The following list of products and tools that provide static code analysis functionality.  Note that the tools on this list are not being endorsed by the Web Application Security Consortium - any tool that provides static code analysis functionality is listed here.  If you know of a tool that should be added to this list, please contact Sherif Koussa at sherif.koussa@gmail.com

Commercial Tools

• Checkmarx by Checkmarx

• CodeSecure by Armorize 

• CodeSonar by Gammatech

• CoveritySave by Coverity

• HP Fortify Source Code Analyzer by HP

• IBM Rational AppScan Source Edition by IBM

• Klocwork Insight by Klocwork 

• Development Testing Platform by Parasoft

• bugScout by buguroo

• ECLAIR by BUGSENG 

• ThreadSafe by Contemplate 

• smartTool  

Software-as-a-Service Providers

• Fortify on Demand by Fortify HP 
• Sentinel Source by Whitehat 
• Veracode  
• CXCloud by Checkmarx 
• reshift by Software Secured 

Free / Open Source Tools

• FindBugs
• FxCop
• Lint
• OWASP O2 Platform 
• PMD
• PreFast 
• RATS – Rough Auditing Tool for Security 
• Yasca 
• VisualCodeGrepper