infer(1)

okay bestie, this is the infer(1) manual page — welcome to Infer Static Analyzer 💅✨

🌸 NAME 🌸

infer — static analysis for Java and C/C++/Objective-C/Objective-C++ 🫶

✨ SYNOPSIS ✨

infer analyze [options]
infer capture [options]
infer compile [options]
infer help [options]
infer explore [options]
infer report [options]
infer reportdiff [options]
infer run [options]
infer semdiff [options]
infer --compilation-database[-escaped] file [options]
infer [options] -- compile command
infer [options]

💖 DESCRIPTION 💖

Infer is a static analyzer. Give it a collection of source files written in Java or in languages of the C family, plus a command to build them, and it produces a list of potential issues. No cap, that’s the whole vibe check 🔥

Infer is made of a bunch of tools referenced in the SEE ALSO section of this manual. Peep their respective manuals for more info, bestie.

When you run it without a subcommand, and if a compilation command is specified via the -- option or one of the --clang-compilation-database[-escaped] options, then infer behaves as infer-run(1). Otherwise, infer behaves as infer-analyze(1). Slay 💅

💅 OPTIONS 💅

Every infer command accepts the arguments from all the other infer commands. Iconic.

Options are read from the .inferconfig file, then from the INFER_ARGS environment variable, then from the command line. Options in INFER_ARGS take precedence over options in .inferconfig, and options passed on the command line take precedence over options in INFER_ARGS. See the ENVIRONMENT and FILES sections of this manual for more info 🫶

Options can be specified inside an argument file file by passing @file as argument. The format is one option per line, and enclosing single ' and double " quotes are ignored.

Options without a default value (e.g., --changed-files-index) and options with list-like values (e.g., --Xbuck) all have a corresponding --option-reset flag that resets their values to nothing or the empty list, respectively. For instance, --Xbuck-reset will cancel any previous --Xbuck option passed to infer. Cleanup queen 🧹✨

See the manuals of individual infer commands for details about their supported options. The following is a list of all the supported options (see also --help-full for options reserved for internal use).

--analysis-schedule-file path — the file where an analysis schedule is stored. The default is infer-out/analysis_dependency_graph. See also infer-analyze(1).
--android-view-class-list +string — a class C is considered a view when it has a supertype that matches one of these classes. The default is [android.view.View]. See also infer-analyze(1).
--annotation-reachability — activates: annotation-reachability checker: given pairs of source and sink annotations, e.g. @A and @B, this checker will warn whenever some method annotated with @A calls, directly or indirectly, another method annotated with @B. Besides the custom pairs, it is also possible to enable some built-in checks, such as @PerformanceCritical reaching @Expensive or @NoAllocation reaching new. It is also possible to model methods as if they were annotated, using regular expressions. This should also work in languages where there are no annotations. See flags starting with --annotation-reachability. (Conversely: --no-annotation-reachability.) See also infer-analyze(1).
--no-annotation-reachability-apply-superclass-annotations — deactivates: applies annotations from superclasses and interfaces also on methods that are not overridden from the superclass or interface. (Conversely: --annotation-reachability-apply-superclass-annotations.) See also infer-analyze(1).
--annotation-reachability-check-loops — activates: highlights callsites in the trace that are nested in some loop. (Conversely: --no-annotation-reachability-check-loops.) See also infer-analyze(1).
--annotation-reachability-custom-models json — use regular expressions to treat methods as if they were annotated. The format is a map from annotations to objects with an "allow" and "block" field, which are both lists of regular expressions. A method is treated as annotated if any matcher in the allow list matches AND none of the matchers in the block list matches. If there are only "allow" matchers, a list can be given instead of the object.

Example 1:

{"Annotation": ["com\\.Myclass\\.foo.*"]}

Example 2:

{"Annotation": {"allow": ["foo.*"], "block": ["foobar"]}}

See also infer-analyze(1).

--annotation-reachability-custom-pairs json — specify custom sources/sinks, and optionally sanitizers for the annotation reachability checker. The optional "minimize_sinks" (default: true) and "minimize_sources" (default: false) flags control path minimization. When "minimize_sinks" is true, paths where a prefix is also a source-to-sink path are not reported. For example if there is a source() -> sink1() -> sink2() path then only source() -> sink1() will be reported. When "minimize_sources" is true, paths where a suffix is also a source-to-sink path are not reported. For example if there is a source1() -> source2() -> sink() path then only source2() -> sink() will be reported. Example format: for custom annotations com.my.annotation.{Source1,Source2,Sink1,Sanitizer1}

{ "sources" : ["Source1", "Source2"], "sinks" : ["Sink1"],
"sanitizers": ["Sanitizer1"], "minimize_sources": true,
"minimize_sinks": false }

See also infer-analyze(1).

--annotation-reachability-expensive — activates: check if methods annotated with @PerformanceCritical can call expensive methods (annotated @Expensive or modeled, with annotation reachability checker). (Conversely: --no-annotation-reachability-expensive.) See also infer-analyze(1).
--annotation-reachability-no-allocation — activates: check if methods annotated with @NoAllocation can allocate (with annotation reachability checker). (Conversely: --no-annotation-reachability-no-allocation.) See also infer-analyze(1).
--annotation-reachability-only — activates: enable annotation-reachability and disable all other checkers. (Conversely: --no-annotation-reachability-only.) See also infer-analyze(1).
--annotation-reachability-report-source-and-sink — activates: reports methods that are marked as both a source and a sink at the same time. (Conversely: --no-annotation-reachability-report-source-and-sink.) See also infer-analyze(1).
--bitcode-capture — activates: [EXPERIMENTAL] use llvm frontend to capture files compiled with clang. (Conversely: --no-bitcode-capture.) See also infer-capture(1).
--no-bo-assume-void — deactivates: assume void type as a type of record fields not in type environment. (Conversely: --bo-assume-void.) See also infer-analyze(1).
--no-bo-bottom-as-default — deactivates: use bottom as a default value instead of unknown. (Conversely: --bo-bottom-as-default.) See also infer-analyze(1).
--bo-context-sensitive-allocsites — activates: assume that different calls to the same function creating an allocsite results in different allocsites imported to the caller. (Conversely: --no-bo-context-sensitive-allocsites.) See also infer-analyze(1).
--bo-debug int — debug level for buffer-overrun checker (0-4). See also infer-analyze(1).
--bo-exit-frontend-gener-vars — activates: put frontend generated variables out of scope when they are listed in exit scope instruction. (Conversely: --no-bo-exit-frontend-gener-vars.) See also infer-analyze(1).
--bo-field-depth-limit int — limit of field depth of abstract location in buffer-overrun checker. See also infer-analyze(1).
--bo-max-cfg-size int — larger CFGs than the max size are skipped in buffer overrun analysis. See also infer-analyze(1).
--bo-sound-unknown-sets-join — activates: join with an unknown set always result in an unknown set. When disabled, unknown set behaves as bot. (Conversely: --no-bo-sound-unknown-sets-join.) See also infer-analyze(1).
--bootclasspath string — specify the Java bootclasspath. See also infer-capture(1).
--buck-clang — activates: Buck integration for clang-based targets (C/C++/Objective-C/Objective-C++). (Conversely: --no-buck-clang.) See also infer-capture(1).
--buck-compilation-database { no-deps | deps } — Buck integration using the compilation database, with or without dependencies. Only includes clang targets, as per Buck's #compilation-database flavor. See also infer-capture(1).
--buck-compilation-database-depth int — depth of dependencies used by the --buck-compilation-database deps option. By default, all recursive dependencies are captured. See also infer-capture(1).
--buck-dependency-depth int — capture dependencies only if they are at most the depth provided, or all transitive dependencies if depth is not provided (the default). In particular, depth zero means capture exactly the targets provided and nothing else. See also infer-capture(1).
--buck-erlang — activates: Buck integration for Erlang. (Conversely: --no-buck-erlang.) See also infer-capture(1).
--buck-java — activates: Buck integration for Java. (Conversely: --no-buck-java.) See also infer-capture(1).
--buck-python — activates: Buck integration for Python. (Conversely: --no-buck-python.) See also infer-capture(1).
--buck-swift — activates: when using the BXL Clang integration, pass --swift <bool> to control capture of Swift files. (Conversely: --no-buck-swift.) See also infer-capture(1).
--buck-swift-keep-going — activates: when using the BXL Clang integration, pass --swift-keep-going <bool>. (Conversely: --no-buck-swift-keep-going.) See also infer-capture(1).
--buck-targets-block-list +regex — skip capture of buck targets matched by the specified regular expression. See also infer-capture(1) and infer-run(1).
--buck2-bxl-capture-file-block-list +regex — skip capture of files matched by the specified regular expression. Only the clang, Buck2 integration is supported, not Java. See also infer-capture(1) and infer-run(1).
--buck2-bxl-target string — Buck2 BXL script (as a buck target) to run when capturing with buck2/clang integration. See also infer-capture(1).
--buck2-inferconfig-target string — the Buck2 target that points at the inferconfig file; it gets used in BXL capture. Peep infer-capture(1) too 💖
--buck2-infertoolchain-target string — the Buck2 target for the infer toolchain, also used in BXL capture. Again, infer-capture(1) has the lore 🫶
--buck2-isolation-dir string — runs buck bxl capture with that isolation directory passed as a parameter. infer-capture(1), bestie 💅
--no-buck2-query-deps — turns off: querying the deps of the given targets and running capture on the result (otherwise it just runs capture on the given targets). Flip it back with --buck2-query-deps. See infer-capture(1) ✨
--buck2-root dir — tells Infer where the parent directory of buck-out lives (only matters for buck2, no cap). See infer-capture(1) and infer-run(1) 🌸
--bufferoverrun — turns on the bufferoverrun checker: InferBO, the detector for out-of-bounds array accesses. DEPRECATED: use Pulse instead 😭 Turn it off with --no-bufferoverrun. See infer-analyze(1) 💀
--bufferoverrun-only — turns on: enables bufferoverrun and disables every other checker. Off with --no-bufferoverrun-only. See infer-analyze(1) 🔥
--capture-block-list json — a matcher (or a whole list of matchers) for the names of files that should not be captured — which, yeah, means they don't get analyzed either. Clang, Java, and Hack only, bestie. See infer-capture(1) and infer-run(1) 🎀
--no-censor-report +issue_type_regex — for debugging/experimentation only, fr fr: name the issues that should not be censored by --censor-report. See infer-report(1) and infer-run(1) 🙈
--censor-report +string — a filter for issues to be censored, which works by slapping a censored_reason field into the json report. Infer won't show censored issues on the console output or in report.txt, but tools that post-process the json report can still take them into account, iconic behavior. If you give multiple filters, they're applied in the order you specified them. Each filter gets applied to every issue detected, and only issues accepted by all filters actually get reported. Each filter looks like:

`<issue_type_regex>:<filename_regex>:<reason_string>`

The first two components are OCaml Str regular expressions, with an optional ! character prefix. If a regex has a ! prefix the polarity is inverted and the filter becomes a "block list" instead of an "allow list" (yes, the original says "allow list", we're quoting the vibe 💅). Each filter is read as an implication: an issue matches if it does not match the issue_type_regex or if it does match the filename_regex. The filenames tested by the regex are relative to the --project-root directory. The <reason_string> is a non-empty string explaining why the issue got filtered. See infer-report(1) and infer-run(1) 🦋

--cfg-json file — path to the CFG json file. See infer-capture(1) ⭐
--changed-files-index file — names the file containing the list of source files where reactive analysis should start. Those source files should be relative to the project root, or absolute. Your call. See infer-analyze(1) ✨
--clang-biniou-file file — a file holding the AST of the program, in biniou format. Heads up: you still need to provide a compilation command, no shortcuts 🫶 See infer-capture(1)
--clang-block-listed-flags +string — Clang flags to filter out. See infer-capture(1) 💜
--clang-block-listed-flags-with-arg +string — Clang flags (the ones that take args) to filter out. See infer-capture(1) 🌸
--clang-compound-literal-init-limit int — the limit past which initializing compound types (structs and arrays) stops going element by element and instead uses a builtin function that each analysis has to model. See infer-analyze(1) and infer-capture(1) 🔥
--clang-yojson-file file — a file holding the AST of the program, in yojson format. Same deal: you still need a compilation command. See infer-capture(1) 🎀
--compilation-database +path — a file containing compilation commands (you can pass this multiple times, go off). See infer-capture(1) 💖
--compilation-database-escaped +path — same thing but the compilation commands have all their entries escaped for the shell, e.g. ones coming from Xcode (also can be specified multiple times). See infer-capture(1) 🌈
--complete-capture-from path — give it the path to an infer results directory containing a capture database. The capture database you specified with --results-dir (which must exist) gets completed from the input database, according to the missing-* files in the results directory. The exit code equals the number of rows added to the capture database. Cute, right? See infer-debug(1) 👑
--config-gating — turns on the config-gating checker: it determines which config flags gate the execution of each line of code. Off with --no-config-gating. See infer-analyze(1) 🌟
--config-gating-only — turns on: enables config-gating and disables every other checker. Off with --no-config-gating-only. See infer-analyze(1) 💅
--config-impact-analysis — turns on the config-impact-analysis checker: [EXPERIMENTAL] collects functions that are called without config checks. Off with --no-config-impact-analysis. See infer-analyze(1) 🧚
--config-impact-analysis-only — turns on: enables config-impact-analysis and disables every other checker. Off with --no-config-impact-analysis-only. See infer-analyze(1) 🦋
--config-impact-current path — config impact report of the latest revision. See infer-reportdiff(1) 💜
--config-impact-data-file file — [ConfigImpact] names the file containing the config data. See infer-report(1) 🍓
--config-impact-issues-tests file — writes a list of config impact issues to file, in a format suitable for config impact tests. See infer-report(1) ✨
--config-impact-max-callees-to-print int — the max number of unchecked callees to print in the config impact checker. See infer-report(1) and infer-reportdiff(1) 🌸
--config-impact-previous path — config impact report of the base revision, the one you use for comparison. See infer-reportdiff(1) 🫶
--continue — turns on: continue the capture for reactive analysis, increasing the changed files/procedures (and if a procedure was already changed beforehand, it keeps the changed marking). Off with --no-continue. See infer-capture(1) ⭐
--continue-analysis — turns on: keep analyzing after more targets get captured by --continue. The other analysis options should be given the same as before. Not compatible with --reanalyze and --incremental-analysis — important, don't do it 😭 Off with --no-continue-analysis. See infer-analyze(1) 💀
--cost — turns on the cost checker: computes the asymptotic complexity of functions with respect to execution cost or other user-defined resources. You can use it to detect changes in complexity with infer reportdiff, which is kind of a slay. Off with --no-cost. See infer-analyze(1) 🔥
--cost-issues-tests file — writes a list of cost issues to file, in a format suitable for cost tests. See infer-report(1) 🎀
--cost-only — turns on: enables cost and disables every other checker. Off with --no-cost-only. See infer-analyze(1) 💅
--no-cost-suppress-func-ptr — turns off: suppressing function pointers in cost reports. Flip it back with --cost-suppress-func-ptr. See infer-analyze(1) 🙈
--costs-current path — costs report of the latest revision. See infer-reportdiff(1) 💜
--costs-previous path — costs report of the base revision, to use for comparison. See infer-reportdiff(1) 🌈
--no-cxx — turns off: analyzing C++ methods. Flip it back with --cxx. See infer-capture(1) 🦋
--cxx-scope-guards json — names the scope guard classes that can be read only by destructors without getting reported as dead stores. See infer-analyze(1) 🍓
--debug, -g — turns on: Debug mode, which also sets --debug-level 2, --developer-mode, --print-buckets, --print-types, --reports-include-ml-loc, --no-only-cheap-debug, --trace-error, --write-html. Off with --no-debug or -G. See infer-analyze(1), infer-capture(1), infer-compile(1), infer-report(1), infer-reportdiff(1), infer-run(1), and infer-semdiff(1) 👑
--debug-level level — debug level, which sets --bo-debug level, --debug-level-analysis level, and --debug-level-capture level:
- 0: only basic debugging enabled
- 1: verbose debugging enabled
- 2: very verbose debugging enabled

See infer-analyze(1), infer-capture(1), infer-compile(1), infer-report(1), infer-reportdiff(1), infer-run(1), and infer-semdiff(1) ✨

--debug-level-analysis int — debug level for the analysis. Check --debug-level for the accepted values. See infer-analyze(1), infer-capture(1), infer-compile(1), infer-report(1), infer-reportdiff(1), infer-run(1), and infer-semdiff(1) 🫶
--debug-level-capture int — debug level for the capture. Check --debug-level for the accepted values. See infer-analyze(1), infer-capture(1), infer-compile(1), infer-report(1), infer-reportdiff(1), infer-run(1), and infer-semdiff(1) 🌸
--debug-level-report int — debug level for the report. Check --debug-level for the accepted values. See infer-analyze(1), infer-capture(1), infer-compile(1), infer-report(1), infer-reportdiff(1), infer-run(1), and infer-semdiff(1) 💜
--no-deduplicate — turns off: applying issue-specific deduplication during analysis and/or reporting. Flip it back with --deduplicate. See infer-analyze(1), infer-report(1), and infer-reportdiff(1) 😭
--deduplicate-by { location | trace } — controls a generic deduplication mechanism. Issue description and issue type are always taken into account when deduplicating for reporting. On top of that, you can also take the location OR the trace into account. Using the trace to de-duplicate can result in multiple distinct traces being reported at the same location, which isn't possible with the default deduplication by location. See infer-report(1) 🔥
--no-default-checkers — turns OFF the whole default squad: --static-constructor-stall-checker, --fragment-retains-view, --inefficient-keyset-iterator, --liveness, --parameter-not-null-checked, --pulse, --racerd, --self-in-block, --starvation, --swift-objc-nullability. And the opposite ofc is --default-checkers. See also infer-analyze(1) 💅
--dependencies — turns ON: translate all the dependencies while capturing, meaning the classes inside the jar file you hand over get translated too, no sources needed. (The flip side is --no-dependencies.) See also infer-capture(1).
--detach-analysis-dependency — turns ON: detach the analysis dependencies of checkers during analysis, so every checker only triggers itself when it's analyzing a callee 🫶. Why you'd want that? It saves you from useless analyses when NOT all of the captured data is supposed to be analyzed — like when --changed-files-index is given, bestie. (Flip side: --no-detach-analysis-dependency.) See also infer-analyze(1).
--dict-missing-key-var-block-list +string — skips analyzing the variables in the dict-missing-key checker, no notes. See also infer-analyze(1).
--differential-filter-files string — points at the file that contains the list of source files you want a differential report for. Those source files should be written relative to the project root, or be absolute. That's it, that's the whole vibe. See also infer-report(1).
--disable-issue-type +issue_type — do NOT show reports coming from this type of issue 🙅‍♀️. Each checker can report a whole range of issue types, so this option is your fine-grained filter for deciding which types of issue get reported once the checkers have already run. Big heads-up though: disabling issue types does not stop the corresponding checker from running — it still runs, it just stays quiet. Available issue types are:
- ARBITRARY_CODE_EXECUTION_UNDER_LOCK (enabled by default)
- BAD_ARG (enabled by default)
- BAD_ARG_LATENT (disabled by default)
- BAD_GENERATOR (enabled by default)
- BAD_GENERATOR_LATENT (disabled by default)
- BAD_KEY (enabled by default)
- BAD_KEY_LATENT (disabled by default)
- BAD_MAP (enabled by default)
- BAD_MAP_LATENT (disabled by default)
- BAD_RECORD (enabled by default)
- BAD_RECORD_LATENT (disabled by default)
- BAD_RETURN (enabled by default)
- BAD_RETURN_LATENT (disabled by default)
- BLOCK_PARAMETER_NOT_NULL_CHECKED (enabled by default)
- BUFFER_OVERRUN_L1 (enabled by default)
- BUFFER_OVERRUN_L2 (enabled by default)
- BUFFER_OVERRUN_L3 (enabled by default)
- BUFFER_OVERRUN_L4 (disabled by default)
- BUFFER_OVERRUN_L5 (disabled by default)
- BUFFER_OVERRUN_S2 (enabled by default)
- BUFFER_OVERRUN_U5 (disabled by default)
- CAPTURED_STRONG_SELF (enabled by default)
- CHECKERS_ALLOCATES_MEMORY (enabled by default)
- CHECKERS_ANNOTATION_REACHABILITY_ERROR (enabled by default)
- CHECKERS_CALLS_EXPENSIVE_METHOD (enabled by default)
- CHECKERS_EXPENSIVE_OVERRIDES_UNANNOTATED (enabled by default)
- CHECKERS_FRAGMENT_RETAINS_VIEW (enabled by default)
- COMPARED_TO_NULL_AND_DEREFERENCED (disabled by default)
- CONDITION_ALWAYS_FALSE (disabled by default)
- CONDITION_ALWAYS_TRUE (disabled by default)
- CONFIG_GATED (enabled by default)
- CONFIG_IMPACT (enabled by default)
- CONFIG_IMPACT_STRICT (disabled by default)
- CONFIG_UNGATED (enabled by default)
- CONFIG_USAGE (disabled by default)
- CONSTANT_ADDRESS_DEREFERENCE (disabled by default)
- CONSTANT_ADDRESS_DEREFERENCE_LATENT (disabled by default)
- CXX_REF_CAPTURED_IN_BLOCK (enabled by default)
- CXX_STRING_CAPTURED_IN_BLOCK (disabled by default)
- DATA_FLOW_TO_SINK (disabled by default)
- DEADLOCK (enabled by default)
- DEAD_STORE (enabled by default)
- DO_NOT_REPORT (enabled by default)
- EXECUTION_TIME_COMPLEXITY_INCREASE (enabled by default)
- EXECUTION_TIME_COMPLEXITY_INCREASE_UI_THREAD (enabled by default)
- EXECUTION_TIME_UNREACHABLE_AT_EXIT (disabled by default)
- EXPENSIVE_EXECUTION_TIME (disabled by default)
- EXPENSIVE_LOOP_INVARIANT_CALL (enabled by default)
- GUARDEDBY_VIOLATION (enabled by default)
- IMPURE_FUNCTION (enabled by default)
- INEFFICIENT_KEYSET_ITERATOR (enabled by default)
- INFERBO_ALLOC_IS_BIG (enabled by default)
- INFERBO_ALLOC_IS_NEGATIVE (enabled by default)
- INFERBO_ALLOC_IS_ZERO (enabled by default)
- INFERBO_ALLOC_MAY_BE_BIG (enabled by default)
- INFERBO_ALLOC_MAY_BE_NEGATIVE (enabled by default)
- INFINITE_EXECUTION_TIME (disabled by default)
- INFINITE_LOOP (disabled by default)
- INFINITE_RECURSION (disabled by default)
- INTEGER_OVERFLOW_L1 (enabled by default)
- INTEGER_OVERFLOW_L2 (enabled by default)
- INTEGER_OVERFLOW_L5 (disabled by default)
- INTEGER_OVERFLOW_U5 (disabled by default)
- INTERFACE_NOT_THREAD_SAFE (enabled by default)
- INVALID_SIL (enabled by default)
- INVARIANT_CALL (disabled by default)
- IPC_ON_UI_THREAD (enabled by default)
- LAB_RESOURCE_LEAK (enabled by default)
- LINEAGE_FLOW (enabled by default)
- LOCKLESS_VIOLATION (enabled by default)
- LOCK_CONSISTENCY_VIOLATION (enabled by default)
- LOCK_ON_UI_THREAD (disabled by default)
- MEMORY_LEAK_C (enabled by default)
- MEMORY_LEAK_CPP (disabled by default)
- MISSING_NULLABILITY_ANNOTATION (enabled by default)
- MISSING_NULLABILITY_ANNOTATION_PULSE (enabled by default)
- MISSING_REQUIRED_PROP (enabled by default)
- MIXED_SELF_WEAKSELF (enabled by default)
- MODIFIES_IMMUTABLE (enabled by default)
- MULTIPLE_WEAKSELF (enabled by default)
- MUTUAL_RECURSION_CYCLE (disabled by default)
- NIL_BLOCK_CALL (enabled by default)
- NIL_BLOCK_CALL_LATENT (disabled by default)
- NIL_INSERTION_INTO_COLLECTION (enabled by default)
- NIL_INSERTION_INTO_COLLECTION_LATENT (disabled by default)
- NIL_MESSAGING_TO_NON_POD (enabled by default)
- NIL_MESSAGING_TO_NON_POD_LATENT (disabled by default)
- NO_MATCHING_BRANCH_IN_TRY (enabled by default)
- NO_MATCHING_BRANCH_IN_TRY_LATENT (disabled by default)
- NO_MATCHING_CASE_CLAUSE (enabled by default)
- NO_MATCHING_CASE_CLAUSE_LATENT (disabled by default)
- NO_MATCHING_ELSE_CLAUSE (enabled by default)
- NO_MATCHING_ELSE_CLAUSE_LATENT (disabled by default)
- NO_MATCHING_FUNCTION_CLAUSE (enabled by default)
- NO_MATCHING_FUNCTION_CLAUSE_LATENT (disabled by default)
- NO_MATCH_OF_RHS (enabled by default)
- NO_MATCH_OF_RHS_LATENT (disabled by default)
- NO_TRUE_BRANCH_IN_IF (enabled by default)
- NO_TRUE_BRANCH_IN_IF_LATENT (disabled by default)
- NSSTRING_INTERNAL_PTR_CAPTURED_IN_BLOCK (disabled by default)
- NULLPTR_DEREFERENCE (enabled by default)
- NULLPTR_DEREFERENCE_IN_NULLSAFE_CLASS (enabled by default)
- NULLPTR_DEREFERENCE_IN_NULLSAFE_CLASS_LATENT (disabled by default)
- NULLPTR_DEREFERENCE_LATENT (disabled by default)
- NULL_ARGUMENT (enabled by default)
- NULL_ARGUMENT_LATENT (disabled by default)
- OPTIONAL_EMPTY_ACCESS (enabled by default)
- OPTIONAL_EMPTY_ACCESS_LATENT (disabled by default)
- PULSE_ASSERTION_ERROR (disabled by default)
- PULSE_CANNOT_INSTANTIATE_ABSTRACT_CLASS (disabled by default)
- PULSE_CONST_REFABLE (enabled by default)
- PULSE_DICT_MISSING_KEY (disabled by default)
- PULSE_DYNAMIC_TYPE_MISMATCH (disabled by default)
- PULSE_READONLY_SHARED_PTR_PARAM (enabled by default)
- PULSE_REFERENCE_STABILITY (enabled by default)
- PULSE_RESOURCE_LEAK (enabled by default)
- PULSE_TRANSITIVE_ACCESS (enabled by default)
- PULSE_UNAWAITED_AWAITABLE (enabled by default)
- PULSE_UNFINISHED_BUILDER (disabled by default)
- PULSE_UNINITIALIZED_CONST (disabled by default)
- PULSE_UNINITIALIZED_METHOD (disabled by default)
- PULSE_UNINITIALIZED_VALUE (enabled by default)
- PULSE_UNNECESSARY_COPY (enabled by default)
- PULSE_UNNECESSARY_COPY_ASSIGNMENT (enabled by default)
- PULSE_UNNECESSARY_COPY_ASSIGNMENT_CONST (enabled by default)
- PULSE_UNNECESSARY_COPY_ASSIGNMENT_MOVABLE (enabled by default)
- PULSE_UNNECESSARY_COPY_INTERMEDIATE (enabled by default)
- PULSE_UNNECESSARY_COPY_INTERMEDIATE_CONST (disabled by default)
- PULSE_UNNECESSARY_COPY_MOVABLE (enabled by default)
- PULSE_UNNECESSARY_COPY_OPTIONAL (enabled by default)
- PULSE_UNNECESSARY_COPY_OPTIONAL_CONST (disabled by default)
- PULSE_UNNECESSARY_COPY_RETURN (disabled by default)
- PULSE_UNNECESSARY_COPY_THRIFT_ASSIGNMENT (enabled by default)
- PURE_FUNCTION (enabled by default)
- REGEX_OP_ON_UI_THREAD (enabled by default)
- RETAIN_CYCLE (enabled by default)
- RETAIN_CYCLE_NO_WEAK_INFO (disabled by default)
- SCOPE_LEAKAGE (enabled by default)
- SELF_IN_BLOCK_PASSED_TO_INIT (enabled by default)
- SENSITIVE_DATA_FLOW (disabled by default)
- STACK_VARIABLE_ADDRESS_ESCAPE (enabled by default)
- STARVATION (enabled by default)
- STATIC_CONSTRUCTOR_STALL (disabled by default)
- STATIC_INITIALIZATION_ORDER_FIASCO (enabled by default)
- STRICT_MODE_VIOLATION (enabled by default)
- STRONG_SELF_NOT_CHECKED (enabled by default)
- TAINT_ERROR (enabled by default)
- THREAD_SAFETY_VIOLATION (enabled by default)
- TOPL_ERROR (enabled by default)
- TOPL_ERROR_LATENT (disabled by default)
- UNREACHABLE_CODE (enabled by default)
- USE_AFTER_DELETE (enabled by default)
- USE_AFTER_DELETE_LATENT (disabled by default)
- USE_AFTER_FREE (enabled by default)
- USE_AFTER_FREE_LATENT (disabled by default)
- USE_AFTER_LIFETIME (enabled by default)
- USE_AFTER_LIFETIME_LATENT (disabled by default)
- VECTOR_INVALIDATION (enabled by default)
- VECTOR_INVALIDATION_LATENT (disabled by default)
- WEAK_SELF_IN_NO_ESCAPE_BLOCK (enabled by default)

See also infer-analyze(1).

--log-missing-deps — activates: log analysis dependencies that cannot be found (conversely: --no-log-missing-deps). See also infer-analyze(1).
--log-pulse-coverage — activates: log precisely where coverage stops, at the end of file stats/stats.txt (conversely: --no-log-pulse-coverage). See also infer-analyze(1).
--log-pulse-disjunct-increase-after-model-call — activates: log which model did increase the current number of Pulse disjuncts (conversely: --no-log-pulse-disjunct-increase-after-model-call). See also infer-analyze(1).
--loop-hoisting — activates: the loop-hoisting checker, which detects opportunities to hoist function calls that are invariant outside of loop bodies for efficiency.

DEPRECATED: this checker is deprecated and will be removed in a future release ⚠️

(conversely: --no-loop-hoisting). See also infer-analyze(1).

--loop-hoisting-only — activates: enable loop-hoisting and disable all other checkers (conversely: --no-loop-hoisting-only). See also infer-analyze(1).
--mark-unchanged-procs — activates: check structural identity of newly-captured procedures with previously-captured versions, marking the new procedure as unchanged if the two are equivalent. Also prevents removing the results db during capture, so that unchanged results can be reused during future incremental analyses ♻️ (conversely: --no-mark-unchanged-procs). See also infer-capture(1).
--no-mask-sawja-exceptions — deactivates: mask exceptions thrown by Sawja/Javalib during Java capture (conversely: --mask-sawja-exceptions). See also infer-capture(1).
--max-jobs int — maximum number of analysis jobs running simultaneously. Experiments show the current best value is 40 jobs 🔥. See also infer-analyze(1).
--max-nesting int — level of nested procedure calls to show. Trace elements beyond the maximum nesting level are skipped. If omitted, all levels are shown 🪆. See also infer-explore(1).
--memtrace-analysis-profiling — activates: generate OCaml analysis allocation traces in infer-out/memtrace (conversely: --no-memtrace-analysis-profiling). See also infer-analyze(1).
--memtrace-sampling-rate float — sampling rate for Memtrace allocation profiling. Default is 1e-6. See also infer-analyze(1).
--merge-capture +string — specifies an Infer results directory. The files and procedures captured in it will be merged together into the results directory specified with -o. Relative paths are interpreted as relative to project-root/buck-out. See also infer-capture(1).
--merge-report +string — specifies an Infer results directory. The reports stored in JSON files in all specified results directories will be merged together and deduplicated before being stored in the main results directory 💖. See also infer-report(1).
--merge-summaries +string — points at an Infer results directory, bestie. Every results directory you list gets its summaries smooshed together and deduplicated before the reporting happens. See also infer-report(1).
--modeled-expensive json — a matcher (or a whole list of matchers, go off) for methods the performance-critical checker should treat as expensive. See also infer-analyze(1).
--multicore — turns on: [EXPERIMENTAL] multi-threading for analysis, which rn is partially implemented or not implemented at all, so like… manage your expectations 💀. (Flip side: --no-multicore.) See also infer-analyze(1).
--never-returning-null json — [Java only, all analyses] a matcher or list of matchers for functions that literally never return null, no cap. See also infer-analyze(1), infer-capture(1), and infer-run(1).
--noescaping-function-list +string — handy for the CXX_REF_CAPTURED_IN_BLOCK check. It declares a list of functions that take blocks as arguments, where those blocks are no-escaping but we just can't annotate them accordingly 😭. See also infer-analyze(1).
--objc-block-execution-macro string — the macro used for executing Objective-C blocks safely. See also infer-analyze(1).
--objc-synthesize-dealloc — turns on: when enabled, capture tries to synthesize code in the dealloc methods of Objective-C classes matching what the compiler does. Iconic compiler cosplay tbh. (Flip side: --no-objc-synthesize-dealloc.) See also infer-capture(1).
--ondemand-callchain-limit int — when enabled, the number of consecutive recursive ondemand calls gets bounded. See also infer-analyze(1).
--ondemand-recursion-restart-limit int — okay so this one's a whole saga: to make the analysis of mutual recursion cycles deterministic in their output, the analysis of a cycle of mutually recursive functions may restart the analysis of the entire cycle from a deterministic place. If the mutual-recursion graph is more complex than a simple cycle, this could potentially cause a lot of restarts before it finds the "right" procedure to start from 🙈. This option limits how many restarts happen before we give up and just analyze the cycle as-is instead. See also infer-analyze(1).
--no-parameter-not-null-checked — turns off: the parameter-not-null-checked checker, an Objective-C-specific analysis that detects when a block parameter gets used before it's been checked for null first. (Flip side: --parameter-not-null-checked.) See also infer-analyze(1).
--parameter-not-null-checked-only — turns on: enable parameter-not-null-checked and disable all the other checkers. Main character checker energy 👑. (Flip side: --no-parameter-not-null-checked-only.) See also infer-analyze(1).
--pmd-xml — turns on: output issues in (PMD) XML format at infer-out/report.xml. (Flip side: --no-pmd-xml.) See also infer-run(1).
--preanalysis-html — turns on: whether the HTML node printing for preanalysis is enabled or not. It's set to false by default, since that helps you focus on debugging just the enabled analyses ✨. (Flip side: --no-preanalysis-html.) See also infer-debug(1).
--print-active-checkers — turns on: print the active checkers before the analysis kicks off. (Flip side: --no-print-active-checkers.) See also infer-analyze(1).
--print-logs — turns on: also log messages to stdout and stderr. (Flip side: --no-print-logs.) See also infer-analyze(1), infer-capture(1), infer-report(1), and infer-run(1).
--procedures — turns on: print the functions and methods that infer discovered. (Flip side: --no-procedures.) See also infer-debug(1).
--procedures-attributes — turns on: print the attributes of each procedure in the output of --procedures. (Flip side: --no-procedures-attributes.) See also infer-debug(1).
--procedures-call-graph — turns on: output a dotty file at infer-out/captured/syntactic-call-graph.dot. That graph is the syntactic call graph reachable from either all captured procedures or the ones determined by the option --changed-files-index. (Flip side: --no-procedures-call-graph.) See also infer-debug(1).
--procedures-callees — turns on: print the static callees of each procedure in the output of --procedures. (Flip side: --no-procedures-callees.) See also infer-debug(1).
--procedures-cfg — turns on: output a dotty file at infer-out/captured/<file_name>/<proc_name>.dot for each procedure in the output of --procedures. (Flip side: --no-procedures-cfg.) See also infer-debug(1).
--no-procedures-definedness — turns off: include procedures' definedness in the output of --procedures — like whether the procedure definition was found, or only the procedure declaration, or whether the procedure is an auto-generated Objective-C accessor. (Flip side: --procedures-definedness.) See also infer-debug(1).
--procedures-filter filter — with --procedures, only print the functions and methods (procedures) matching the filter you give it. A procedure filter looks like path_pattern:procedure_name. Patterns get interpreted as OCaml Str regular expressions. For instance, to keep only methods named "foo", you can use the filter ".*:foo", or just "foo" for short 🎀. See also infer-debug(1).
--procedures-name — turns on: include procedures' names in the output of --procedures. (Flip side: --no-procedures-name.) See also infer-debug(1).
--no-procedures-source-file — turns off: include the source file where the procedure definition or declaration was found in the output of --procedures. (Flip side: --procedures-source-file.) See also infer-debug(1).
--procedures-summary — turns on: print the summaries of each procedure in the output of --procedures. Also peep --procedures-summary-skip-empty. (Flip side: --no-procedures-summary.) See also infer-debug(1).
--procedures-summary-json — turns on: emit the summaries of each procedure in the output of --procedures as JSON. (Flip side: --no-procedures-summary-json.) See also infer-debug(1).
--procedures-summary-skip-empty — turns on: completely skip procedures that have no summaries. Super useful when you're analyzing just a small part of a big project 🫶. (Use it in conjunction with --procedures-summary or --procedures-summary-json. See also --changed-files-index.) (Flip side: --no-procedures-summary-skip-empty.) See also infer-debug(1).
--procs-to-analyze-index file — specify the file containing an Sexp representing a list of pairs of procedures and specializations to analyze. Heads up: only works with the restart scheduler. See also infer-analyze(1).
--no-progress-bar,-P — turns off: show a progress bar. (Flip side: --progress-bar | -p.) See also infer-run(1).
--progress-bar-style { auto | plain | multiline } — the style of the progress bar. auto picks multiline if you're connected to a tty, otherwise plain. See also infer-analyze(1) and infer-capture(1).
--project-root,-C dir — specify the root directory of the project. See also infer-analyze(1), infer-capture(1), infer-report(1), and infer-run(1).
--no-pulse — turns off: the pulse checker, the general-purpose memory and value analysis engine. (Flip side: --pulse.) See also infer-analyze(1).
--pulse-cut-to-one-path-procedures-pattern string — a regex of methods for which pulse will only explore one path 🛤️. Can be used on pathologically large procedures to prevent too-big states from being produced. See also infer-analyze(1).
--pulse-eternal — turns on: [EXPERIMENTAL] the latest iteration of the non-termination loop prover based on the UNTER under-approximate theory. (Flip side: --no-pulse-eternal.) See also infer-analyze(1).
--pulse-inline-global-init-func-pointer — turns on: inline the initializer of global variables that are of type function pointer in Pulse. (Flip side: --no-pulse-inline-global-init-func-pointer.) See also infer-analyze(1).
--pulse-log-summary-count — turns on: log the number of summaries (grouped by summary kind) for each analyzed procedure in Pulse. Results land in JSON files under a 'pulse' subdirectory, one per analysis job. Ngl, when you join the files you might need to deduplicate 💅. (Flip side: --no-pulse-log-summary-count.) See also infer-analyze(1).
--pulse-max-cfg-size int — CFGs bigger than the max size get skipped in Pulse. See also infer-analyze(1).
--pulse-max-disjuncts int — stop exploring new paths after int disjunctions in the domain. See also infer-analyze(1).
--pulse-max-heap int — give up analyzing a procedure if the number of words in the heap exceeds this limit. Intended use: avoid OutOfMemory crashes 😭. See also infer-analyze(1).
--pulse-model-abort +string — methods that should be modelled as abort in Pulse. See also infer-analyze(1).
--pulse-model-alloc-pattern string — a regex of methods that should be modelled as allocs in Pulse. See also infer-analyze(1).
--pulse-model-cheap-copy-type regex — a regex of methods that should be cheap to copy in Pulse. See also infer-analyze(1).
--pulse-model-cheap-copy-type-list +regex — a regex of methods that should be cheap to copy in Pulse. See also infer-analyze(1).
--pulse-model-deep-release-pattern string — a regex of methods that should be modelled as deep release in Pulse (i.e. await all unawaited values reachable from its arguments). See also infer-analyze(1).
--pulse-model-free-pattern string — a regex of methods that should be modelled as wrappers to free(3) in Pulse. The pointer to be freed should be the first argument of the function. You should only need this if the wrapper's code isn't visible to infer or if Pulse somehow doesn't understand it (e.g. the call is dispatched to global function pointers). See also infer-analyze(1).
--pulse-model-malloc-pattern string — a regex of methods that should be modelled as wrappers to malloc(3) in Pulse. The size to allocate should be the first argument of the function. Peep --pulse-model-free-pattern for more info. See also infer-analyze(1).
--pulse-model-realloc-pattern string — a regex of methods that should be modelled as wrappers to realloc(3) in Pulse. The pointer to be reallocated should be the first argument of the function and the new size should be the second argument. Peep --pulse-model-free-pattern for more info. See also infer-analyze(1).
--pulse-model-release-pattern string — a regex of methods that Pulse should model as release, bestie. See also infer-analyze(1).
--pulse-model-return-first-arg string — regex of methods Pulse should model as returning the first argument, like, in terms of the source language semantics 💅 languages supported: Java, C, Objective-C. See also infer-analyze(1).
--pulse-model-return-nonnull string — regex of methods to model as returning non-null in Pulse. See also infer-analyze(1).
--pulse-model-return-nonnull-list +string — same non-null energy, but you can stack them (that + means repeatable ✨). See also infer-analyze(1).
--pulse-model-return-nullable string — regex of methods modelled as returning nullable values in Pulse. See also infer-analyze(1).
--pulse-model-return-nullable-list +string — the repeatable version of the nullable one 🫶. See also infer-analyze(1).
--pulse-model-return-this string — regex of methods modelled as returning the this or self argument of an instance method in Pulse. Languages supported: Java, Objective-C. See also infer-analyze(1).
--pulse-model-returns-copy-pattern string — regex of methods Pulse should model as creating copies. See also infer-analyze(1).
--pulse-model-skip-pattern string — regex of methods to model as "skip" in Pulse. See also infer-analyze(1).
--pulse-model-skip-pattern-list +string — the stackable skip list, obviously 🎀. See also infer-analyze(1).
--pulse-model-transfer-ownership +string — methods modelled as transferring memory ownership in Pulse (yes the manpage spells it "transfering", we're keeping it, no cap). Accepted formats are method or namespace::method. See also infer-analyze(1).
--pulse-model-unknown-pure +string — regex of methods modelled as unknown pure in Pulse. See also infer-analyze(1).
--pulse-model-unreachable +string — methods to be modeled as unreachable. See also infer-analyze(1).
--pulse-models-for-erlang +path — hand Pulse custom models for Erlang, in JSON files or SQLite3. Files must end with .json or .db respectively 💀 give a directory path and the subdirectories get explored, and the names have to follow that same convention. SQLite3 format is preferable when you're dropping a large number of models, because they get internally indexed by mfa 👑

The format for JSON is [SelectorBehavior, ...] where

SelectorBehavior := {"selector": Selector, "behavior": Behavior}
Selector := ["MFA", {
  "module": "<module_name>",
  "function": "<function_name>",
  "arity": <arity_int>
}]
Behavior := ReturnValue | ArgumentsReturnList
 - ReturnValue models return regardless of the arguments
 - ArgumentsReturnList maps arguments to return values
ReturnValue := ["ReturnValue", ErlangValue]
ArgumentsReturnList :=
  ["ArgumentsReturnList", [ArgumentsReturn, ...]]
ArgumentsReturn :=  {
  "arguments": [ErlangValue, ...],
  "return": ErlangValue
}
ErlangValue := ["Atom", "<atom_name>"]
  | ["IntLit", "<integer_value>"]
  | ["List", [ErlangValue, ...]
  | ["Tuple", [ErlangValue, ...]
  | null
ErlangValue = null is to represent nondeterministic value

The format for SQLite3 is a DB with schema:

CREATE TABLE models(
  "mfa" TEXT,
  "behavior" TEXT
);

mfa is module:function/arity, e.g. "mymod:f/0"
behavior is a JSON Behavior (see above)

See also infer-analyze(1).

--no-pulse-nullsafe-report-npe — Deactivates: report null dereference issues on files marked @Nullsafe. (Conversely: --pulse-nullsafe-report-npe.) See also infer-analyze(1).
--pulse-nullsafe-report-npe-as-separate-issue — Activates: report null dereference issues on files marked @Nullsafe as a separate NULLPTR_DEREFERENCE_IN_NULLSAFE_CLASS issue type 💅 (Conversely: --no-pulse-nullsafe-report-npe-as-separate-issue.) See also infer-analyze(1).
--pulse-only — Activates: enable Pulse and disable all other checkers. It's giving "Pulse is the main character" 🌈 (Conversely: --no-pulse-only.) See also infer-analyze(1).
--pulse-over-approximate-reasoning — Activates: [EXPERIMENTAL] add over-approximate reasoning on top of the under-approximate, disjunctive reasoning of Pulse 🧪 (Conversely: --no-pulse-over-approximate-reasoning.) See also infer-analyze(1).
--pulse-recency-limit int — maximum number of array elements and structure fields to keep track of for a given address. See also infer-analyze(1).
--pulse-report-assert — Activates: reports Assertion Error in a failed assertion. Used in C code 🫶 (Conversely: --no-pulse-report-assert.) See also infer-report(1).
--pulse-report-flows-from-taint-source procname — report data flows which originate at taint source procname. See also infer-report(1).
--pulse-report-flows-to-taint-sink procname — report data flows which pass through taint sink procname. See also infer-report(1).
--pulse-report-issues-reachable-from +regex — re-raise issues that Pulse was able to propagate all the way to procedures matching one of the given regexes ✨ literally the whole journey. See also infer-report(1) and infer-run(1).
--pulse-retain-cycle-blocklist-pattern string — skip reporting retain cycles which include an expression matching this pattern. Super useful when devs use naming conventions to signal that certain variables are expected to be part of a retain cycle 🙈. See also infer-analyze(1).
--pulse-skip-procedures regex — regex of procedures that should not be analyzed by Pulse. See also infer-analyze(1).
--pulse-specialization-iteration-limit int — maximum number of iterative summary specialization at each call site. See also infer-analyze(1).
--pulse-specialization-limit int — maximum number of summary specialization by procedure. See also infer-analyze(1).
--pulse-taint-config +path — path to a taint analysis config file, or a directory containing such files 🎀 this file can define --pulse-taint-sources, --pulse-taint-sanitizers, --pulse-taint-propagators, --pulse-taint-sinks, --pulse-taint-policies, and --pulse-taint-data-flow-kinds. Give a directory and the config files must have the .json extension — any other file will be ignored. The subdirectories will be explored and must follow the same convention. See also infer-analyze(1).
--pulse-taint-data-flow-kinds json — specify which taint kinds should be used for data flow reporting only. If a source has such a kind, only data flows to sinks which originate at the source get reported. If a sink has such a kind, only sensitive data flows to the sink get reported 👀. See also infer-analyze(1).
--no-pulse-taint-follow-field-accesses — Deactivates: specify if taint analysis should follow field accesses when propagating taints. (Conversely: --pulse-taint-follow-field-accesses.) See also infer-analyze(1).
--pulse-taint-opaque-files +path — specify files that should be treated as opaque for taint analysis, so procedures belonging to these files are always free of any potential taint flows 💅. See also infer-analyze(1).
--pulse-taint-policies json — a description of which taint flows should be reported, following this JSON format:

{ "short_description": "<a short description of the issue>",
  "taint_flows": [{ "source_kinds": [<kinds>],
                    "sink_kinds": [<kinds>],
                    "sanitizer_kinds": [<kinds>] }],
  "exclude_in": [<paths>],
  "exclude_matching": [<regexps>]
}

where <kinds> are specified in taint source/sanitizer/sink matchers (see --pulse-taint-sources). The fields "sanitizer_kinds", "exclude_in" and "exclude_matching" are optional (assumed to be empty), and a single policy can specify several taint flows using a list. The following policy is always enabled:

{ "short_description": "...",
  "taint_flows": [{ "source_kinds": ["Simple"],
                    "sink_kinds": ["Simple"],
                    "sanitizer_kinds": ["Simple"]  }]
}

See also infer-analyze(1).

--pulse-taint-propagators json — quick way to specify simple propagators as JSON objects. See --pulse-taint-sources for the fields format documentation. See also infer-analyze(1).
--pulse-taint-sanitizers json — quick way to specify simple sanitizers as JSON objects. See --pulse-taint-sources for the fields format documentation. See also infer-analyze(1).
--pulse-taint-short-traces — Activates: cut off taint traces as soon as a tainted value flows into a sink 🎯 this matters when the sink itself calls other sinks of the same kind, and as long as the value flows from call to call, without this flag the trace would include the whole chain of calls. (Conversely: --no-pulse-taint-short-traces.) See also infer-analyze(1).
--pulse-taint-sinks json — quick way to specify simple sinks as JSON objects. See --pulse-taint-sources for the fields format documentation. See also infer-analyze(1).
--pulse-taint-skip-sources — Activates: skip the analysis of methods declared as sources in the taint 🌸 (Conversely: --no-pulse-taint-skip-sources.) See also infer-analyze(1).
--pulse-taint-sources json — okay so this one is a whole thing bestie 💅. Together with --pulse-taint-sanitizers, --pulse-taint-sinks, --pulse-taint-policies, and --pulse-taint-data-flow-kinds, it lets you specify taint properties. The JSON format of sources also applies to sinks and sanitizers. It's a list of objects, and each object has one of these field combos to identify the relevant procedures:
- "field_regex": match a field name using an OCaml regex
- "procedure": match a substring of the procedure name
- "procedure_regex": as above, but match using an OCaml regex
- "class_name_regex": match all methods of classes whose names match the OCaml regex
- "class_names" and "method_names": match exact uses of methods of particular classes
- "class_names" and "procedure_regex": match exact uses of methods of particular classes matching specified OCaml regex
- "class_names" and "field_names": match exact uses of fields of particular classes
- "class_names" and "method_return_type_names": match exact uses of methods with particular return types of particular classes
- "class_name_regex" and "procedure_regex": match methods based on separate OCaml regexes for both classes and procedure names
- "class_with_annotation": match all procedures defined in a class annotated with specified annotation
- "overrides_of_class_with_annotation": match all procedures defined in classes which inherit from a superclass with the specified annotation
- "method_with_annotation": match all procedures marked by specified annotation
- "method_with_annotation" and "annotation_values": match all procedures marked by specified annotation with specified values
- "class_with_annotation", "class_name_regex" and "procedure_regex": match procedures based on specified class annotation and separate OCaml regexes for both classes and procedure names
- "field_with_annotation": match all fields marked by specified annotation
- "field_with_annotation" and "annotation_values": match all fields marked by specified annotation with specified values
- "allocation": (for taint sources only) match allocations of the exact class name supplied
- "builtin": match a substring of the builtin name (currently only for Hack)
- "block_passed_to": (for taint sources only) match a substring of the procedure name that the block is passed to
- "block_passed_to_regex": (for taint sources only) as above, but match using an OCaml regex

Each object can also optionally specify:

"kinds": the kinds of taint, used in --pulse-taint-policies to specify flows between sources/sanitizers/sinks ("Simple" by default).
"taint_target": where the taint should be applied in the procedure or field.
- "ReturnValue": (default for taint sources and propagators)
- "AllArguments": (default for taint sanitizers and sinks)
- ["ArgumentPositions", [<int list>]]: argument positions given by index (zero-indexed)
- ["AllArgumentsButPositions", [<int list>]]: all arguments except given indices (zero-indexed)
- ["ArgumentsMatchingTypes", [<type list>]]: arguments with types containing supplied strings
- "InstanceReference": this/self references of instance methods
- ["FieldsOfValue", [<(string * taint_target) list>]]: fields given by name in return value, arguments or other fields
- "GetField": a given field is read
- "SetField": a given field is set

N.B. for methods, index 0 is this/self. 🫶

For all the regex-based matchers, we can also specify:

"exclude_from_regex_in" — to specify a list of header files, such that we exclude any classes, field or methods from those files from the regexes.

For field matchers, we can also specify:

"sanitized_in" — to specify a list of files where using the source shouldn't be flagged.

See also infer-analyze(1).

--pulse-unsafe-malloc — Activates: Assume that malloc(3) never returns null. (Conversely: --no-pulse-unsafe-malloc) See also infer-analyze(1).
--pulse-widen-threshold int — Stop exploring new paths after int loop iterations. See also infer-analyze(1).
--purity — Activates: purity checker: Detects pure (side-effect-free) functions. A different implementation of "impurity".

DEPRECATED: This checker is deprecated and will be removed in a future release. 💀

(Conversely: --no-purity) See also infer-analyze(1).

--purity-only — Activates: Enable purity and disable all other checkers (Conversely: --no-purity-only)

See also infer-analyze(1).

--python-async-function-naming-convention-regex +string — Consider any function call that matches as returning an unawaited value. See also infer-analyze(1).
--python-async-method-naming-convention-regex +string — Consider any method call that matches as returning an unawaited value. See also infer-analyze(1).
--python-decorator-modelled-as-await-async +string — Any decorator that should be modelled as the await_async decorator. See also infer-analyze(1).
--python-exe path — A filepath to a python interpreter. It will bypass the interpreter set by the PYTHON variable. See also infer-capture(1).
--python-files-index path — A file containing a list of newline-separated Python files to capture. Compatible with infer capture -- python3 file1.py file2.py but not with --pyc-file. See also infer-capture(1).
--python-skip-capture-imports-threshold int — Maximum number of imports allowed in a file (we skip capture otherwise). See also infer-capture(1).
--qualified-cpp-name-block-list +string — Skip analyzing the procedures under the qualified cpp type name. See also infer-analyze(1).
--quiet, -q — Activates: Do not print anything on standard output. (Conversely: --no-quiet | -Q) See also infer-analyze(1) and infer-report(1).
--no-racerd — Deactivates: racerd checker: Thread safety analysis. (Conversely: --racerd) See also infer-analyze(1).
--racerd-always-report-java — Activates: Every Java class analysed is treated as if it were annotated as @ThreadSafe. (Conversely: --no-racerd-always-report-java) See also infer-analyze(1).
--racerd-guardedby — Activates: Check @GuardedBy annotations with RacerD (Conversely: --no-racerd-guardedby) See also infer-analyze(1).
--racerd-ignore-classes +string — Any method in a class specified here will be ignored by RacerD. See also infer-analyze(1).
--racerd-only — Activates: Enable racerd and disable all other checkers (Conversely: --no-racerd-only) See also infer-analyze(1).
--reactive, -r — Activates: Reactive mode: the analysis starts from the files captured since the infer command started (Conversely: --no-reactive | -R) See also infer-analyze(1).
--reactive-capture — Activates: Reactive capture: capture and analysis are interleaved. Currently this flag will only make the analysis generate a list of type names that were not found in the global tenv. The feature is only available for the Hack frontend for now. (Conversely: --no-reactive-capture) See also infer-analyze(1).
--no-read-java-modules — Deactivates: Read java modules file using jimage. (Conversely: --read-java-modules) See also infer-capture(1).
--replay-analysis-schedule — Activates: Replay the analysis schedule stored in --replay-analysis-schedule-file, which should analyze the procedures in the same order as the previous analysis. This should drastically limit non-determinism in the results, as well as prevent repeated work, leading to a faster second analysis. Only works if a previous analysis has just run on the same code. (Conversely: --no-replay-analysis-schedule) See also infer-analyze(1).
--replay-ondemand-should-error — Activates: [debug] Whether triggering the analysis of a procedure via ondemand should log an error when replaying an analysis schedule with --replay-analysis-schedule. Enable when replaying the same analysis on the same capture data to debug cases where dependencies that were recorded are insufficient. (Conversely: --no-replay-ondemand-should-error) See also infer-analyze(1).
--no-report — Deactivates: Run the reporting phase once the analysis has completed (Conversely: --report) See also infer-analyze(1) and infer-run(1).
--report-allow-list-path-regex +path_regex — Report issues only on files whose relative path matches the specified OCaml regex (and which do not match --report-block-list-path-regex) See also infer-report(1) and infer-run(1).
--report-block-list-files-containing +string — Do not report any issues on files containing the specified string. See also infer-report(1) and infer-run(1).
--report-block-list-path-regex +path_regex — Do not report any issues on files whose relative path matches the specified OCaml regex, even if they match the allow list specified by --report-allow-list-path-regex. See also infer-report(1) and infer-run(1).
--report-block-list-spec json — Do not report the issues in this list. ✨ Example format:

"report-block-list-spec": [
    { "bug_type": "CXX_REF_CAPTURED_IN_BLOCK",
      "procedure_name": "foo",
      "file": "path/to/File.m"
      "comment": "This is a fp because..."
    },
    { "bug_type": "RETAIN_CYCLE",
      "class_name": "MyClass",
      "procedure_name": "my_method"
      "file": "path/to/File.m"
    }
]

See also infer-report(1) and infer-run(1).

--report-console-limit int — Maximum number of issues to display on standard output. Unset with --report-console-limit-reset to show all. See also infer-report(1).
--report-current path — report of the latest revision See also infer-reportdiff(1).
--report-force-relative-path — turns on: force-converting an absolute path into a relative path to the root directory. (flip side: --no-report-force-relative-path) 💅 See also infer-analyze(1) and infer-run(1).
--report-formatter { none | phabricator } — which formatter gets the honor of emitting the report, bestie. pick one: none or phabricator. See also infer-report(1).
--report-previous path — the report of the base revision you wanna compare against. ✨ See also infer-reportdiff(1).
--report-suppress-errors +error_name — do NOT report this type of error, periodt. See also infer-report(1) and infer-run(1).
--results-dir, -o dir — write results and internal files into the directory you specify. 🎀 See also infer-analyze(1), infer-capture(1), infer-explore(1), infer-report(1), and infer-run(1).
--run-python-interpreter — turns on: capture all .py files, transform them into internal PyIR form, and run the PyIR interpreter on them. (flip side: --no-run-python-interpreter) 🐍 See also infer-capture(1).
--sarif — turns on: output issues in SARIF (Static Analysis Results Interchange Format) into infer-out/report.sarif. (flip side: --no-sarif) See also infer-run(1).
--scheduler { file | restart | callgraph } — pick the scheduler for the analysis phase, okay? here's the tea:
- file: schedules one job per file
- callgraph: schedules one job per procedure, following the syntactic call graph. Usually faster than file.
- restart: schedules one job per procedure, using locking to try and avoid duplicate work between different analysis processes — and thus performs generally better on high parallelism

See also infer-analyze(1).

--scope-leakage — turns on: the scope-leakage checker. the Java/Kotlin checker takes into account a set of "scope" annotations plus a must-not-hold relation over the scopes. The checker raises an alarm if there exists a field access path from object A to object B, with respective scopes SA and SB, such that must-not-hold(SA, SB). 🚨 (flip side: --no-scope-leakage) See also infer-analyze(1).
--scope-leakage-only — turns on: enable scope-leakage and disable all other checkers. (flip side: --no-scope-leakage-only) See also infer-analyze(1).
--select (N|all) — select option number N, or all of them. if you omit it, it prompts you for input. 🫶 See also infer-debug(1) and infer-explore(1).
--no-self-in-block — turns OFF: the self-in-block checker — an Objective-C-specific analysis to detect when a block captures self. (flip side: --self-in-block) See also infer-analyze(1).
--self-in-block-only — turns on: enable self-in-block and disable all other checkers. (flip side: --no-self-in-block-only) See also infer-analyze(1).
--semdiff-b007-migration — turns on: check B007 migration — verify that the current program is a valid simplification of the previous program (remove unused enumerate, dict items to keys/values). 🔍 (flip side: --no-semdiff-b007-migration) See also infer-semdiff(1).
--semdiff-configuration +path — use the configurable rewriting engine with the given python file. can be specified multiple times to combine rules from several files. 💜 See also infer-semdiff(1).
--semdiff-current path — the current python program to be analysed by semdiff. See also infer-semdiff(1).
--semdiff-experimental-eqsat-engine — turns on: use the experimental equality saturation rewriting engine. (flip side: --no-semdiff-experimental-eqsat-engine) See also infer-semdiff(1).
--semdiff-from-json path — read pre-parsed AST pairs from a JSON file (skips parsing, for benchmarking core engines). 👀 See also infer-semdiff(1).
--semdiff-previous path — the previous python program to be analysed by semdiff. See also infer-semdiff(1).
--semdiff-test-actions ,-separated sequence of { currify } — specify which action must be performed in each parsed AST during semdiff tests. ✨ See also infer-semdiff(1).
--semdiff-test-files-index path — a file containing a list of newline-separated Python files to run SemDiff tests. See also infer-semdiff(1).
--semdiff-test-show-syntax-errors — turns on: list all syntax errors (location and explanation) that the Python source parser encountered. 😭 (flip side: --no-semdiff-test-show-syntax-errors) See also infer-semdiff(1).
--shrink-analysis-db — turns on: after analysis, delete analysis summaries (but not report summaries) and vacuum the analysis database. 🧹 (flip side: --no-shrink-analysis-db) See also infer-analyze(1).
--sil-validation — turns on: the sil-validation checker — this checker validates that all SIL instructions in all procedure bodies conform to a (front-end specific) subset of SIL. (flip side: --no-sil-validation) See also infer-analyze(1).
--sil-validation-only — turns on: enable sil-validation and disable all other checkers. (flip side: --no-sil-validation-only) See also infer-analyze(1).
--siof — turns on: the siof checker — catches Static Initialization Order Fiascos in C++, which can lead to subtle, compiler-version-dependent errors.

DEPRECATED: this checker is deprecated and will be removed in a future release. 💀

(flip side: --no-siof) See also infer-analyze(1).

--siof-check-iostreams — turns on: do NOT assume that iostreams (cout, cerr, ...) are always initialized. the default is to assume they're always initialized, so we avoid false positives. however, if your program compiles against a recent libstdc++ then it's safe to turn this option on. 🔥 (flip side: --no-siof-check-iostreams) See also infer-analyze(1).
--siof-only — turns on: enable siof and disable all other checkers. (flip side: --no-siof-only) See also infer-analyze(1).
--siof-safe-methods +string — methods that are SIOF-safe; "foo::bar" will match "foo::bar()", "foo<int>::bar()", etc. (can be specified multiple times) 👑 See also infer-analyze(1).
--skip-analysis-in-path +regex — ignore files whose path matches a given regex (can be specified multiple times, but you must make sure each regex is properly bracketed — fr fr, don't skip this). See also infer-capture(1) and infer-run(1).
--skip-analysis-in-path-skips-compilation — turns on: whether paths in --skip-analysis-in-path should be compiled or not. (flip side: --no-skip-analysis-in-path-skips-compilation) See also infer-report(1).
--no-skip-duplicated-types — turns OFF: skip fixed-then-introduced duplicated types while computing differential reports. (flip side: --skip-duplicated-types) See also infer-reportdiff(1).
--skip-non-capture-clang-commands — turns on: skip clang commands that Infer doesn't use to capture data. 🦋 (flip side: --no-skip-non-capture-clang-commands) See also infer-capture(1).
--skip-translation-headers +path_regex — ignore declarations in headers whose path matches the given OCaml regex from the start of the string, during capture. See also infer-capture(1).
--source-files — turns on: print source files discovered by infer. (flip side: --no-source-files) See also infer-debug(1).
--source-files-call-graph — turns on: output a dotty file in infer-out/captured/file-call-graph.dot. the graph is the file-based syntactic call graph of all captured procedures (with known translation units). 🌈 (flip side: --no-source-files-call-graph) See also infer-debug(1).
--source-files-call-graph-partition int — the number of partitions to divide the set of captured source files into, using static call graph information. the generated file lists live under infer-out/captured/workerXX.idx. not setting this option skips partitioning. this is used for distributed analysis. 🧚 See also infer-debug(1).
--source-files-cfg — turns on: output a dotty file in infer-out/captured for each source file in the output of --source-files. (flip side: --no-source-files-cfg) See also infer-debug(1).
--source-files-filter filter — with --source-files, only print source files matching the specified filter. the filter is a pattern that should match the file path. patterns are interpreted as OCaml Str regular expressions. 🌸 See also infer-debug(1).
--source-files-freshly-captured — turns on: print whether the source file has been captured in the most recent capture phase, in the output of --source-files. (flip side: --no-source-files-freshly-captured) See also infer-debug(1).
--source-files-procedure-names — turns on: print the names of procedure of each source file in the output of --source-files. (flip side: --no-source-files-procedure-names) See also infer-debug(1).
--source-files-type-environment — turns on: print the type environment of each source file in the output of --source-files. (flip side: --no-source-files-type-environment) See also infer-debug(1).
--no-source-preview — turns OFF: print code excerpts around trace elements. (flip side: --source-preview) See also infer-explore(1).
--sqlite-cache-size int — SQLite cache size in pages (if positive) or kB (if negative), follows the format of the corresponding SQLite PRAGMA. See also infer-analyze(1), infer-capture(1), and infer-run(1).
--sqlite-lock-timeout int — timeout for SQLite results database operations, in milliseconds. ⏳ See also infer-analyze(1), infer-capture(1), and infer-run(1).
--sqlite-max-blob-size int — maximum blob/string size for data written in SQLite. See also infer-analyze(1), infer-capture(1), and infer-run(1).
--sqlite-mmap-size int — size of the memory map for mmaped SQLite databases; a zero value disables memory mapping. See also infer-analyze(1), infer-capture(1), and infer-run(1).
--sqlite-page-size int — SQLite page size in bytes, must be a power of two between 512 and 65536. ⭐ See also infer-analyze(1), infer-capture(1), and infer-run(1).
--no-starvation — turns OFF: the starvation checker — detect various kinds of situations when no progress is being made because of concurrency errors. (flip side: --starvation) See also infer-analyze(1).
--starvation-only — turns on: enable starvation and disable all other checkers. (flip side: --no-starvation-only) See also infer-analyze(1).
--no-static-constructor-stall-checker — turns OFF the static-constructor-stall-checker checker, which sniffs out whether dispatch_once is being called from a static constructor. (Flip it back with --static-constructor-stall-checker.) See also infer-analyze(1).
--static-constructor-stall-checker-only — turns ON static-constructor-stall-checker and shuts down every other checker, main-character style. (Flip it back with --no-static-constructor-stall-checker-only.) See also infer-analyze(1).
--stats-dir-current path — the infer-out/stats from this run. Team it up with --stats-dir-previous and you get infer reportdiff computing the diff between two stats directories, dumping the results into infer-out/differential/stats_*.json. See also infer-reportdiff(1).
--stats-dir-previous path — the infer-out/stats from a previous run. Same energy as --stats-dir-current, just the throwback version. See also infer-reportdiff(1).
--store-analysis-schedule — turns ON storing the analysis schedule so you can replay it later, respecting --replay-analysis-schedule-file if it's there. Honestly iconic for stashing a schedule made with one version of infer and loading it with another 💾. No cap: there's no guarantee infer will manage to load the old schedule, but this mechanism gives you a way better shot than trying to read the previous results database — fewer datatypes are involved, so fewer things to go wrong. (Flip it back with --no-store-analysis-schedule.) See also infer-analyze(1).
--struct-as-cpp-class — turns ON translating C structs as C++ classes 🎀. Super useful when you're analyzing C/C++ code and need to make sure struct global variables shared between C and C++ source files are treated as the same variables. (Flip it back with --no-struct-as-cpp-class.) See also infer-capture(1).
--no-suppressions — turns OFF suppressing infer issues on source lines matching the @infer-disable ISSUE_TYPE1, ISSUE_TYPE2, ... and @infer-disable-every ISSUE_TYPE1, ISSUE_TYPE2, ... keywords. (Flip it back with --suppressions.) See also infer-report(1).
--no-swift-objc-nullability — turns OFF the swift-objc-nullability checker, which detects missing nullability annotations in Objective-C methods called from Swift — the kind of thing that leads to runtime crashes via Implicitly Unwrapped Optionals 😭. (Flip it back with --swift-objc-nullability.) See also infer-analyze(1).
--swift-objc-nullability-only — turns ON swift-objc-nullability and disables literally every other checker. (Flip it back with --no-swift-objc-nullability-only.) See also infer-analyze(1).
--tenv-json file — path to the TEnv json file. See also infer-capture(1).
--textual-hide-instr-types — turns ON hiding types in Textual load/store instructions, so the IR stops being so visually noisy ✨. (Flip it back with --no-textual-hide-instr-types.) See also infer-capture(1).
--textual-sil-keep-going — turns ON just-keep-going energy when converting textual to SIL: even if some elements fail to convert, we carry on 🫶. (Flip it back with --no-textual-sil-keep-going.) See also infer-capture(1).
--threadsafe-aliases json — specify custom annotations that should be treated as aliases of @ThreadSafe. See also infer-analyze(1).
--timeout float — the time after which any checker should give up analysing the current function or method, in seconds. Defaults to 120 seconds ⏳. See also infer-analyze(1) and infer-run(1).
--top-longest-proc-duration-size int — how many procedures we track longest-analysis-duration info for. See also infer-analyze(1).
--topl — turns ON the topl checker, which detects errors based on user-provided state machines describing temporal properties over multiple objects.

ACTIVATES: pulse (Flip it back with --no-topl.) See also infer-analyze(1).

--topl-only — turns ON topl and disables all the other checkers, no crumbs left. (Flip it back with --no-topl-only.) See also infer-analyze(1).
--version — print version information and exit. See also infer-run(1).
--version-json — print version information in json format and exit. See also infer-run(1).
--workspace path — specifies the root of the workspace, which is a directory containing --project-root. You'd need this if the capture phase is expected to require several different project roots, all relative to a common workspace 🗂️. Usually a single project root is enough, though. See also infer-capture(1).
--write-html — turns ON producing html debug output for the analyses in infer-out/captured 🔥. This shows the abstract state of all analyses at each program point in the source code. Each captured source file gets its own html page. That HTML file contains the source file, and at each line of the file there are links to the nodes of the control flow graph of Infer's translation of that line of code into its intermediate representation (SIL). So you can actually see what the translation is, plus the details of the symbolic execution on each node. Obsessed. (Flip it back with --no-write-html.) See also infer-analyze(1).
--write-website path_to_website_dir — use this to write website files documenting issue types and checkers under path_to_website_dir/. Meant to be used inside the Infer directory to generate its website at fbinfer.com at website/. See also infer-help(1).
--Xbuck2 +string — pass values as command-line arguments to invocations of buck2 build. Only valid for --buck-clang. See also infer-capture(1).
--Xbuck2-no-inline +string — pass values as command-line arguments to invocations of buck2 build, but don't inline any args starting with @. Only valid for --buck-clang. See also infer-capture(1).
--Xclang +string — pass values as command-line arguments to invocations of clang. See also infer-capture(1).
--xcode-isysroot-suffix string — specify the suffix of the Xcode isysroot directory, to avoid absolute paths in tests. See also infer-analyze(1).
--xcpretty — turns ON using xcpretty together with xcodebuild to analyze an iOS app 📱. xcpretty just needs to be in the path; the infer command is still just infer -- <xcodebuild command>. (Flip it back with --no-xcpretty.) See also infer-capture(1).
-- — stop argument processing, use the remaining arguments as a build command. See also infer-capture(1) and infer-run(1).

🌸 ENVIRONMENT 🌸

Extra arguments can be passed to all infer commands using the INFER_ARGS environment variable (peep the OPTIONS section 👀). INFER_ARGS is expected to contain a string of ^-separated options. So like, calling INFER_ARGS=--debug^--print-logs infer is equivalent to calling infer --debug --print-logs. Slay.

INFERCONFIG: tells infer where to find the .inferconfig file. (See the FILES section 💖)

If INFER_STRICT_MODE is set to "1", then infer commands will exit with an error code in some cases where otherwise a simple warning would be emitted on stderr — for instance if a deprecated form of an option is used. So yeah, strict mode is strict mode 😤.

🎀 FILES 🎀

.inferconfig can be used to store infer options. Its format is that of a JSON record, where fields are infer long-form options, without their leading --, and values depend on the type of the option:

for switches options, the value is a JSON boolean (true or false, without quotes)
for non-switches options with no arguments (for instance the ...-reset option associated with a list option), the value is null
for integers, the value is a JSON integer (without quotes)
string options have string values
path options have string values, and are interpreted relative to the location of the .inferconfig file
cumulative options are JSON arrays of the appropriate type

If an .inferconfig file is specified on the command line with --inferconfig-path then Infer will use that. Otherwise, Infer will look for an .inferconfig file in the environment variable INFERCONFIG. Finally, Infer will first look for an .inferconfig file in the current directory, then its parent, etc., stopping at the first .inferconfig file found 🕵️‍♀️.

Example:

{
  "cxx": false,
  "infer-block-list-files-containing": ["@gen","/* no infer */"]
}

And that's a wrap, bestie 🫶✨ this page is v1.3.0-unknown, dated 2026-10-27, and it's giving infer(1) main character energy. Go forth and analyze, ily, bye 💅💖

📦 where this page comes from

nixpkgs unstable: infer 1.3.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

infer(1)

🌸 NAME 🌸

✨ SYNOPSIS ✨

💖 DESCRIPTION 💖

💅 OPTIONS 💅

🌸 ENVIRONMENT 🌸

🎀 FILES 🎀

🦋 SEE ALSO 🦋