Serve Clang Static Analyzer Results with scan-view-20

scan-view-20 puts a browsable web page in front of a Clang static analyzer results directory, without you hand-crafting links between report files. You will finish with a local web server showing that directory, plus a safe way to expose it only when you deliberately need remote access. The examples use scan-view-20 from Debian package clang-tools-20, version 1:20.1.8~++20250804090239+87f0227cb601-1~exp1~20250804210352.139.

Allow about ten minutes. You need a shell, a results directory produced by a Clang static analysis run, and permission to read that directory. The normal workflow is unprivileged: you do not need sudo unless the results sit somewhere your account cannot read.

1. Confirm the installed command

Check the executable and package before starting a server:

$ command -v scan-view-20
/usr/bin/scan-view-20
$ dpkg-query -W -f='${Package} ${Version}\n' clang-tools-20
clang-tools-20 1:20.1.8~++20250804090239+87f0227cb601-1~exp1~20250804210352.139
$ scan-view-20 --help

The help output should describe the Clang static analyzer results viewer and show one required positional argument, <results directory>. It also lists the defaults: host 127.0.0.1 and port 8181, which keep the viewer on the local machine.

2. Locate the results directory

Use the directory created by your analyzer run. Substitute an actual path, not the literal placeholder:

$ RESULTS_DIR='/path/to/clang-analysis-results'
$ test -d "$RESULTS_DIR" && printf '%s\n' 'results directory exists'
results directory exists
$ ls -la "$RESULTS_DIR"

The positional argument is a directory, not an individual report file, and a missing or unsuitable directory is rejected before the server starts. This check is harmless and catches a typo early:

$ test -d "$RESULTS_DIR" || { printf 'Not a directory: %s\n' "$RESULTS_DIR" >&2; exit 1; }

Do not create a results directory by guessing its internal files. Generate or copy a real analyzer result set, then point scan-view at that directory, and keep the original result files unchanged while you investigate a report.

3. Start a local viewer

Start with --no-browser. It stops the command opening a graphical browser, which is useful on a remote shell, in a terminal multiplexer, or when you want to control the browser yourself:

$ scan-view-20 --no-browser "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8181
  Use Ctrl-C to exit.

Leave this process running. On the same machine, open http://127.0.0.1:8181 in a browser: the viewer serves the directory supplied on the command line. Press Ctrl-C in the terminal to stop it.

4. Choose a port explicitly

For a repeatable local command, pick a free unprivileged port above 1024:

$ scan-view-20 --no-browser --host 127.0.0.1 --port 8282 "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8282
  Use Ctrl-C to exit.

A port below 1024 can require elevated privileges on Linux and offers no benefit for this viewer. Prefer an unprivileged port and avoid sudo. If the chosen port is busy, stop the process that owns it or choose another; do not kill an unrelated service merely to make the example work.

To verify the listener from another terminal, use a read-only request:

$ curl --fail http://127.0.0.1:8282/ > /tmp/scan-view-index.html
$ test -s /tmp/scan-view-index.html && printf '%s\n' 'viewer answered'
viewer answered

Remove the temporary response with rm /tmp/scan-view-index.html once you no longer need it. That file is only a captured page, not part of scan-view's configuration.

5. Understand reload and debug options

Add --debug for extra diagnostic messages:

$ scan-view-20 --no-browser --debug --port 8282 "$RESULTS_DIR"
Starting scan-view at: http://127.0.0.1:8282
  Use Ctrl-C to exit.

The exact extra messages depend on what the server is doing. Debugging does not change the results or make the server more secure.

Add --auto-reload when another analysis process updates the results directory and you want scan-view to pick that up on each request:

$ scan-view-20 --no-browser --auto-reload --port 8282 "$RESULTS_DIR"

Use this only when you expect the directory to change. It can make repeated requests do more work, and can make a report appear to change while an analysis is still writing it: stop the producer or wait for a completed result set before drawing conclusions from a report.

6. Treat remote access as a deliberate exception

By default, scan-view restricts access to 127.0.0.1. The --allow-all-hosts option removes that restriction and allows connections from any host that can reach the listening address:

$ scan-view-20 --no-browser --host 0.0.0.0 --port 8282 --allow-all-hosts "$RESULTS_DIR"

There is no persistent configuration to undo. Stop the process with Ctrl-C; the next invocation returns to the local default unless you pass the remote-access options again. If you exposed it by accident, stop it first, then check the host firewall and any proxy or tunnel that may also have published the port.

7. Diagnose the common failures

If scan-view reports Invalid directory, analysis results not found!, check the path and permissions:

$ printf 'path: %s\n' "$RESULTS_DIR"
$ test -d "$RESULTS_DIR" && test -r "$RESULTS_DIR" && printf '%s\n' 'directory is readable'
directory is readable

• Directory owned by another account? Fix the ownership or permissions through your normal project process; do not make a private analysis directory world-readable just to avoid a permission problem.
• Browser cannot connect? Read the startup URL, check that the server process is still running, and test the same host and port with curl. A listener on 127.0.0.1 is intentionally unreachable from another machine, so either use a local browser or design a reviewed tunnel that preserves the local bind address. Do not add --allow-all-hosts as a first troubleshooting step.