THEMIS Lint reads your compile_commands.json and analyzes each translation unit with Clang's AST, preprocessor and control-flow analysis. Every finding is mapped to a MISRA C++:2023 guideline number and category.

In total, 178 of the 179 catalogued guidelines have an implemented rule. The rule mapping is a project-local model that has not been independently signed off, so treat findings as signals for review.

One analysis run can produce several outputs side by side:

• Plain text for the terminal, with a compact --summary mode
• JSON as the full compliance record, including a traceability matrix of every guideline
• HTML as a self-contained review report with coverage badges, category breakdowns and the full findings list
• SARIF 2.1.0 for IDEs, GitHub code scanning and CI systems, with MISRA category mapped to SARIF level, stable per-finding fingerprints and justified deviations kept as in-source suppressions
• Trend dashboard that aggregates a folder of dated JSON reports into a single page

THEMIS Lint runs from a CMake build as a custom target. It exits with status 0 even when violations are found, so a CI gate reads the report rather than the exit code.

Run with --fix and THEMIS Lint rewrites the sources for 23 rules that have a safe, mechanical correction. Typical fixes include:

• Braces added around bare if, else, loop and switch bodies
• NULL and 0 replaced with nullptr
• int and unsigned long replaced with fixed-width std::intN_t types
• Missing override and default: labels added
• Implicit narrowing and arithmetic conversions made explicit with static_cast
• Uninitialised variables and members given {} initialisers
• C-style casts replaced with the C++ cast the compiler actually performs

Every fix is announced on standard output with the rule and position. Fixes are never applied to a translation unit that Clang reported errors for, and an edit is refused if the file changed since analysis. Rules with no safe rewrite, such as dynamic memory use, are reported but never changed. Preview with a normal run first and use a clean working tree.

Real, reviewed exceptions are recorded inline with a misra-suppress(...) comment that carries a written justification. Suppressed findings are not hidden: they appear in the JSON, HTML and SARIF reports as overridden, together with their justification, so the audit trail stays visible.

• --component limits a run to files whose path matches
• --exclude skips generated and vendored code
• --rules restricts a run to selected rule IDs
• --jobs runs the analysis in parallel
• --list-rules prints the guideline catalog as JSON
• --title, --version and --githash stamp the report metadata

A Qt desktop application, themis-lint-gui, is also built from the same repository for reviewing findings alongside the source.

THEMIS Lint is built with CMake against Clang/LLVM and Qt6 Core, and is continuously built on Ubuntu 24.04, Ubuntu 26.04, AlmaLinux 9 and AlmaLinux 10. It installs with a man page and can be packaged as DEB or RPM.

THEMIS Lint is a practical review aid. It is not a formally certified MISRA tool and does not claim full coverage of every guideline. For a formal MISRA compliance claim, use a recognized MISRA tooling vendor and a formal review process.

The MISRA guideline text is a licensed publication available from misra.org.uk. THEMIS Lint does not reproduce it.