XCop is a free code analysis tool (open source) from Microsoft that analyzes managed .NET assemblies. .NET assemblies contain metadata entries that describe the assembly and all its contained types. FXCop works by reading the assembly metadata and checking it for compliance against built-in and custom rules that describe recommended coding standards and practices.

After analyzing the assemblies, FxCop reports any rules violations in the areas of localization, performance, and security. It checks code against a set of rules and messages stored in an embedded xml file, displaying appropriate messages at runtime when rules violations occur. You can extend the built-in rules with custom rules that you create. This article discusses how to use FxCop, and how to create and apply such custom rules.

To implement the techniques discussed in the article, you'll need: FxCop Version 1.32, the .NET framework version 1.1 or higher installed, and Windows XP/2000 or a later OS.

What is FxCop?
FxCop, an abbreviation for "Framework Police," is a rules-based engine that checks managed code assemblies for conformance to Microsoft's .NET Framework design guidelines and custom guidelines. It performs tests on the assemblies by parsing the MSIL they contain, inspecting and reporting on code that fails to meet the rules. Because FxCop performs the tests on managed assemblies and not the source code, it's .NET-language neutral; in other words, you can apply it to any assembly created using any language that target the Microsoft.NET managed environment.

Why Use FxCop?
FxCop provides some immediate advantages, particularly for shops that use more than one .NET language.

• It works with any managed assembly created by any .NET-compliant language that runs on the Microsoft.NET framework.
• It has an extensive set of pre-defined rules.
• It has support for creating custom rules.
• It produces well-formatted XML test reports.
• It's an open source tool, so you can extend or alter it as needed.

Still, at its current stage of maturity, FxCop does have some limitations:

• It works only with assembly metadata, not source, so it can't be as specific as source code analysis tools.
• It follows a flat rules structure that makes implementing large sets of policies tougher.
• It does not support custom report types.

How to get FxCop?
FxCop was developed by Microsoft. It's available as a free download.

If you have problems or questions you can post messages to the FxCop team or to the MSDN forums.