Klocwork Reviews

Klocwork's most notable features include static code analysis, minimal false positives, on-the-fly analysis, and custom checker creation. It integrates with IDEs, supports industry standards, enhances CI processes, and aids in detecting defects during development. Plurals commend its ease of use, efficient incremental analysis, detailed reporting, and effective collaboration capabilities. Plurals appreciate its language support expansion and seamless plugin integration, praising the prompt support from the Klocwork team in optimizing performance.

• "It's integrated into our CI, continuous integration."
• "The reporting helps us understand the trend of our results and whether we improve over time. We can see the history within Klocwork's server architecture and know that we're making things better. It creates a great story for our management. We can demonstrate value and how our software is developing over time."
• "The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies.I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python."

Klocwork needs improvement in handling false positives, particularly with global variables. It should enhance language support and improve licensing flexibility. Dashboard reporting is another area for enhancement, as is integration with Agile DevOps tools. Users encounter challenges with code analysis between projects and find the upgrade process cumbersome. The complexity in defining analysis rules needs simplification, and support for more modern languages such as Python and JavaScript is desired. Improved dynamic analysis capabilities would also be beneficial.

• "The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
• "Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."
• "What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."