creusot-rs/creusot

Health v2 · maintenance only

Adoption not part of the score

1833 stars · 88 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Creusot is a deductive verifier for Rust that proves code is free of panics, overflows, and assertion failures, and—with Pearlite contracts—that it meets formal specifications. It translates Rust to the Coma intermediate language on the Why3 platform, where SMT provers discharge verification conditions.

Use cases

• prove my rust code is correct
• verify rust code has no panics or overflows
• formally verify a rust function against a specification
• write contracts for rust functions
• prove termination of rust programs
• verify a rust data structure like a binary search or sort implementation

When to choose

• you need mathematical guarantees of correctness for critical Rust code
• you want to verify absence of panics, overflows, and assertion failures
• you are comfortable writing formal specifications and working with SMT provers
• you want first-class support for verifying code using mutable borrows

When to avoid

• you just want lightweight linting or property-based testing instead of full proofs
• your codebase is large and you cannot afford annotation effort
• you need zero setup friction—Creusot requires opam, Why3, and external provers
• you work in a language other than Rust

Facets

cli-tool · maturity active

testing developer-tools compiler developer-tools programming-languages windows rust cli formal-verification deductive-verification why3 rust-verification contracts pearlite smt-provers proof-assistant algorithms linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="creusot-rs/creusot")