There is also smatch, it is used by the Linux Kernel community https://github.com/error27/smatch