Whole-program analysis
Abstract interpretation and symbolic execution explore the feasible execution paths of a program, finding defects across procedure boundaries and modules that simpler tools miss.
Static analysis for code where quality and security matter
Find the bugs that compilers, linters and testing leave behind
CodeSonar is a static application security testing (SAST) tool for software where quality and security matter. It analyses source code or binaries to find and explain quality and security defects, including in code your team did not write, and is used especially in embedded and automotive development.
Deep C/C++ analysis
Whole-program, semantic analysis built for the language versions, compilers and coding standards of large C/C++ codebases.
Defects found early
Flaws buried deep in complex systems cost far more to fix the later they are found; analysis runs at compile time, before testing.
Legacy and third-party code
Analysis of code you did not write makes maintaining large codebases and integrating third-party software manageable.
Compliance evidence
Coding-standard enforcement and safety-standard support support certification work such as DO-178C or ISO 26262.
What CodeSonar does
Analysis that goes deeper than warnings
Understand every warning
Visualised warning paths and call trees show where a defect comes from and what it may cost to fix, so engineers can understand, prioritise and remediate quickly.
Binary analysis
Analysis goes beyond source code to compiled binaries and mixed-language environments, including where source is missing: legacy systems, third-party components and proprietary libraries.
Taint analysis
An integrated taint engine traces untrusted data through the system, exposing injection vulnerabilities and unsafe data propagation.
The CodeSonar hub
A central hub stores every analysis, tracks findings persistently across builds even when code moves, and lets you annotate, rank, assign and compare warnings.
AI-assisted workflows
An MCP server lets AI agents start an analysis, check its progress and find or compare results, combining algorithmic analysis with an AI-assisted workflow.
Coding standards and functional safety
Standards and languages
CodeSonar supports major coding standards such as MISRA C/C++, AUTOSAR C++, CERT, CWE, JSF++ and Power of Ten, and supports functional-safety work against standards such as IEC 61508, ISO 26262, DO 178C/DO 330, IEC 62304/ISO 13485, EN 50128 and IEC 62443. It covers C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript, as well as native binaries, and exchanges findings with other tools through SARIF.
- C/C++
- Java
- C#
- Kotlin
- Python
- Go
- Rust
- JavaScript
- TypeScript
- Native binaries
In your development workflow
Fits the way your team already builds
IDE and CI/CD out of the box
Detected defects appear in your IDE or pipeline like a compiler warning: Eclipse, Visual Studio and Visual Studio Code, plus GitLab, GitHub, BitBucket and Jenkins.
Distributed builds
Parallel build systems such as Bazel are supported, so analysis streams results into the hub while your build infrastructure keeps working.
Exchange with your tools
Findings can be exchanged with other tools in the DevSecOps environment through OASIS SARIF, and custom reports export as PDF, HTML or XML.
CodeSecure describes adoption in aerospace, automotive, defence, medical and industrial automation, among other industries.
Related tool
CodeSentry is the companion binary software composition analysis tool, used where binaries must be analysed without source code.
Licences and renewals
EVOCEAN sells CodeSonar licences and renewals. Licence scope and commercial terms are agreed with you for your environment. Bring your tool landscape and requirements to a 15-minute call or an enquiry. Not sure which configuration fits your environment? We help you scope it.
Discuss your tool environment and the questions you need the product to address. Product descriptions are not guarantees of coverage, compatibility, compliance or results.
Book a 15-min call