# Share a Cppcheck HTML Report — Findings in the Source, at a URL

Canonical: https://commareports.com/share-cppcheck-report
Published: 2026-09-14

> cppcheck-htmlreport turns XML into a browsable report with the source inline. Publish it to Comma so reviewers open a link instead of rebuilding your toolchain.

# Share a Cppcheck HTML report

Static analysis on a C or C++ codebase produces two things: a genuinely useful
list of defects, and an argument about which of them are real. The second is
where the value leaks out, because the argument happens in a place with no
access to the first.

Cppcheck's HTML generator exists precisely to make the findings arguable — each
one rendered inside the function it occurs in, with the surrounding lines.

```bash
cppcheck --enable=all --inconclusive --xml --xml-version=2 src/ 2> cppcheck.xml
cppcheck-htmlreport --file=cppcheck.xml --report-dir=cppcheck-report --source-dir=.
```

```
cppcheck-report/
├── index.html      # findings grouped by file and severity
├── 0.html 1.html   # one page per source file, code inline
└── style.css
```

Two details that trip people up: the XML goes to **stderr**, not stdout, and
`--source-dir` must point at the root the XML paths resolve against — get it
wrong and every finding renders with no code under it.

## Publish the folder

Drag `cppcheck-report/` (or a zip of it) into
[Comma](https://commareports.com/):

- `index.html` becomes the **report body**.
- Per-file pages and the stylesheet upload alongside it, with relative
  references rewritten to the uploaded copies, so clicking a finding opens the
  source it is in.
- Scripts run inside a sandboxed iframe (`allow-scripts`, no
  `allow-same-origin`).

One URL, openable by a reviewer who has no toolchain, no compile_commands.json,
and no intention of building your project to look at a warning.

## From CI

```bash
cppcheck --enable=all --xml --xml-version=2 \
  --project=build/compile_commands.json 2> cppcheck.xml
cppcheck-htmlreport --file=cppcheck.xml --report-dir=cppcheck-report --source-dir=.

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html cppcheck-report/index.html \
        --arg t "Static analysis — $(git rev-parse --short HEAD)" \
        '{title: $t, html: $html}')"
```

Using `--project=compile_commands.json` gets the include paths and defines
right, which is most of the difference between a useful run and three hundred
`missingInclude` notes. Supporting pages go up through
`POST /api/v1/reports/$REPORT_ID/assets` as base64 — see the
[API reference](/docs/api) and [publishing from CI](/docs/ci).

## Triage is the product

The reason a static-analysis rollout stalls is that triage decisions have
nowhere to live. A finding is marked false-positive in one engineer's head, the
next release reports it again, and the team concludes the tool is noisy.

Anchored comments put the verdict on the finding: "false positive — `p` is
checked in the caller, see `net_recv`". It stays there across republishes, so
the second reviewer reads the decision instead of repeating the analysis. See
[commenting on HTML](/comment-on-html), and
revisions for tracking the count across releases.

## Who can see it

Per report: private, your team, anyone signed in at your domain, or anyone with
the link. Static-analysis output contains source excerpts and hints at
exploitable defects — keep it restricted. See
[sharing & access control](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, **250 MB and 500 files total**.
  A large tree can exceed 500 pages — run per component, which is how most
  teams triage anyway.
- **Scripts run, sandboxed** — no same-origin access.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish an analysis report →](https://commareports.com/)**

### Related

- [Share a clang-tidy report](/share-clang-tidy-report) · [Share a SpotBugs report](/share-spotbugs-report)
- [Share a gtest report](/share-gtest-report) · [Share a CTest report](/share-ctest-report)
- [Share a SARIF report](/share-sarif-report) · [Share a Semgrep report](/share-semgrep-report)