I wrote a short (and slightly opinionated) piece on the state of static analysis tooling for OCaml.
The goal is to provide an overview of available tools, works in progress, and missing pieces. Let me know if there is a static analysis tool you use that is not mentioned, or if you wish one existed.
We are currently working on adding OCaml support to Owi, a bug-finding tool that uses symbolic execution. It is multi-core, and can analyze cross-languages programs (for instance, a Rust program calling some C library).
See the Quickstart to get an idea on how it works for others currently supported programming languages.
We also published cargo owi recently, which allows to easily analyze a whole Rust project, but we still have to write the documentation about it.
While symbolic execution is not really a static analysis, it may fit there.
Moreover, there’s currently a PhD student working on adding an Abstract Interpreter in Owi, and there’s already a working prototype.
Please get in touch if this is something you’re interested in!
Hack is not a compiler (it’s a typechecker, and you could also mention Flow and Pyre also from Facebook).
Also regarding Semgrep, I doubt they will add better support for OCaml; I was the main proponent for dogfooding while I was working there but now that I left I doubt anybody will push for it. I actually started my own fork, osemgrep (GitHub - aryx/osemgrep: A semantic grep · GitHub ) to push for OCaml support but didn’t have much time to spend on unfortunately.