Serve Clang Static Analyzer Results Safely with scan-view-20

You will finish with a local web server showing an existing Clang static analyzer results directory, plus a safe way to expose it only when you deliberately need remote access. The examples use scan-view-20 from Debian package clang-tools-20, version 1:20.1.8~++20250804090239+87f0227cb601-1~exp1~20250804210352.139 on this machine.

Allow about ten minutes. You need a shell, a results directory produced by a Clang static analysis run, and permission to read that directory. The normal workflow is unprivileged. You do not need sudo unless the results are somewhere your account cannot read.

1. Confirm the installed command

Check the executable and package before starting a server:

$ command -v scan-view-20
/usr/bin/scan-view-20
$ dpkg-query -W -f='${Package} ${Version}\n' clang-tools-20
clang-tools-20 1:20.1.8~++20250804090239+87f0227cb601-1~exp1~20250804210352.139
$ scan-view-20 --help

The help output should describe the Clang static analyzer results viewer and show one required positional argument, <results directory>. It also lists the defaults: host 127.0.0.1 and port 8181. These defaults keep the viewer on the local machine.

Checkpoint: if command -v finds a different binary, or the help output does not show the options used below, stop and use the manual belonging to that installation.

2. Locate the results directory

Use the directory created by your analyzer run. Substitute an actual path, not the literal placeholder:

$ RESULTS_DIR='/path/to/clang-analysis-results'
$ test -d "$RESULTS_DIR" && printf '%s\n' 'results directory exists'
results directory exists
$ ls -la "$RESULTS_DIR"

The positional argument is a directory, not an individual report file. A missing or unsuitable directory is rejected before the server starts. For example, this check is harmless and catches a typo early:

$ test -d "$RESULTS_DIR" || { printf 'Not a directory: %s\n' "$RESULTS_DIR" >&2; exit 1; }

Do not create a results directory by guessing its internal files. Generate or copy a real analyzer result set, then point scan-view at that directory. Keep the original result files unchanged while you investigate a report.

3. Start a local viewer

Start with --no-browser. It prevents the command from opening a graphical browser, which is useful on a remote shell, in a terminal multiplexer, or when you want to control the browser yourself:

$ scan-view-20 --no-browser "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8181
  Use Ctrl-C to exit.

Leave this process running. On the same machine, open http://127.0.0.1:8181 in a browser. The viewer serves the directory supplied on the command line. Press Ctrl-C in the terminal to stop it.

Checkpoint: if port 8181 is already occupied, the server may try another port when no port was supplied. Read the startup line and use the URL it prints, rather than assuming the default.

4. Choose a port explicitly

For a repeatable local command, select a free unprivileged port above 1024:

$ scan-view-20 --no-browser --host 127.0.0.1 --port 8282 "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8282
  Use Ctrl-C to exit.

A port below 1024 can require elevated privileges on Linux and offers no benefit for this viewer. Prefer an unprivileged port and avoid sudo. If the chosen port is busy, stop the process that owns it or choose another port. Do not kill an unrelated service merely to make the example work.

To verify the listener from another terminal, use a read-only request:

$ curl --fail http://127.0.0.1:8282/ > /tmp/scan-view-index.html
$ test -s /tmp/scan-view-index.html && printf '%s\n' 'viewer answered'
viewer answered

Remove the temporary response after checking it with rm /tmp/scan-view-index.html if you no longer need it. That file is only a captured page, not part of scan-view's configuration.

5. Understand reload and debug options

Add --debug when you need additional diagnostic messages:

$ scan-view-20 --no-browser --debug --port 8282 "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8282
  Use Ctrl-C to exit.

The exact extra messages depend on what the server is doing. Debugging does not change the results or make the server more secure.

Add --auto-reload when another analysis process updates the results directory and you want scan-view to update its module for each request:

$ scan-view-20 --no-browser --auto-reload --port 8282 "$RESULTS_DIR"

Use this only when you expect the directory to change. It can make repeated requests do more work and can make a report appear to change while an analysis is still writing it. Stop the producer or wait for a completed result set before drawing conclusions from a report.

6. Treat remote access as a deliberate exception

By default, scan-view restricts access to 127.0.0.1. The --allow-all-hosts option removes that restriction and allows connections from any host that can reach the listening address:

$ scan-view-20 --no-browser --host 0.0.0.0 --port 8282 --allow-all-hosts "$RESULTS_DIR"

This is a security-sensitive change. Clang analyzer results can contain source paths, code excerpts and details about defects. Do not use this option on an untrusted network, and do not assume that an office or VPN network is a sufficient access control. The manpage documents no authentication or encryption option for scan-view-20, so keep the server local unless you have an independently controlled, trusted transport and access boundary.

There is no persistent configuration to undo. Stop the process with Ctrl-C; the next invocation returns to the local default unless you pass the remote-access options again. If you exposed it accidentally, stop it first, then check the host firewall and any proxy or tunnel that may also have published the port.

7. Diagnose the common failures

If scan-view reports Invalid directory, analysis results not found!, check the path and permissions:

$ printf 'path: %s\n' "$RESULTS_DIR"
$ test -d "$RESULTS_DIR" && test -r "$RESULTS_DIR" && printf '%s\n' 'directory is readable'
directory is readable

If the check fails because the directory belongs to another account, fix the ownership or permissions through your normal project process. Do not make a private analysis directory world-readable just to avoid a permission problem.

If a browser cannot connect, read the startup URL, check that the server process is still running, and test the same host and port with curl. A listener on 127.0.0.1 is intentionally unreachable from another machine. Either use a local browser, or design a reviewed tunnel that preserves the local bind address. Do not add --allow-all-hosts as a first troubleshooting step.