — Real-World FP Fixes (API00-C, INT01-C, EXP37-C, EXP34-C)
- v0.2.19 — Real-World FP Reduction (INT30-C Loop Guards, Prescan Null Guards, ARR00-C Fix)
- v0.2.18 — Quick Wins FP Reduction (INT31-C, ARR36-C, API00-C, INT30-C)
- v0.2.17 — Phase 3: CWE-476 FP Reduction (MEM10-C, API00-C, API02-C, Prescan)
- v0.2.15 — Real-World FP Cleanup (17 Patterns)
- v0.2.13 — INT31-C Implicit Narrowing + Real-World FP Fixes
- v0.2.12 — DCL13-C Pointer Modification + INT01-C sizeof Skip
- v0.2.7 — INT36-C TP Restore + INT31-C FP Fix
- Round 16 — DCL13-C main() Exemption + MEM10-C Parameter-Only Null Check
- Round 15 — EXP34-C: if/else Branch Merge
- Round 14 — EXP34-C: deref_after_check Pattern
- Round 13 — STR31-C: L-prefix and Literal-Source Fixes
- Round 12 — INT07-C, INT32-C, EXP10-C, EXP34-C, INT30-C, MEM10-C, STR31-C, Windows API
- Round 9 — CFG, Data-Flow, Inter-Procedural Analysis
- Round 8 — DCL40-C, FLP32-C, ERR33-C
- Round 7 — EXP36-C, EXP34-C, ARR37-C
- Round 6 — Cross-File Analysis (
-d) - Round 5 — FLP02-C, DCL06-C, INT30-C
- Round 4 — EXP12-C, FLP03-C, INT32-C
- Round 3 — DCL31-C, DCL07-C, FLP34-C
- Round 2 — EXP33-C, SIG31-C, ARR01-C, DCL30-C, DCL02-C
- Round 1 — INT08-C, CON08-C, DCL20-C, ARR38-C
- Performance by CWE Category (Historical Snapshot)
- Full Per-CWE Results (Round 1 Baseline)
- Per-Rule Data Accuracy Note (2026-03-03)
- Competitor Comparison
- Version History (v0.2.1 – v0.3.17)
- Scripts and Data Locations
- Analysis Architecture
- Benchmark Setup
- Running Benchmarks (MCP Server)
- Project Structure
- Future Rulesets Beyond CERT C
- Contributing
- Bibliography