It seems like this kind of tool would benefit a lot from the analysis infrastructure created for the Static Analyzer (include/clang/Analysis). Could you briefly explain why you didn't use that infrastructure? http://llvm-reviews.chandlerc.com/D19