diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 000000000000..d5c104817f9c
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,44 @@
+# The checks defined here will be run and will display by default as warnings.
+Checks: >
+    -*, cppcoreguidelines-c-copy-assignment-signature,
+    cppcoreguidelines-interfaces-global-init, cppcoreguidelines-no-malloc,
+    cppcoreguidelines-pro-bounds-constant-array-index, cppcoreguidelines-pro-type-const-cast,
+    cppcoreguidelines-pro-type-cstyle-cast, cppcoreguidelines-pro-type-member-init,
+    cppcoreguidelines-pro-type-static-cast-downcast, cppcoreguidelines-pro-type-union-access,
+    cppcoreguidelines-pro-type-vararg, cppcoreguidelines-slicing,
+    cppcoreguidelines-special-member-functions, clang-analyzer-security.FloatLoopCounter,
+    clang-analyzer-security.insecureAPI.*, clang-analyzer-core.CallAndMessage,
+    clang-analyzer-core.DivideZero, clang-analyzer-core.DynamicTypePropagation,
+    clang-analyzer-core.NonNullParamChecker, clang-analyzer-core.NullDereference,
+    clang-analyzer-core.StackAddressEscape, clang-analyzer-core.UndefinedBinaryOperatorResult,
+    clang-analyzer-core.VLASize, clang-analyzer-core.builtin.BuiltinFunctions,
+    clang-analyzer-core.builtin.NoReturnFunctions, clang-analyzer-core.uninitialized.ArraySubscript,
+    clang-analyzer-core.uninitialized.Assign, clang-analyzer-core.uninitialized.Branch,
+    clang-analyzer-core.uninitialized.CapturedBlockVariable,
+    clang-analyzer-core.uninitialized.UndefReturn, clang-analyzer-cplusplus.NewDelete,
+    clang-analyzer-cplusplus.NewDeleteLeaks, clang-analyzer-cplusplus.SelfAssignment,
+    clang-analyzer-deadcode.DeadStores, modernize-avoid-bind, modernize-deprecated-headers,
+    modernize-loop-convert, modernize-make-shared, modernize-pass-by-value,
+    modernize-raw-string-literal, modernize-redundant-void-arg, modernize-replace-auto-ptr,
+    modernize-replace-random-shuffle, modernize-return-braced-init-list, modernize-shrink-to-fit,
+    modernize-unary-static-assert, modernize-use-bool-literals, modernize-use-default-member-init,
+    modernize-use-emplace, modernize-use-equals-default, modernize-use-equals-delete,
+    modernize-use-noexcept, modernize-use-nullptr, modernize-use-override,
+    modernize-use-transparent-functors, modernize-use-using, performance-*
+
+# cppcoreguidelines checks not enabled:
+# cppcoreguidelines-pro-bounds-pointer-arithmetic
+# cppcoreguidelines-pro-bounds-array-to-pointer-decay
+# cppcoreguidelines-pro-type-reinterpret-cast
+
+# modernize checks not enabled:
+# modernize-use-auto
+# modernize-make-unique (C++14 and newer only)
+
+# In order to trigger an error, you must have a rule defined both in checks and in this section.
+WarningsAsErrors: >
+    cppcoreguidelines-no-malloc
+
+# Todo: define a better regex match that includes most project headers, but excludes third party 
+# code.
+HeaderFilterRegex: '^src/.*'
diff --git a/Jenkinsfile b/Jenkinsfile
index 0e4aa199a6c7..6a93fd586414 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -183,6 +183,16 @@ core_logic: {
         }
       }
     },
+    'CPU: Clang Tidy': {
+      node(NODE_LINUX_CPU) {
+        ws('workspace/build-cpu-clang60_tidy') {
+          timeout(time: max_time, unit: 'MINUTES') {
+            utils.init_git()
+            utils.docker_run('ubuntu_cpu', 'build_ubuntu_cpu_clang_tidy', false)
+          }
+        }
+      }
+    },
     'CPU: Clang 3.9 MKLDNN': {
       node(NODE_LINUX_CPU) {
         ws('workspace/build-cpu-mkldnn-clang39') {
diff --git a/ci/docker/install/ubuntu_clang.sh b/ci/docker/install/ubuntu_clang.sh
index 40761716933e..cb0f234a1c15 100755
--- a/ci/docker/install/ubuntu_clang.sh
+++ b/ci/docker/install/ubuntu_clang.sh
@@ -26,6 +26,11 @@ wget -O - http://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add - && \
     apt-add-repository "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-3.9 main" && \
     apt-add-repository "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-6.0 main" && \
     apt-get update && \
-    apt-get install -y clang-3.9 clang-6.0 && \
+    apt-get install -y clang-3.9 clang-6.0 clang-tidy-6.0 && \
     clang-3.9 --version && \
     clang-6.0 --version
+
+# Use llvm's master version of run-clang-tidy.py.  This version has mostly minor updates, but
+# importantly will properly return a non-zero exit code when an error is reported in clang-tidy.
+# Please remove the below if we install a clang version higher than 6.0.
+wget https://raw.githubusercontent.com/llvm-mirror/clang-tools-extra/7654135f0cbd155c285fd2a37d87e27e4fff3071/clang-tidy/tool/run-clang-tidy.py -O /usr/lib/llvm-6.0/share/clang/run-clang-tidy.py
diff --git a/ci/docker/runtime_functions.sh b/ci/docker/runtime_functions.sh
index 1e38ec48e6ce..a124e105838d 100755
--- a/ci/docker/runtime_functions.sh
+++ b/ci/docker/runtime_functions.sh
@@ -365,6 +365,32 @@ build_ubuntu_cpu_clang60() {
         -j$(nproc)
 }
 
+build_ubuntu_cpu_clang_tidy() {
+    set -ex
+
+    export CXX=clang++-6.0
+    export CC=clang-6.0
+    export CLANG_TIDY=/usr/lib/llvm-6.0/share/clang/run-clang-tidy.py
+
+    pushd .
+    cd /work/build
+    cmake \
+        -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+        -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+        -DUSE_CUDA=OFF \
+        -DUSE_MKL_IF_AVAILABLE=OFF \
+        -DUSE_OPENCV=ON \
+        -DCMAKE_BUILD_TYPE=Debug \
+        -G Ninja \
+        -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
+        /work/mxnet
+
+    ninja -v
+    cd /work/mxnet
+    $CLANG_TIDY -p /work/build -j $(nproc) -clang-tidy-binary clang-tidy-6.0 /work/mxnet/src
+    popd
+}
+
 build_ubuntu_cpu_clang39_mkldnn() {
     set -ex