diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21e0c06..29e69df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,15 @@ defaults:
     shell: bash
 
 jobs:
+  cppcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Cppcheck
+        run: sudo apt-get update && sudo apt-get install -y cppcheck
+      - name: Cppcheck (default settings)
+        run: make cppcheck
+
   mcu-ubuntu:
     runs-on: ubuntu-latest
     steps:
diff --git a/Makefile b/Makefile
index 75d9ba3..06d980d 100644
--- a/Makefile
+++ b/Makefile
@@ -45,8 +45,11 @@ MPU_CFLAGS = -std=c23 -Wall -Wextra -Wpedantic -Iinclude -DMEMKIT_MPU=1 -DEMBEDD
              -DMEMKIT_ALLOW_HEAP=1 -DMEMKIT_ALLOW_MMAP=1
 MPU_OBJS = $(BUILD)/mpu/arena.o $(BUILD)/mpu/mmap_backing.o $(BUILD)/mpu/c_api/bindings.o
 
+CPPCHECK ?= cppcheck
+CPPCHECK_DIRS = src tests examples benchmarks
+
 .PHONY: all test_cpp test_c_api test_c_api_mpu test_c_api_extended test_cpp_mpu mcu mpu clean lib \
-	lib-mcu-c check-lib check-lib-mcu-c test-lib-mcu-c-link benchmark benchmark-size
+	lib-mcu-c check-lib check-lib-mcu-c test-lib-mcu-c-link benchmark benchmark-size cppcheck
 
 # Freestanding MCU C API archive (no libstdc++ at link time for C customers).
 MCU_C_CXXFLAGS = $(CXXFLAGS) -ffreestanding
@@ -241,5 +244,8 @@ $(BUILD)/mpu:
 $(BUILD):
 	mkdir -p $(BUILD)
 
+cppcheck:
+	$(CPPCHECK) --error-exitcode=1 -Iinclude $(CPPCHECK_DIRS)
+
 clean:
 	rm -rf $(BUILD)
diff --git a/README.md b/README.md
index 75878aa..113b6e3 100644
--- a/README.md
+++ b/README.md
@@ -247,6 +247,7 @@ make test_cpp         # C++ container tests only
 make test_c_api       # tier-1 C API tests (MCU, 8 binaries)
 make mpu              # MPU: tier-2 C API tests + test_heap_arena_cpp + integration test
 make lib-mcu-c        # freestanding tier-1 C archive for pure-C firmware
+make cppcheck         # Cppcheck (default checks; requires cppcheck on PATH)
 make clean
 ```
 
@@ -904,10 +905,15 @@ You may still `#include <vector>` directly in your own MPU code; memkit just doe
 
 ## CI
 
-GitHub Actions (`.github/workflows/ci.yml`):
+GitHub Actions (`.github/workflows/ci.yml`) runs builds, tests, and **Cppcheck** static analysis on every push and pull request to `main`:
+
+```bash
+make cppcheck   # same command as the cppcheck CI job (install: apt/brew cppcheck)
+```
 
 | Job | What it runs |
 |-----|----------------|
+| `cppcheck` | Cppcheck (default checks) — `make cppcheck` on `src/`, `tests/`, `examples/`, `benchmarks/` |
 | `mcu-ubuntu` | Clang 21 — `make all` + `lib-mcu-c` / `check-lib-mcu-c` / `test-lib-mcu-c-link` |
 | `mcu-gcc-ubuntu` | GCC 14 (C++23) — `make all` + freestanding C lib targets |
 | `mpu-ubuntu` | Clang 21 — `make mpu` (tier-2 C API + `test_heap_arena_cpp`) |
diff --git a/docs/GETTING_STARTED.md b/docs/GETTING_STARTED.md
index b6181ea..db76885 100644
--- a/docs/GETTING_STARTED.md
+++ b/docs/GETTING_STARTED.md
@@ -197,6 +197,7 @@ git clone https://github.com/NetKit-Labs/memkit.git
 cd memkit
 make all          # MCU: lib + tests + 4 MCU examples
 make mpu          # MPU: tier-2 C tests + heap arena test + 2 MPU examples + integration test
+make cppcheck     # static analysis (Cppcheck; same as CI — install cppcheck first)
 ```
 
 ### CMake (in-tree)