How do I install and run MIRAI on my Rust project?

Follow the installation guide to set up MIRAI, then use `cargo mirai` similarly to `cargo check` for analysis. Configure options via the MIRAI_FLAGS environment variable for custom diagnostics.

What's the difference between MIRAI and Rust's Clippy?

MIRAI focuses on formal verification, panic detection, and security analysis using abstract interpretation, while Clippy is a linter for code style and common idioms. MIRAI is better for high-assurance needs but requires more setup.

How can I reduce false positives in MIRAI analysis?

Use annotations from the mirai-annotations crate to provide hints, and adjust the diagnostic level with flags like --diag=default to balance sensitivity. This helps MIRAI understand intended behavior and minimize noise.

Does MIRAI analyze test functions in Rust?

Yes, by running `cargo mirai --tests`, MIRAI performs path-sensitive analysis on test functions, helping catch issues in testing code as well as main entry points.

Can MIRAI be integrated into continuous integration pipelines?

Absolutely, run `cargo mirai` in CI scripts to enforce code quality checks. However, consider setting timeouts with --body_analysis_timeout to manage resource usage and analysis duration.

What annotations are needed for MIRAI verification?

Precondition annotations and other hints from the mirai-annotations crate, such as function contracts, are required for thorough verification. These help MIRAI validate correctness properties and reduce warnings.

MIRAI — Rust MIR Static Analyzer

What is MIRAI?

MIRAI is an abstract interpreter that operates on Rust's mid-level intermediate representation (MIR), designed as a static analysis tool for the Rust ecosystem. It helps developers improve code quality by detecting potential issues like unintentional panics and verifying correctness properties through formal analysis. The tool aims to make Rust code more reliable and better documented by catching bugs early and maintaining clear API contracts.

Target Audience

Rust developers and teams building high-assurance software, such as those in security-critical or safety-critical domains, who need to verify code correctness and prevent bugs. It is also suitable for developers looking to enhance API documentation and integrate static analysis into CI pipelines.

Value Proposition

Developers choose MIRAI for its path-sensitive, full-program analysis that goes beyond typical linters by offering formal verification capabilities through source annotations. Its unique selling point is the combination of panic detection, security analysis (e.g., taint analysis), and configurable diagnostics, making it a comprehensive tool for improving Rust code reliability and documentation.

Overview

MIRAI is an abstract interpreter that operates on Rust's mid-level intermediate representation (MIR), designed to become a widely used static analysis tool for the Rust ecosystem. It helps developers improve code quality by detecting potential issues and verifying correctness properties through formal analysis.

Key Features

Panic Detection — Identifies unintentional panics or suboptimal program termination paths
Correctness Verification — Validates program properties encoded via source annotations
API Documentation — Checks that explicit precondition annotations match the actual code implementation
Security Analysis — Performs taint analysis to find information leaks, code injection bugs, and side-channel vulnerabilities
Path-Sensitive Analysis — Conducts top-down, full-program analysis of package entry points
Configurable Diagnostics — Offers multiple diagnostic levels from default to paranoid for different analysis needs

Philosophy

MIRAI aims to make Rust code more reliable and better documented through rigorous static analysis, helping developers catch bugs early and maintain clear, verifiable contracts in their APIs.

MIRAI

What is MIRAI?

Overview

Key Features

Philosophy

Related Projects

Found a gem we're missing?

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions