  Background. Developers use Automated Static Analysis Tools (ASATs) to control
for potential quality issues in source code, including defects and technical
debt. Tool vendors have devised quite a number of tools, which makes it harder
for practitioners to select the most suitable one for their needs. To better
support developers, researchers have been conducting several studies on ASATs
to favor the understanding of their actual capabilities.
  Aims. Despite the work done so far, there is still a lack of knowledge
regarding (1) which source quality problems can actually be detected by static
analysis tool warnings, (2) what is their agreement, and (3) what is the
precision of their recommendations. We aim at bridging this gap by proposing a
large-scale comparison of six popular static analysis tools for Java projects:
Better Code Hub, CheckStyle, Coverity Scan, Findbugs, PMD, and SonarQube.
  Method. We analyze 47 Java projects and derive a taxonomy of warnings raised
by 6 state-of-the-practice ASATs. To assess their agreement, we compared them
by manually analyzing - at line-level - whether they identify the same issues.
Finally, we manually evaluate the precision of the tools.
  Results. The key results report a comprehensive taxonomy of ASATs warnings,
show little to no agreement among the tools and a low degree of precision.
  Conclusions. We provide a taxonomy that can be useful to researchers,
practitioners, and tool vendors to map the current capabilities of the tools.
Furthermore, our study provides the first overview on the agreement among
different tools as well as an extensive analysis of their precision.
