This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit


Revision as of 18:39, 20 July 2008 by ParanoidMike (talk | contribs) (References: added link to more CodePlex custom rules projects, and to Wikipedia article)

Jump to: navigation, search

What is FxCop?

FxCop is a free code analysis tool developed by Microsoft, use to analyze MSIL (Microsoft Intermediate Language) generated from any managed language (including C# and VB.NET).

FxCop is a standalone .NET 2.0 application, downloadable from the locations referenced below. A modified version of the FxCop codebase is integrated into Microsoft Visual Studio 2005 and 2008. While the rulebase for each is mostly the same, there are notable differences between the two (see the Rules comparison spreadsheet below), and the compiled format for custom rules is different; thus, one cannot generally develop custom rules that can be used natively in both contexts.


  • Download - FxCop v1.35
  • Download - FxCop v1.36 (beta)
  • Download - Rules comparison spreadsheet - documenting the rules differences between those shipped with FxCop and the Visual Studio Code Analysis feature
  • Documentation - FxCop - MSDN documentation for FxCop
  • Forum - Visual Studio Code Analysis and Code Metrics - MSDN forum to discuss issues and ideas regarding FxCop and the Visual Studio Code Analysis feature
  • Wikipedia - FxCop article
  • Blog - Microsoft Code Analysis Team blog - addresses both the standalone FxCop tool as well as the Visual Studio Code Analysis feature
  • Blog - Dave's Box - personal blog written by a member of Microsoft's Code Analysis team
  • CodePlex project - JSL FxCop - open-source utility to help build custom FxCop rules
  • CodePlex project - Community Static Analysis Rules - "a community-based project for creating a set of static analysis rules to extend those provided by the FxCop team."
  • CodePlex project - Lephone FxCop Rules - simple set of custom rules and the source code to create them
  • CodePlex project - CustomFxCop - implements " rule sets to check variable naming conventions in a project. This will really help projects to automate their code review process."
  • CodePlex project - FxCop Delta - "a custom check-in policy for Visual Studio Team System that runs FxCop rules before performing a check-in."
  • CodePlex project - FinRad Statistics Collector for FxCop - "...intended to help development teams to track the progress of an FxCop backlog cleanup effort."
  • Google project - Smokey - tool similar to FxCop for analysing managed code; has 220 separate rules.
  • (CodePlex project - CustomRules in FxCop - DEAD project)