Static code analysis is an important part of modern software engineering. It helps teams identify potential bugs, security vulnerabilities, code smells, and maintainability issues before they reach production.
But I’ve always wondered: does running static analysis really need to be complicated?
There are excellent tools available, including SonarQube and Semgrep. However, depending on your requirements, adopting them can involve additional infrastructure, configuration, and ongoing maintenance.
I wanted to explore a simpler approach.
That’s how Sonda started.
Today, I’m sharing version 0.2.1 of Sonda, an open-source static analysis tool written in Rust.
And I’m looking for developers willing to put it to the test.
What is Sonda?
Sonda is a lightweight, CLI-first static code analysis tool designed to run locally or inside CI/CD pipelines.
The core idea is straightforward:
Download a binary, scan your repository, and get actionable results.
No server, database, or Docker container is required for standalone analysis.
For teams that want centralized results, analysis history, and quality gates, Sonda also provides an optional server component.
The project is still in its early stages, but the foundation is already in place.
Why Rust?
I chose Rust because I wanted a tool that could be:
- Fast: Efficiently analyze repositories without unnecessary overhead.
- Portable: Run as a native binary on Linux, macOS, and Windows.
- Reliable: Handle unexpected inputs without compromising the entire analysis.
- Maintainable: Support an extensible architecture as new analysis capabilities are introduced.
Rust doesn’t automatically make software fast or reliable, of course. Those properties still depend on architectural decisions and implementation quality.
And building Sonda has presented some interesting engineering challenges.
Inside Sonda’s Architecture
Sonda uses Tree-sitter for parsing source code and is organized as a Cargo workspace with separate components for the analysis engine, CLI, and server.
Several architectural decisions have been particularly interesting.
- Process Isolation for Safer Analysis
Source code analysis involves processing input that may be malformed, unexpectedly large, or intentionally crafted to trigger problematic behavior.
Rather than relying exclusively on threads, Sonda supports running analysis in isolated worker processes.
This helps protect the main scanning process from failures occurring during analysis.
The trade-off is additional complexity around process management and communication.
- Deterministic Parallel Analysis
Parallel processing can improve performance, but it also introduces challenges around reproducibility.
I wanted Sonda to produce consistent results regardless of the number of workers or the order in which files are discovered.
To support this, Sonda uses deterministic ordering when discovering files, collecting findings, and generating reports.
This is particularly important in CI/CD environments, where inconsistent output can make comparisons and debugging unnecessarily difficult.
- Efficient Tree-sitter Queries
Sonda uses Tree-sitter queries to identify patterns in source code.
Instead of independently executing every rule query, enabled queries are combined by language and compiled when needed.
This reduces repeated query execution and helps keep the analysis engine efficient.
- Keeping the Core Independent
The analysis engine is separated from the CLI and server components.
This allows the same analysis capabilities to support different workflows without coupling the core implementation to a particular interface or deployment model.
It also creates a foundation for future improvements.
What Sonda Doesn’t Do Yet
I think it’s important to be transparent about the project’s limitations.
Sonda currently focuses on syntactic and semantic analysis.
It doesn’t yet provide full data-flow or taint analysis, meaning it may miss vulnerabilities or bugs that require tracking values across functions.
It’s also not intended to claim feature parity with mature static analysis platforms.
The goal is to build something useful, reliable, and progressively more capable, with feedback from developers helping determine what comes next.
Why I’m Looking for Early Adopters
Up to this point, much of Sonda’s development has been driven by my own experience and assumptions about developer tooling.
But there’s a limit to what you can learn by testing a tool against your own repositories.
I need developers to challenge those assumptions.
I’m looking for people willing to install Sonda, run it against a real project, and share their experience.
I’m especially interested in understanding:
- Was installation straightforward?
- Did the analysis identify useful issues?
- Were there false positives or unexpected results?
- How did it perform on your repository?
- What would prevent you from using it regularly?
You don’t need to contribute code.
Even ten minutes of testing and a short GitHub issue describing your experience would be incredibly valuable.
Try Sonda v0.2.1
Sonda is available for Linux, macOS, and Windows.
You can find installation instructions, documentation, and the source code here:
GitHub: https://github.com/lvaoliveira/sonda
Website: https://sonda.sh
If you decide to give it a try, please share your findings through GitHub Issues or Discussions.
I’m particularly interested in constructive criticism. If something doesn’t work, is confusing, or doesn’t provide value, that’s exactly the kind of feedback that can help improve the project.
What’s Next?
There are several directions I’d like to explore, including deeper analysis capabilities, improved developer experience, and better integration into existing workflows.
But rather than building features based solely on assumptions, I want to learn from developers using Sonda on real codebases.
That’s one of the reasons I decided to build it as an open-source project.
If you’re interested in static analysis, Rust, or developer tooling, I’d love for you to take a look.
And if you try Sonda, tell me what you think — especially what needs improvement.
Thanks for reading!
