{"slug": "kani", "name": "Kani", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 4, "commenters": 8, "warners": 0, "score": 4.587, "rising": -1.31, "first": "2025-12-22", "latest": "2026-10-24", "why": "I've been using Kani[0] which works across both Rust and C code so the proofs are based off the actual code", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 2, "compare": 2, "warn": 0}, "spark": [0, 1, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I've been using Kani[0] which works across both Rust and C code so the proofs are based off the actual code", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/model-checking/kani", "official_url": "https://github.com/model-checking/kani", "pricing": "", "aliases": ["Kani"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 785808640, "item_id": 49113040, "url": "https://news.ycombinator.com/item?id=49113040", "by": "malisper", "date": "2026-07-30", "version": null, "stance": "recommend", "quote": "takes care of translating the code to an intermediate representation for me", "excerpt": "Right now I'm only doing very small simple functions. Kani[0] takes care of translating the code to an intermediate representation for me. It converts the Rust code and C code into a GOTO program[1] which verifiers can then run on top of [0] https://github.com/model-checking/kani [1] https://model-checking.github.io/cbmc-training/cbmc/overview/goto-programs.html", "context": "", "use_case": "Rust code verification", "switched_from": "", "story": "Why Don't People Use Formal Methods?"}, {"id": 785760784, "item_id": 49110049, "url": "https://news.ycombinator.com/item?id=49110049", "by": "malisper", "date": "2026-07-30", "version": null, "stance": "recommend", "quote": "I've been using Kani[0] which works across both Rust and C code so the proofs are based off the actual code", "excerpt": "I recently came across a use case where formal methods were incredibly helpful. I've been rewriting Postgres in Rust and am currently focusing on correctness. The biggest challenge is that there's so much surface area to cover. Postgres has over 3000 user-facing functions, ranging from regular expression matching to JSON iteration to computing the gamma function. About half of these functions are simple pure function", "context": "rewriting Postgres in Rust", "use_case": "formal verification of Rust vs C", "switched_from": "", "story": "Why Don't People Use Formal Methods?"}, {"id": 782310836, "item_id": 48894427, "url": "https://news.ycombinator.com/item?id=48894427", "by": "mayank", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "Kani proofs on the parser and arithmetic core", "excerpt": "TL;DR: Overplane is an AI build system that pairs popular AI coding agents with containers, spec driven development, and automatic lightweight formal verification for a safer, replayable AI codegen workflow. Like many others, I\u2019ve watched AI code pile up at work, and get increasingly lighter reviews due to its size and maddening uniformity. On my side projects at night, I see the full speed and fragility of vibe codi", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Overplane: Containers and formal verification for AI code"}, {"id": 780937472, "item_id": 48808592, "url": "https://news.ycombinator.com/item?id=48808592", "by": "ZeroCool2u", "date": "2026-07-06", "version": null, "stance": "recommend", "quote": "The tutorial is helpful", "excerpt": "The tutorial is helpful: https://model-checking.github.io/kani/kani-tutorial.html Reminds me a bit of hypothesis auto in its simplest applications: https://github.com/timothycrosley/hypothesis-auto/", "context": "", "use_case": "Rust model checking", "switched_from": "", "story": "Kani: A Model Checker for Rust"}, {"id": 741653008, "item_id": 46353313, "url": "https://news.ycombinator.com/item?id=46353313", "by": "rocqua", "date": "2025-12-22", "version": null, "stance": "recommend", "quote": "the thing I love about Kani", "excerpt": "I had a look, and it seems cool. But it doesn't seem to do the thing I love about Kani: work with only very partial annotations, only proving the annotations and being a very light lift on code not relevant for the annotations.", "context": "", "use_case": "Light-touch Rust verification", "switched_from": "", "story": "AI will make formal verification go mainstream"}]}], "caveats": [], "who": [{"by": "malisper", "context": "rewriting Postgres in Rust", "url": "https://news.ycombinator.com/item?id=49110049", "date": "2026-07-30"}], "tags": [], "use_cases": ["rust code verification", "rust verification", "formal verification of rust vs c", "model checking rust code", "rust model checking", "light-touch rust verification"], "compared": [{"slug": "verus", "name": "Verus", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49109026", "title": "Why Don't People Use Formal Methods?", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48806410", "title": "Kani: A Model Checker for Rust", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50225695", "title": "We should be more ambitious with the software we build", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49700153", "title": "Developing provably correct Rust code with Verus", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49323459", "title": "The Case Against Formal Verification, 50 Years Later", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48894426", "title": "Show HN: Overplane: Containers and formal verification for AI code", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 3, "neutral": 1}, "2026-08": {"compare": 1}, "2026-09": {"compare": 1}, "2026-10": {"neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 803621680, "item_id": 50226355, "url": "https://news.ycombinator.com/item?id=50226355", "by": "weinzierl", "date": "2026-10-24", "version": null, "stance": "neutral", "quote": "I understand how to use Kani.", "excerpt": "\"[..] the last time I taked to him about pgrust verification, he mentioned using Kani to verify some parts of the code. He's since switched to Lean and has been using Lean to verify things that are too complex to do in Kani. This would be another topic for another post,\" I'd love to read that post! I understand how to use Kani. I suppose Rust with Lean involves Aeneas, but this is over my head. I'd love someone to wr", "context": "", "use_case": "Rust code verification", "switched_from": "", "story": "We should be more ambitious with the software we build"}, {"id": 795854497, "item_id": 49740906, "url": "https://news.ycombinator.com/item?id=49740906", "by": "63", "date": "2026-09-17", "version": null, "stance": "compare", "quote": "There looks to be some significant overlap between Verus, Kani, and Creusot", "excerpt": "If you found this interesting, you may also be interested to hear about some related projects with similar goals/scopes: Miri[0], Kani[1], and Creusot[2]. There looks to be some significant overlap between Verus, Kani, and Creusot but I've not used any of them so I'll refrain from trying to differentiate them. [0]https://github.com/rust-lang/miri [1]https://github.com/model-checking/kani [2]https://github.com/creusot", "context": "", "use_case": "Rust verification", "switched_from": "", "story": "Developing provably correct Rust code with Verus"}, {"id": 789342352, "item_id": 49333897, "url": "https://news.ycombinator.com/item?id=49333897", "by": "yencabulator", "date": "2026-08-17", "version": null, "stance": "compare", "quote": "Kani is closest to that pragmatism, but correspondingly its theory side is not quite as powerful", "excerpt": "This is why I'm more interested in the kinds of formal methods that integrate with the actual program source code. A couple of examples, in a rough order of approachability by a working programmer: https://github.com/model-checking/kani https://github.com/flux-rs/flux https://github.com/viperproject/prusti-dev https://creusot.rs/ I really wish one of these projects overcomes its academic origins and becomes a softwar", "context": "", "use_case": "", "switched_from": "", "story": "The Case Against Formal Verification, 50 Years Later"}, {"id": 785808640, "item_id": 49113040, "url": "https://news.ycombinator.com/item?id=49113040", "by": "malisper", "date": "2026-07-30", "version": null, "stance": "recommend", "quote": "takes care of translating the code to an intermediate representation for me", "excerpt": "Right now I'm only doing very small simple functions. Kani[0] takes care of translating the code to an intermediate representation for me. It converts the Rust code and C code into a GOTO program[1] which verifiers can then run on top of [0] https://github.com/model-checking/kani [1] https://model-checking.github.io/cbmc-training/cbmc/overview/goto-programs.html", "context": "", "use_case": "Rust code verification", "switched_from": "", "story": "Why Don't People Use Formal Methods?"}, {"id": 785760784, "item_id": 49110049, "url": "https://news.ycombinator.com/item?id=49110049", "by": "malisper", "date": "2026-07-30", "version": null, "stance": "recommend", "quote": "I've been using Kani[0] which works across both Rust and C code so the proofs are based off the actual code", "excerpt": "I recently came across a use case where formal methods were incredibly helpful. I've been rewriting Postgres in Rust and am currently focusing on correctness. The biggest challenge is that there's so much surface area to cover. Postgres has over 3000 user-facing functions, ranging from regular expression matching to JSON iteration to computing the gamma function. About half of these functions are simple pure function", "context": "rewriting Postgres in Rust", "use_case": "formal verification of Rust vs C", "switched_from": "", "story": "Why Don't People Use Formal Methods?"}, {"id": 782310836, "item_id": 48894427, "url": "https://news.ycombinator.com/item?id=48894427", "by": "mayank", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "Kani proofs on the parser and arithmetic core", "excerpt": "TL;DR: Overplane is an AI build system that pairs popular AI coding agents with containers, spec driven development, and automatic lightweight formal verification for a safer, replayable AI codegen workflow. Like many others, I\u2019ve watched AI code pile up at work, and get increasingly lighter reviews due to its size and maddening uniformity. On my side projects at night, I see the full speed and fragility of vibe codi", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Overplane: Containers and formal verification for AI code"}, {"id": 781058832, "item_id": 48816177, "url": "https://news.ycombinator.com/item?id=48816177", "by": "CodesInChaos", "date": "2026-07-07", "version": null, "stance": "neutral", "quote": "The primary thing it checks for is panics.", "excerpt": "The primary thing it checks for is panics. (bounds|overflow|DBZ) are just examples where Rust panics (for overflows rust doesn't always panic, while Kani always fails). You aren't testing your application code directly, but writing a test function. That test function can include any assertion you want in the end, which causes a panic, failing the verification. Similarly you want to add assumptions in the test functio", "context": "", "use_case": "Model checking Rust code", "switched_from": "", "story": "Kani: A Model Checker for Rust"}, {"id": 780937472, "item_id": 48808592, "url": "https://news.ycombinator.com/item?id=48808592", "by": "ZeroCool2u", "date": "2026-07-06", "version": null, "stance": "recommend", "quote": "The tutorial is helpful", "excerpt": "The tutorial is helpful: https://model-checking.github.io/kani/kani-tutorial.html Reminds me a bit of hypothesis auto in its simplest applications: https://github.com/timothycrosley/hypothesis-auto/", "context": "", "use_case": "Rust model checking", "switched_from": "", "story": "Kani: A Model Checker for Rust"}, {"id": 741653008, "item_id": 46353313, "url": "https://news.ycombinator.com/item?id=46353313", "by": "rocqua", "date": "2025-12-22", "version": null, "stance": "recommend", "quote": "the thing I love about Kani", "excerpt": "I had a look, and it seems cool. But it doesn't seem to do the thing I love about Kani: work with only very partial annotations, only proving the annotations and being a very light lift on code not relevant for the annotations.", "context": "", "use_case": "Light-touch Rust verification", "switched_from": "", "story": "AI will make formal verification go mainstream"}]}