Open-source alternatives to Kani

Manticore is a symbolic execution engine designed for the analysis of binary executables and smart contracts. It functions as an automated vulnerability scanner and verification platform that systematically traverses program execution paths to identify security flaws, validate business invariants, and ensure software properties hold true under all possible input conditions. The engine distinguishes itself through a unified instruction set abstraction that enables consistent analysis across diverse architectures and contract formats. It provides a programmatic interface for deep customization,

Mythril is an Ethereum Virtual Machine smart contract security analyzer that uses symbolic execution to identify vulnerabilities in bytecode before deployment. It functions as a vulnerability scanner and formal auditor, treating program inputs as mathematical symbols to prove the presence of bugs in contract logic. The tool performs bytecode-level analysis to detect flaws that may be hidden by high-level compilers. It integrates SMT solvers to determine if specific vulnerability states are reachable and compares symbolic execution traces against a library of known security flaw signatures. T

Bosque is an experimental programming language and development platform designed for machine-assisted software construction. It combines functional programming semantics with imperative syntax to enforce logic correctness and runtime safety, providing a type-safe environment that utilizes structured data models to maintain information integrity throughout the application lifecycle. The platform distinguishes itself through deep integration with formal verification tools, including automated theorem provers and symbolic execution engines. By transforming source code into a regularized intermed

go-ast-book is a collection of educational and technical resources focused on abstract syntax tree analysis, compiler development, and static code verification. It provides guides and manuals for parsing, traversing, and analyzing Go source code to extract semantic meaning. The project serves as a reference for building compiler frontends, covering the translation of high-level code into intermediate representations and single static assignment forms. It also provides instructions for using these techniques to develop language tooling and perform static code analysis. The resources cover a b

Leo is a zero-knowledge proof programming language and a formally verified language designed to prove the mathematical correctness of application logic and cryptographic circuits. It serves as a private application framework and a ZK-circuit compiler that transforms high-level source code into the low-level constraints required to generate and verify zero-knowledge proofs. The project provides a toolset for zero-knowledge application development and ZK circuit engineering, enabling the creation of private smart contract logic. It allows developers to write high-level code that compiles into c

Noir is a domain-specific language and development framework designed for writing and compiling cryptographic circuits. It functions as a compiler that translates high-level code into intermediate representations, enabling the creation of zero-knowledge proofs that verify the validity of private data without revealing the underlying information. The framework distinguishes itself through a backend-agnostic architecture that decouples circuit logic from specific cryptographic proving systems. By providing a modular interface and abstraction layer, it allows developers to generate verifiable co

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

This project is a comprehensive security suite and knowledge base focused on the engineering and construction of trustworthy digital and physical systems. It provides a systematic framework for security engineering design, covering the establishment of high-assurance architectures and the implementation of security models that govern how a system achieves its safety goals. The project is distinguished by its focus on formal assurance and adversarial deterrence. It includes methodologies for creating security assurance cases and proofs to verify system trustworthiness, alongside economic and t

This project provides a development framework for writing loadable Linux kernel modules using the Rust programming language. It establishes a methodology for safe systems programming by enforcing memory and thread safety within the restricted execution environment of the kernel, allowing developers to extend operating system functionality while preventing common memory corruption errors. The framework distinguishes itself through automated generation of type-safe foreign function interfaces, which bridge high-level code with low-level kernel headers and system structures. It maps high-level s

Yosys is a digital logic synthesizer and RTL synthesis tool that transforms hardware description language code into optimized gate-level representations. It functions as a hardware logic optimizer and formal verification tool, providing a framework to convert generic circuit representations into specific technology library cells for targeted hardware platforms. The project serves as a hardware design automator through a scriptable environment used to execute sequences of synthesis commands. This automation allows for the management of complex digital hardware workflows, integrating RTL design

This project is a static analysis linter, code quality tool, and language auditor for Rust. It functions as an automated refactoring system designed to identify common mistakes and suggest idiomatic improvements for Rust source code. The tool identifies non-idiomatic patterns, performance bottlenecks, and code smells to improve the overall correctness and quality of the code. It specifically audits memory safety by flagging suspicious use of unsafe blocks and pointer manipulations and detects inefficient operations to optimize execution speed. The analysis surface covers coding style enforce

PureScript is a statically typed, purely functional programming language that compiles to JavaScript. It is designed as a cross-platform frontend language for building safe web applications, utilizing a static type system and a JavaScript compiler to ensure program correctness across browser and server environments. The language is distinguished by its emphasis on mathematical purity, featuring a robust type system with first-class support for monads. It provides a sophisticated toolset for static verification, including algebraic data types, type classes, and automatic type inference to reje

Ring is a low-level cryptographic primitive library and security toolset designed for building portable, secure applications. It provides a collection of implementations for RSA, elliptic curve cryptography, and authenticated symmetric encryption. The project focuses on constant-time cryptography to prevent secret data from leaking through timing side-channel attacks. It utilizes a formal verification tool that generates arithmetic logic from templates, ensuring mathematical correctness and eliminating manual implementation errors. The library includes capabilities for producing cryptographi

Coq is an interactive theorem prover and proof assistant used for formal mathematical verification and verified software development. It utilizes the Gallina functional language to define computable functions and logical propositions, which are then verified through a machine-checked kernel. The system employs a dependent type system and a Caldicott-style proof engine to automate proof search and tactic execution. These capabilities allow for the creation of formal specifications and the development of algorithms that are mathematically proven to meet specific requirements. The toolset inclu

Error Prone is a static code analyzer and Java compiler extension that identifies common programming mistakes during the build process. It functions as a compiler wrapper that flags potential errors as compile-time failures to prevent bugs from reaching execution. The tool integrates directly into the Java compilation workflow to provide compile-time validation. It allows for the definition of custom linting rules and analysis checks to enforce specific coding standards and detect prohibited API usage. The system utilizes abstract syntax tree analysis and type-aware pattern matching to inspe

fast-check is a property-based testing framework and random data generator designed to verify software invariants by producing a wide range of randomized input data. It functions as a test data fuzzer that executes predicates against high volumes of random inputs to uncover edge cases and critical bugs. The project is distinguished by its ability to perform input-shrinking searches, which reduce complex failing inputs to their simplest form to isolate the exact cause of failure. It provides deterministic seed replay to exactly reproduce specific test failures and includes a concurrency testin

Sway is a smart contract development language and programming environment designed for writing, compiling, and deploying secure blockchain programs. It serves as a type-safe language for building on-chain logic and a static analysis toolchain that validates contracts before they are executed on a network. The ecosystem provides a development environment focused on blockchain application logic and web3 backend engineering. It integrates a type-safe programming approach to reduce vulnerabilities and ensure reliable state transitions for decentralized services. The toolchain incorporates static

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

Z3 is an automated theorem prover and satisfiability modulo theories solver designed to determine the validity of complex logical formulas. It functions as a formal verification framework, enabling the systematic checking of hardware and software system specifications against defined logical constraints to identify inconsistencies or design flaws. The engine distinguishes itself through a combination of theory-specific decision procedures and symbolic execution capabilities. It employs conflict-driven clause learning and backtracking search algorithms to prune search spaces, while maintaining

JPF is an extensible software analysis framework for Java bytecode. jpf-core is the basis for all JPF projects; you always need to install it. It contains the basic VM and model checking infrastructure, and can be used to check for concurrency defects like deadlocks, and unhandled exceptions like NullPointerExceptions and AssertionErrors.

A collection of TLA⁺ specifications of varying complexities.

a concolic testing engine for Java