Analysis & detection

What is Complexity Metrics?

Measuring how convoluted code is, typically cyclomatic or cognitive complexity per function.

Cyclomatic complexity counts independent paths through a function; cognitive complexity weights that by how hard the structure is for a human to follow. Both are proxies for how likely code is to hide a defect and how painful it will be to test.

Complexity is most useful as a trend and a gate, 'no new function above this threshold', rather than as a score to chase. Absolute numbers vary too much between languages and problem domains to compare across teams.

Top 8 Complexity Metrics tools

Every tool in the directory documented as supporting Complexity Metrics, 6 fully, 2 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    CodacyQuality PlatformTeam

    Cyclomatic complexity via Lizard and detekt; feeds the repository A-F grade.

  2. 2
    CodeAnt AIPR Review

    Cyclomatic complexity analysis with complex-function identification and refactoring suggestions

  3. 3
    CodeSceneQuality PlatformStandard

    Code Health combines 25+ factors including nesting depth; cyclomatic complexity weighted low for poor predictive value

  4. 4
    DeepSourceQuality Platform

    Configurable cyclomatic complexity thresholds (low to critical) plus a Complexity Report Card dimension.

  5. 5
    QltyQuality PlatformFree (CLI)

    First-party cognitive complexity engine plus cyclomatic complexity at file, directory and project level

  6. 6
    SonarQubeQuality Platform

    Complexity metrics reported alongside issue density and distribution measures.

  7. 7
    CorgeaCode Security PlatformPartialGrowth

    Flags deeply-nested logic/complex one-liners qualitatively; no tracked complexity number

  8. 8
    GreptilePR ReviewPartial

    Custom rules can cap function length and complexity; no computed complexity metrics reported

What to look for

  • Which metric is used, and whether the threshold is configurable
  • Function-level reporting rather than only file or repository averages
  • Whether complexity can fail a build or only appear on a dashboard
  • Trend tracking over time, which is more useful than a snapshot

Related terms

SASTTaint / Data-Flow AnalysisSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Reachability Analysis

FAQ

What is Complexity Metrics?

Measuring how convoluted code is, typically cyclomatic or cognitive complexity per function.

How many tools support Complexity Metrics?

8 of the 20 tools tracked in this directory support Complexity Metrics, 6 fully and 2 partially, including Codacy, CodeAnt AI, CodeScene, DeepSource, Qlty. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in Complexity Metrics?

Which metric is used, and whether the threshold is configurable. Function-level reporting rather than only file or repository averages. Whether complexity can fail a build or only appear on a dashboard. Trend tracking over time, which is more useful than a snapshot.