Skip to content
SPECIFICTION
Get listed

CodeSonar

adacore.com

Free trial WebWindowsLinuxSelf-hosted
Visit adacore.com
Spec score 8.1 #5 of 24 in Static Application Security Testing Sast

What it is

CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.

Spec sheet

Purpose
CodeSonar is a static application security testing solution that finds security and quality defects in code.Read 8 Oct 2026 · adacore.com
Deployment
AdaCore says its tools can be installed on premises or in air-gapped environments, including on developer workstations, DevOps pipelines, and private clouds.Read 8 Oct 2026 · adacore.com
Trial
AdaCore invites customers to request a trial to evaluate CodeSonar in their environment.Read 8 Oct 2026 · adacore.com
Integrations
The product page identifies Visual Studio, GitLab, Jira, Jenkins, and VS Code integrations, and says CodeSonar integrates with project management, CI/CD workflows, and developer IDEs.Read 8 Oct 2026 · adacore.com
Support
AdaCore says its engineering team is directly accessible through support and that customers can speak with the developers of the technology.Read 8 Oct 2026 · adacore.com
Headquarters
New York, United States and Paris, FranceRead 28 Sep 2026 · adacore.com
Founded
1994Read 28 Sep 2026 · adacore.com
Maker
AdaCore says it began in 1994 as an Ada compiler company focused on Unix systems.Read 8 Oct 2026 · adacore.com
Analysis
Abstract interpretation and symbolic execution explore feasible execution paths across procedures and modules to detect defects.Read 8 Oct 2026 · adacore.com
Binary analysis
CodeSonar can analyze compiled binaries and mixed-language environments, including cases where source code is missing.Read 8 Oct 2026 · adacore.com
Coding standards
Supported standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++, and CERT.Read 8 Oct 2026 · adacore.com
Languages
It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript.Read 8 Oct 2026 · adacore.com
Reporting
Its custom report builder can export reports in PDF, HTML, or XML.Read 8 Oct 2026 · adacore.com
Safety qualification
AdaCore says CodeSonar is pre-qualified for projects to ISO 26262, IEC 61508, and EN 50128 safety levels, and has been qualified in projects for DO-178B/C up to DAL-A using DO-330.Read 8 Oct 2026 · adacore.com
Security coverage
Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++, and DISA STIG.Read 8 Oct 2026 · adacore.com
Supported operating systems
CodeSonar runs on supported 64-bit Windows versions, including Windows Server, and 64-bit Linux distributions with glibc 2.39 or higher.Read 8 Oct 2026 · adacore.com

Plans and prices

CodeSonar Priced on request Flexible licensing options based on usage size, team needs, and deployment configuration Read 8 Oct 2026 · adacore.com

Every CodeSonar plan and price →

Strong points and limits

Strong points

  • Analyzes source code and compiled binaries
  • Supports nine listed programming-language groups
  • Includes named IDE, CI and project integrations
  • Exports PDF, HTML and XML reports
  • Supports pull-request scans and custom rules

Limits

  • Pricing is available only on request
  • Linux requires glibc 2.39 or higher
  • Runs on supported 64-bit systems
  • Trial requires requesting evaluation access

Who it suits

CodeSonar suits development and security teams analyzing source and binaries across multiple languages, especially where coding standards, CI/CD workflows or safety-qualified projects matter. It supports on-premises and air-gapped environments.

Verdict

CodeSonar combines multi-language static analysis, binary inspection and workflow integrations with on-premises and air-gapped deployment options. Teams should confirm operating-system requirements and request pricing or a trial.

Where Specifiction places it

Alternatives to CodeSonarAll alternatives →