diff --git a/clang-query.sh b/clang-query.sh
new file mode 100755
index 0000000000..e21ca82461
--- /dev/null
+++ b/clang-query.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -eu
+
+matcher=$(cat <<'EOF'
+set print-matcher true
+
+# expressions of any floating point type (unless in a system header)
+match expr(allOf(unless(isExpansionInSystemHeader()), hasType(realFloatingPointType())))
+
+# calls to memcmp (secp256k1_memcmp_var should be used instead)
+match callExpr(callee(functionDecl(hasName("memcmp"))))
+
+quit
+EOF
+)
+
+check() {
+    local file=$1
+    shift
+    local extra=
+    for arg in $@
+    do
+        extra="$extra --extra-arg=$arg "
+    done
+    output=$(echo "$matcher" | clang-query --extra-arg="-DHAVE_CONFIG" --extra-arg="-DSECP256K1_BUILD" $extra "src/$file")
+
+    ! echo "$output" | grep -C 9999999 -E "^Match"
+    echo
+}
+
+check secp256k1.c            -DHAVE_CONFIG -DSECP256K1_BUILD
+check tests.c                -DHAVE_CONFIG -DSECP256K1_BUILD -DVERIFY
+check tests_exhaustive.c     -DHAVE_CONFIG -DSECP256K1_BUILD -DVERIFY
+check valgrind_ctime_test.c  -DVALGRIND
diff --git a/contrib/travis.sh b/contrib/travis.sh
index 24cc9315cb..4814f82513 100755
--- a/contrib/travis.sh
+++ b/contrib/travis.sh
@@ -66,3 +66,5 @@ if [ "$CTIMETEST" = "yes" ]
 then
     ./libtool --mode=execute valgrind --error-exitcode=42 ./valgrind_ctime_test > valgrind_ctime_test.log 2>&1
 fi
+
+./clang-query.sh