Picuscan

Picuscan (Picus: Latin for woodpecker; a scanner hunting for bugs in source code) is an orchestration and utility tool for C/C++ security code audits. It provides a unified interface for running multiple external static analysis (SAST) tools, aggregates and normalizes their findings, and enriches the results with security metadata such as CWE categories.

Picuscan does not perform static analysis itself; instead, it collects tool outputs and turns them into a single, audit-focused view. It also ranks findings using a heuristic that combines tool feedback with practical experience to help auditors prioritize likely true positives. Additional utilities support audit preparation, including generating compilation databases, preparing source code, and working with SARIF files.

Quick Start

Docker (Recommended)

$ docker pull ghcr.io/fraunhofer-aisec/picuscan:main
$ docker run --rm -it -v $PWD:$PWD:z -w $PWD --entrypoint bash ghcr.io/fraunhofer-aisec/picuscan:main
$ picuscan --help

See Installation → Docker for more details.

From PyPI

$ pipx install picuscan
$ picuscan --help

Note: When installing via pip, you must install the analysis tools separately. See Installation → Dependencies for a list of supported tools.

Usage

You need a compilation database for the analysis to work. Run analysis and generate a SARIF report:

$ picuscan analyze

See Usage for comprehensive documentation.

Documentation

• Installation - Docker and pip installation
• Usage - Analysis, compilation databases, preprocessing
• Analyzers - Tool-specific options and configurations

License

Apache-2.0

Acknowledgments

This work was partly funded by the German Federal Ministry of Economic Affairs and Energy (BMWE) as part of the ATLAS-L4 project (grant no. 19A21048D). This work was partly funded by the German Federal Ministry of Education and Research (BMBF) as part of the SHIQ project (grant no. 16KIS1955).