I've played with Semmle's product, which I think is called QL now, and I was very impressed. It's a way to write queries about your code, like "show me lines where the address to a non-packed struct is passed to fwrite() or send()," for example.

clang-query might be conceptually similar (and open source), but QL has some sort of graph database captured at compile time that is extremely fast to query. QL's DSL may also be more intuitive and/or sophisticated than clang's, but I haven't used either in a while.

Unless they've extended it since, QL does not actually simulate execution, so it cannot find some of the same bug patterns that other analyzers can.