A cargo plugin that detects and reports usage of unsafe Rust code in crates and their dependencies.
cargo-geiger is a Rust cargo plugin that analyzes Rust crates and their dependencies to detect and report statistics about unsafe code usage. It helps developers identify where memory-unsafe operations occur in their codebase and dependency tree, providing visibility into potential security risks. The tool generates quantitative metrics about unsafe vs. safe code to inform security auditing and code review processes.
Rust developers and teams who need to audit code safety, security researchers analyzing Rust ecosystems, and projects prioritizing memory safety verification in their dependency chains.
Developers choose cargo-geiger because it provides automated, comprehensive unsafe code detection across entire dependency trees, integrates with existing Rust tooling via cargo, and offers objective statistics rather than subjective security judgments—complementing deeper auditing tools.
Detects usage of unsafe Rust in a Rust crate and its dependencies.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Recursively analyzes entire Rust dependency trees, not just local code, providing a holistic safety overview as highlighted in the dependency tree analysis feature.
Designed to feed data into security tools like cargo-crev and safety-dance, enabling deeper analysis and complementing existing Rust security ecosystems.
Offers human-readable console output and structured library APIs, allowing both quick reviews and programmatic use for automated reporting.
Generates statistical counts and percentages of unsafe vs. safe code lines, providing quantitative data to inform auditing priorities without subjective bias.
Only reports statistics on unsafe code usage and explicitly states it does not advise on security risks, leaving interpretation to developers or external tools.
Exposes unversioned, highly unstable libraries (as noted in the README), making programmatic integration prone to breaking changes and less reliable for production.
Requires managing OpenSSL dependencies, with options for system-wide or vendored linking, which can introduce installation hurdles and environment-specific issues.