Static analysis tools for COBOL and JCL
Utilize static code analysis for your mainframe to find issues in COBOL and JCL such as bugs, code smells & security vulnerabilities. Use the Sonar language analyzer with hundreds of rules to evaluate your code and ensure security, reliability and maintainability of your software.
SonarQube code analysis finds issues while you focus on the work
It all comes from a powerful static analysis engine that we constantly refine. SonarQube Server and Cloud employ advanced rules along with smart, exclusive static code analysis techniques to find the trickiest, most elusive issues, code smells, and security vulnerabilities.
Precise static analysis
Deep static analysis of your code through symbolic execution, path sensitive analysis & cross-function/cross file taint analysis.
Fast issue resolution
Issue contextualization with secondary locations highlighted and clear remediation guidance helps you understand and construct a fix.
Minimal distractions
Automatic pull request analysis with results displayed in the comments of your favorite DevOps platform so you stay in the zone.
Produce secure, reliable and maintainable software
Sonar brings Code Quality to your mainframe where your COBOL and JCL code lives. Sonar is tightly integrated with your CI/CD workflow to feed you the right info at the right time and place.
COBOL and JCL code linting in your IDE for mainframes
SonarQube for IDE in your IDE is your first line of defense for keeping the COBOL and JCL code you write today clean and secure. Issues are raised in-line with clear rule descriptions and guidance.
With SonarQube for IDE, the impact is immediate and no configuration is required. You learn from the real-time feedback provided and quickly resolve issues with contextual guidance!
SonarQube for IDE is available from your IDE marketplace:
VS Code | Eclipse
In your cloud workflow
Automatically analyze Pull Requests and feature branches with the results decorated in the DevOps platform of your choice.
Your team can share rule configurations and exclusions across projects and coalesce on a shared definition of excellence. The project Quality Gate is visible to everyone and the releasabity status is clear.
SonarQube Cloud tightly integrates with these popular platforms:
GitHub | Bitbucket | Azure DevOps | GitLab
Reduce technical debt with every release
Identify issues early for quick, accurate fixes, allowing your team to maintain momentum and continuously improve code health.
Sonar empowers developers
Developers can write high-quality, secure code with Sonar. It flags new code and pull requests in your workflow, giving a clear go/no-go for merges and quick issue resolution. Fix problems directly in your workflow as you write code, ensuring changes are solid before production.
Quality Gates show your project Releasability
Sonar Quality Gates immediately indicate if commits meet standards and projects are releasable. They align teams around a shared vision of quality, ensuring everyone knows and meets the standard of excellence across the codebase.
Language Standards
COBOL-74 | COBOL-85 | COBOL-2002 | JCL
Compilers
IBM OS/VS COBOL
IBM OS/VS COBOL II
IBM COBOL/400
IBM ILE COBOL
IBM Enterprise COBOL
Rocket COBOL
AcuCobol-GT
Bull GCOS
HP Tandem and COBOL-IT
Supported Environments
Code compiled in Windows, Linux, macOS
Embedded Statements
Analysis of DB2 SQL and CICS statements embedded inside COBOL
Start cleaning your COBOL and JCL now
What is the COBOL programming language, and why is it still widely used?
COBOL, short for Common Business-Oriented Language, is a long-established programming language created for business, finance, and administrative systems. It is still widely used because many large organizations continue to rely on COBOL applications for critical business processes such as transaction processing, account management, and other core operations. IT is predominantly used on IBM mainframe computers such as the IBM zSystems and Z Enterprise series.
Its continued use is also practical: many existing COBOL systems remain deeply integrated into enterprise workflows, and replacing them can be costly and risky. As a result, organizations often focus on maintaining and improving these systems rather than rewriting them entirely.
What is static code analysis for COBOL?
Static code analysis for COBOL is the automated examination of COBOL source code without executing the program. It helps teams detect issues early in the Software Development Lifecycle (SDLC) by checking code against predefined rules and quality standards during development and CI workflows.
In SonarQube products, COBOL analysis can also be configured with language-specific settings such as source format, dialect, copybooks, and optional DB2 catalog information for rules that analyze embedded SQL more precisely.
How does SonarQube support COBOL programming to ensure software quality?
SonarQube supports COBOL analysis in both SonarQube Server and SonarQube Cloud, with availability depending on plan and edition. In SonarQube Server, COBOL analysis is available starting in Enterprise Edition. In SonarQube Cloud, COBOL is available in Enterprise subscription plans that include enterprise programming languages.
SonarQube lets teams analyze COBOL code with language-specific configuration for source format, dialects, copybooks, ACUCOBOL-GT preprocessing, Micro Focus compiler constants, and optional DB2 catalog data for embedded SQL rules. Teams can then use quality profiles, issues, and quality gates to manage code quality consistently across teams and projects.
What are the key benefits of running automated COBOL code reviews?
Automated COBOL code review helps teams find issues earlier in the SDLC and more consistently than manual review alone. It performs repeatable checks across the codebase, supports standardized quality expectations, and gives developers faster feedback during development and throughout the CI/CD pipeline.
For organizations maintaining large COBOL systems, this can make code changes easier to review, reduce avoidable regressions, and help teams improve maintainability over time. It is especially useful when modernizing development practices around long-lived mainframe applications.
How can developers use SonarQube for IDE to analyze COBOL code?
Software developers can use SonarQube for IDE to get feedback on COBOL issues within the IDE as developers or agents write code, but COBOL support in the IDE requires connected mode with a licensed instance of SonarQube that supports COBOL. The COBOL documentation explicitly supports this with SonarQube for VS Code and SonarQube for Eclipse when connected to SonarQube Server or SonarQube Cloud Enterprise or higher.
Connected mode allows the IDE to use the COBOL quality profile and analysis settings defined on the server or cloud project, so developers receive feedback aligned with the team's configured standards. For VS Code, COBOL analysis is available in SonarQube for VS Code v3.19+ in connected mode with SonarQube Server Enterprise Edition+ or SonarQube Cloud Enterprise plan, and the file's language mode must be set to COBOL.
What is the difference between SonarQube Server and SonarQube Cloud for COBOL analysis?
The main difference is the deployment model.
SonarQube Server is self-managed and you deploy it in the environment of your choice. COBOL analysis is available starting in Enterprise Edition. SonarQube Cloud is a fully managed SaaS product, and COBOL is available in the Enterprise plan.
SonarQube supports COBOL-specific configuration such as dialects, copybooks, source formats, and optional DB2 catalog input for embedded SQL analysis. SonarQube also integrates directly with supported DevOps platforms such as Github, BitBucket, GitLab, and Azure DevOps as part of its SaaS workflow model.
How does automated code analysis help reduce technical debt in legacy COBOL systems?
Automated code analysis helps reduce technical debt by making quality issues visible on an ongoing basis instead of leaving them hidden in long-lived code. This proactive approach gives teams a structured way to identify maintainability problems, prioritize remediation, and prevent new issues from accumulating and contributing to technical debt.
In practice, this is especially valuable for legacy COBOL systems, where codebases may be large, shared across teams, and dependent on copybooks, compiler-specific behavior, or embedded SQL. Continuous analysis helps teams improve those systems incrementally instead of relying only on large, risky cleanup projects.
What features does SonarQube offer to enforce COBOL code security?
SonarQube supports security-related analysis in two important ways for COBOL environments.
First, COBOL analysis includes rules that can target embedded SQL, and some of those rules can use IBM DB2 z/OS catalog data when it is provided to the analysis. This improves the analyzer's understanding of certain database structures used by COBOL applications.
Second, SonarQube also supports secrets detection, which identifies exposed credentials and other sensitive values in source code and supported text files. In SonarQube, secrets detection is available in all plans and editions, including in Community Build and scans files processed by language analyzers as well as files included through Sonar.text.inclusions. Coverage of secrets detection increases in paid editions and plans of SonarQube and lets teams refine the detection scope through language settings.
Which COBOL dialects, standards, and compilers are supported by SonarQube?
Sonar's COBOL analyzer supports multiple COBOL dialects. The supported dialects are Bull GCOS COBOL (bull-gcos-cobol), HPE NonStop COBOL (hp-tandem-cobol), IBM OS/VS COBOL (ibm-os/vs-cobol), IBM ILE COBOL for IBM i (ibm-ile-cobol), IBM VS COBOL II (ibm-cobol/ii), IBM COBOL/400 for AS/400 (ibm-cobol/400), IBM Enterprise COBOL for z/OS (ibm-enterprise-cobol), Micro Focus Visual COBOL (microfocus-cobol), Micro Focus ACUCOBOL-GT (microfocus-acucobol-gt-cobol), and GnuCOBOL / COBOL-IT (opencobol/cobol-it).
The analyzer also supports multiple COBOL source formats: fixed, free, and variable. In addition, SonarQube supports JCL as a separate language, which can be relevant in mainframe environments where COBOL and JCL are used together.
How can teams integrate COBOL analysis into their existing DevOps pipelines?
Teams integrate COBOL analysis by first extracting COBOL source code onto a filesystem that the scanner can access. SonarQube's COBOL documentation explicitly states that source extraction is required and that SonarQube does not provide connectors or extraction tools for this step.
Once the source is available, teams run analysis through their CI-based workflow using SonarQube scanners and then review results in SonarQube Server or SonarQube Cloud. From there, teams can use branch analysis, pull request analysis, and quality gates as part of their delivery process. When pull request decoration and DevOps integration are configured, analysis feedback can also appear directly in the pull request workflow.