RAPx
An extensible static analysis platform for Rust that detects memory safety bugs and performs advanced program analysis beyond rustc.
What is RAPx?
RAPx is an advanced static analysis platform for Rust that extends beyond the standard rustc compiler's capabilities. It provides an extensible framework for building powerful analysis tools that help developers detect memory safety bugs, perform deep program analysis, and reason about code safety and performance. The platform enables researchers and developers to implement custom analyses while offering practical bug detection for real-world Rust projects.
Rust developers and researchers who need advanced static analysis capabilities beyond what rustc provides, particularly those working on security-critical systems, embedded development, or academic research in program analysis.
RAPx offers a unique combination of academic-grade analysis algorithms with practical usability, providing extensibility for researchers while delivering ready-to-use bug detection for developers. Unlike basic linters, it performs deep program analysis including alias and dataflow analysis, making it particularly valuable for finding subtle memory safety issues in complex Rust codebases.
Overview
A static analysis tool for Rust programs. The guardrail for AI-generated Rust code.
Use Cases
Best For
- Detecting use-after-free vulnerabilities in Rust codebases
- Finding memory leaks in embedded Rust applications
- Performing alias analysis on complex Rust programs
- Generating call graphs for large Rust projects
- Extending Rust's static analysis capabilities with custom checks
- Analyzing Rust code for RISC-V and other non-standard targets
Not Ideal For
- Teams relying on stable Rust toolchains without nightly builds
- Projects needing quick, out-of-the-box linting without manual toolchain setup
- Environments where automatic dependency management is preferred over manual configuration
- Developers seeking mature, production-ready analysis tools with comprehensive documentation
Pros & Cons
Pros
Separates core algorithms from application tasks, enabling easy customization and extension for researchers, as outlined in the philosophy section promoting modular development.
Identifies critical vulnerabilities like use-after-free and memory leaks, with specific command examples in the README for targets such as RISC-V.
Supports analysis for various targets including RISC-V and embedded systems, making it versatile for non-standard environments, as highlighted in the features.
Can analyze single crates, workspace members, or entire dependency trees recursively using the RAP_RECURSIVE environment variable, allowing comprehensive project coverage.
Cons
The README explicitly states the project is 'still under heavy development,' leading to potential instability, breaking changes, and incomplete features.
Requires a specific nightly Rust version (nightly-2025-12-06) with extra components, complicating installation and integration compared to stable toolchain tools.
Users must manage environment variables like RAP_LOG and RAP_CLEAN, and handle toolchain overrides manually, adding setup complexity and maintenance burden.
Frequently Asked Questions
Related Projects
verusVerified Rust for low-level systems code
MIRAIMIRAI is an abstract interpreter that operates on Rust's mid-level intermediate representation (MIR), designed to become a widely used static analysis tool for the Rust ecosystem. It helps developers improve code quality by detecting potential issues and verifying correctness properties through formal analysis. ## Key Features - **Panic Detection** — Identifies unintentional panics or suboptimal program termination paths - **Correctness Verification** — Validates program properties encoded via source annotations - **API Documentation** — Checks that explicit precondition annotations match the actual code implementation - **Security Analysis** — Performs taint analysis to find information leaks, code injection bugs, and side-channel vulnerabilities - **Path-Sensitive Analysis** — Conducts top-down, full-program analysis of package entry points - **Configurable Diagnostics** — Offers multiple diagnostic levels from default to paranoid for different analysis needs ## Philosophy MIRAI aims to make Rust code more reliable and better documented through rigorous static analysis, helping developers catch bugs early and maintain clear, verifiable contracts in their APIs.
cargo-couplingA coupling analysis tool for Rust projects - measuring the 'right distance' in your code
static_assertionsCompile-time assertions to ensure that invariants are met
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.