Sonda is open-source static code analysis and quality gates in the spirit of SonarQube, as a single fast binary. It judges every change on its new code — and lets you sound from any metric straight down to the line that caused it.
Terminal output is abridged from a real report; the numbers are sample data.
Drill-down
Every number has a bottom. Sonda takes you there.
A falling coverage figure isn’t a task. Click any metric and Sonda lowers a line through your projects — project, component, file — until it reaches the issues behind it.
Overviewdepth 1
all projectsGate pass rate 81% · 253 of 312 passing.
Projectdepth 2
payments-platformGate failed on main · new_bugs > 0.
Componentdepth 3
services/Security level 1 of 5 · owner @checkout, from CODEOWNERS.
From a checkout of the repository: Docker Compose and PostgreSQL, with its secrets created for you.
$ scripts/setup-server.sh
02
Sign in
Open http://127.0.0.1:9000 and sign in as admin. The password is in secrets/admin_password.
03
Connect a repository
Paste its GitHub URL. Sonda creates the project, its token, and the CI workflow that uploads every analysis.
04
Upload from anywhere
Or send any scan yourself. The server’s gate then decides the exit code.
$ sonda scan . --upload --server http://127.0.0.1:9000 --project app
Developer experience
Same analysis on your laptop and in the pipeline.
Analyze locally before you push, then let CI run the same scan and report the gate result. Without --new-code, Sonda picks the pull request’s base or the pushed commits on its own.
localScan before you push and read the results in the terminal.
pull requestThe same scan in CI judges the pull request’s changes; a failing gate exits 1.
serverUploads keep analyses per branch and pull request, with history, triage and owners.
.github/workflows/sonda.yml
name: sonda
on: [pull_request]
jobs:
analyze:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # sonda needs the base branch
- run: cargo install --git https://github.com/lvaoliveira/sonda --tag v0.1.0 sonda
- run: sonda scan . # exits 1 when the gate fails
History
Every decision, written down.
Sonda is built in the open. Every architectural choice — how parsers are sandboxed, how new code is found, what a token may do — is written down as a public decision record before the code that follows it.
466commits
168merged pull requests
23decision records
2,022rules
As of 2 November 2026
A scanner that treats every repository as hostile
First commit: a static analyzer with hardened input handling, a CLI and property tests. New code is computed from git objects, never by running git diff.
Parsing moves into worker processes, so a crashing grammar costs one file, then the workers sandbox themselves: seccomp on Linux, Seatbelt on macOS.
The workspace splits into sonda, sonda-core and sonda-server. Reports get stable fingerprints, sonda upload sends them, and the server takes its first analyses.
The web app moves onto real data: Overview, Issues and drill-downs, then Projects, Analyses, Components, Security and Quality gates. Owners come from CODEOWNERS.
Users, roles and sign-in throttling. SonarQube rule parity becomes the goal, and the first JavaScript rule batches land.
Every rule gets its CWE ids and OWASP Top 10 categories. SBOMs from lockfiles, OSV advisory sync and a dependency gate follow.
New code gets a sensible default and a period on the server; coverage goes per file, per branch and per function.
A tool that judges your code should be open to judgment itself. Sonda’s analyzers, rules and roadmap are developed on GitHub under MIT or Apache-2.0, and contributions of every size are welcome.
