CodeSonar vs NodeJsScan
CodeSonar
adacore.comNodeJsScan
github.comSide by side
| Figure | CodeSonar | NodeJsScan |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Static Application Security Testing Sast | 8.1 (#5) | 7.8 (#10) |
| Spec score · SAST Tools | 8.1 (#8) | 7.8 (#13) |
| Deployment | AdaCore says its tools can be installed on premises or in air-gapped environments, including on developer workstations, DevOps pipelines, and private clouds. | The project documents running a prebuilt Docker image or building its Docker image locally. |
| Headquarters | New York, United States and Paris, France | Vancouver, Canada |
| Integrations | The product page identifies Visual Studio, GitLab, Jira, Jenkins, and VS Code integrations, and says CodeSonar integrates with project management, CI/CD workflows, and developer IDEs. | Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI. |
| Purpose | CodeSonar is a static application security testing solution that finds security and quality defects in code. | NodeJsScan is a static application security testing scanner for Node.js applications. |
Plans
In their own words
CodeSonar
CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.
NodeJsScan
NodeJsScan is a static application security testing scanner for Node.js application source code. Its detection engine uses libsast and Semgrep, and the project provides a web interface, command-line interface, and Python API through njsscan. A local setup runs the web interface at http://127.0.0.1:9090. CLI results can be exported as JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, or HTML. The .njsscan configuration file lets users set scanned file types, ignored paths and rules, severity filters, and severity overrides. Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI. Alerts can go to Slack through a webhook or to email using SMTP settings. Teams can run a prebuilt Docker image or build the image locally. The project describes use in CI/CD and DevSecOps pipelines. NodeJsScan is free and licensed under GPL-3.0. The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.