- C++ 80.7%
- Python 15.2%
- Rust 2.2%
- Meson 1%
- Shell 0.7%
- Other 0.2%
b03c8615ca
fold lives only on git.trevon.dev, but every SARIF report advertised https://github.com/trvon/fold as the tool's information URI, so code scanning UIs and SARIF viewers linked readers to a repository fold no longer uses. The driver now points at https://git.trevon.dev/trevon/fold. test_scan_e2e asserts the URI; it failed before this change. |
||
|---|---|---|
| .forgejo/workflows | ||
| .githooks | ||
| .github/workflows | ||
| bench | ||
| docker | ||
| docs | ||
| include/fold | ||
| meson | ||
| scripts | ||
| skills/fold-sast | ||
| src | ||
| subprojects | ||
| tests | ||
| third_party | ||
| tools | ||
| .build.yml | ||
| .clang-format | ||
| .clang-tidy | ||
| .clangd | ||
| .fold-suppressions | ||
| .gitignore | ||
| .inferconfig | ||
| .tsan-suppress | ||
| AGENTS.md | ||
| BUILD.md | ||
| CLAUDE.md | ||
| CMakeLists.txt | ||
| conanfile.py | ||
| DIFFERENTIAL_REVIEW_REPORT.md | ||
| FOLLOWUP_FIXES_REPORT.md | ||
| LICENSE | ||
| meson.build | ||
| meson_options.txt | ||
| README.md | ||
| ROADMAP_EXPANSION_TASKS_REPORT.md | ||
| setup.sh | ||
fold
Bounded symbolic static analysis for C++: dead-branch and hazard detection (null dereference, division by zero, integer overflow, out-of-bounds, and more), clone and equivalence detection, and taint tracking, built on Clang LibTooling and the Z3 solver. Rust (HIR), Swift and binary scan modes also exist; the Rust detectors are heuristic today.
Every finding carries a confidence tier that says how it was established:
| Tier | Meaning |
|---|---|
concrete-witness |
A fuzzer ran the solver's witness under a sanitizer and produced a correlated crash. |
proved |
An exact bounded model proved it: SAT for a hazard witness, or UNSAT for a negated invariant. |
latent |
Proved inside the function, but only reachable if a caller supplies a value the callee never guards. |
heuristic |
Some part of the model was over-approximated. |
syntactic |
An AST pattern or hash match only. |
"Bounded" is literal: loops are unrolled to a fixed depth, and a condition that depends on a loop's exit is never reported as proved. The contract behind each tier is in docs/research/soundness.md.
Quick start
./setup.sh release # needs LLVM/Clang 18+ and libz3 headers; Conan handles the rest
fold scan --compile-db compile_commands.json \
--detectors null-deref --detectors div-by-zero \
--format sarif --output findings.sarif
fold grep "null pointer" findings.sarif --field message --ignore-case
Per-platform install lines and a Docker validation harness are in BUILD.md.
Output formats are sarif, versioned findings-json, and markdown. Both
machine formats record which translation units were analysed. A scan exits 0
with no findings, 1 with any unsuppressed finding, and 2 when a report could
not be written or any translation unit was not analysed (compile errors,
frontend failure, crash, timeout): no findings from an incomplete scan is not
evidence of no bugs.
Documentation
- Usage: the full CLI (scan modes, scopes, confirmation, fuzzing), every detector with its CWE and method, MCP/LSP, and project evaluation.
- MCP tools and compatibility (deprecated names and removal criteria).
- Positioning and prior art: how fold relates to other analyzers.
- Performance: the evaluation gates and the single-pass graph-building plan.
- Architecture and research notes.
License
GPL-3.0-only