Tools for Legacy Code: The Source Code Archaeology Toolkit (2/5)

Legacy code works, but no one knows exactly why the systems were built the way they were. The documentation is missing, and the original developers are gone. Source code archaeology makes this knowledge accessible again, thereby laying the foundation for any well-informed modernization.

After examining the strategic fundamentals and business benefits in Part 1 of our series, this part focuses on the technical toolkit: Which source code archaeology and code analysis tools do developers and software architects use to extract the necessary insights from their legacy systems?

Here’s what you’ll take away from this post:

• Broad Scope of Application: Source code archaeology helps successfully examine large legacy systems and answer key questions about architecture, code quality, history, test coverage, and security.
• Diverse Toolkit: There are numerous commercial and open-source tools (e.g., Git, IntelliJ, SonarQube, and CodeScene), each covering different areas of focus.
• Built-in tools as a starting point: Standard tools like Git and IntelliJ significantly lower the barrier to entry, as they are usually already available and quickly provide initial insights.
• Custom Tool Selection: There is no universal “perfect” tool. The choice depends on the specific questions, the integration effort, and the project’s focus, though different tools often complement each other well.

As explained in the previous section, source code archaeology helps answer key questions: What is the architecture like, what is the code quality, how has the code evolved over time, how reliable are the tests, and where do security risks lie?

There are numerous tools available for each of these questions. Most address several questions at once; some are open source, others proprietary; and the effort required to integrate them into an existing system landscape varies greatly. Our overview is intended to help you make targeted selections for your projects. To that end, we present frequently used, established tools and indicate in square brackets which questions each one addresses. This is deliberately not a comprehensive catalog to be worked through point by point: what matters is which question you want to answer and what level of effort is appropriate for that. That’s why we’ll delve deeper into only selected tools in the following posts.

We have deliberately excluded artificial intelligence. It expands source code archaeology with new analysis capabilities and will therefore be the subject of its own post in later parts of the series. Stay tuned!

Which Tools Are Suitable for Source Code Archaeology?

For effective source code archaeology, a multi-tiered toolkit is recommended: Built-in tools like Git and IntelliJ IDEA for a quick overview of history and code structure, supplemented by static code analysis tools (e.g., SonarQube, CodeScene, Teamscale) for quality metrics and hotspots, architecture tools for structural rules, and specialized security tools for code vulnerabilities.

Market Overview: Built-in Tools and Analysis Tools

Built-in Tools for History & Code Characteristics

Git [Architecture, Behavioral Analysis] is considered the go-to built-in tool, as it is already in widespread use even before the archaeology analysis begins, eliminating the need for additional integration effort. Its strengths clearly lie in the initial historical analysis, as simple commands like git log provide comprehensive insight into commits over time. It also offers clues about architectural issues, since strong coupling between two components is usually evident when both components are modified simultaneously. We’ll show you everything else you can uncover with Git in one of the upcoming parts of our series, where we’ll take a closer look at Git as a tool.

IntelliJ IDEA [Architecture, Code Quality], the second built-in tool—which is often used even before the analysis begins—provides an excellent overview of code quality per file through its highlighting (underlines in the code, lightbulb icons), thereby quickly identifying code smells, anti-patterns, dead code, and much more. This more microscopic view of individual files is further complemented by two architecture-related features: the Dependency Structure Matrix (DSM) and UML diagrams. These visualize dependencies and immediately highlight architectural violations. Here, you can already sense that IntelliJ offers more power than you might expect at first glance. We’ll show you exactly how to use these features in a separate part of our series.

Generalists for Code Quality & Technical Debt

SonarQube [Code Quality, Test Coverage, Security] (very limited Open Core, commercial for Team and Enterprise features) is one of the most widely used tools for assessing source code quality through static code analysis and provides a comparison after every change made. It also indirectly contributes to test coverage by visualizing coverage reports from other tools. Through vulnerability analysis in the code, it already functions as a basic Static Application Security Testing (SAST) tool, as it can detect SQL injections, hardcoded credentials, and more. It should be noted, however, that in the standard configuration, this part of the analysis applies only to your own source code. SonarQube detects vulnerabilities in third-party libraries only with the paid add-on package Advanced Security (available starting with the Enterprise Edition). Users who do not use this package should supplement it with specialized tools

CodeScene [Architecture, Code Quality, Behavioral Analysis] (commercial, with the exception of open-source projects) enables, among other things, static code analysis that takes version control into account. This often helps identify frequently modified hotspots that indicate areas that are particularly technically vulnerable or prone to errors. Through CodeHealth, CodeScene provides a quality metric to identify, for example, God classes or duplicate code, and presents this as a numerical value. CodeScene itself demonstrates in a benchmark that CodeHealth predicts maintainability more accurately than SonarQube’s Maintainability Rating. In addition, thanks to its change-coupling graphs, this tool can uncover hidden logical dependencies and thus contributes to the architectural aspect to some extent.

Teamscale [Architecture, Code Quality, Behavioral Analysis, Test Coverage] (purely commercial) specializes in combining static analysis with dynamic data to, for example, identify test gaps as early as the development phase and excels in broad language and system integration. Through architecture conformance analysis, it is possible to specify architectures as hierarchically nested components. Architects can also define policies, and the monitoring system alerts users when these policies are violated. Metrics for code quality (method length, complexity, duplicate code) are also included, allowing code smells and similar issues to be detected. Through evolution and code ownership analysis, this tool also provides valuable insights into historical analysis and reveals who owns which code and how this ownership shifts over time.

CodeCharta [Architecture, Code Quality, Behavioral Analysis, Test Coverage] (Open Source) provides an overview of problematic areas in the codebase that is particularly well-suited for management. It clusters related parts of the code into “building complexes” in the form of a 3D city map. Some metrics are also visualized through height and color. The metrics can be collected using the tool itself or imported from tools such as SonarQube. The range of metrics covers several aspects and includes, for example, complexity, line coverage, code churn (frequency of changes), code smells, and the number of authors. This makes it particularly well-suited for consolidating findings from multiple sources and communicating them to the team or to management.

Architecture Specialists

jQAssistant [Architecture, Code Quality] (Open Source) stores the structure of software systems in a Neo4j graph database and enables them to be analyzed and validated based on customizable rules. For example, this can help identify architecture violations. In the next parts of our series, we’ll show you how to use jQAssistant to automatically enforce architectural rules and detect “God classes” or deep inheritance hierarchies.

Sonargraph [Architecture, Code Quality] (commercial) has a strong focus on architectural erosion and cyclic dependencies, but also covers the internal quality of the code through complexity assessment. Although it also offers the option to import coverage reports from other tools, similar to SonarQube, the presentation of these metrics is very limited; therefore, it does not really contribute to test coverage.

Security: SAST Tools & Software Composition Analysis

PrismaScan [Security] (commercial-only, part of Palo Alto Prisma Cloud) is a specialized tool for Software Composition Analysis (SCA) that scans open-source dependencies for known vulnerabilities and licensing issues. PrismaScan is a strong security solution because it goes beyond mere code security. In addition to detecting misconfigurations, it also protects containers at runtime and identifies identity and authorization risks in the cloud. Although it extends beyond the narrower core area of source code archaeology, its strong security focus makes it an important addition.

Veracode [Security] (purely commercial) combines Software Composition Analysis with a wide range of SAST tools (Static Application Security Testing), DAST (Dynamic Application Security Testing), and IAST (Interactive Application Security Testing). Reachability analysis checks whether vulnerable library methods are called at all, which drastically reduces false positives. Policy gates in CI/CD can enforce the remediation of findings before merging. Compared to PrismaScan, the primary focus is on application security (AppSec), making it an excellent choice depending on environmental requirements.

Tools for the Various Aspects of Source Code Archaeology

This table provides an overview of the tools.
 

	Architecture	Code Quality	Historical/Behavioral Analysis	Test Coverage	Security
Git	✔		✔
IntelliJ	✔	✔
SonarQube		✔		✔	✔
CodeScene	✔	✔	✔
TeamScale	✔	✔	✔	✔
PrismaScan					✔
Veracode					✔
CodeCharta	✔	✔	✔	✔
jQAssistant	✔	✔
Sonargraph	✔	✔

  As mentioned earlier, this table does not provide a complete picture of all tools or niche topics, but it does offer a solid overview of the most common conventional tools and how they can be used to address various challenges in source code archaeology.

 

Conclusion & Outlook: Choosing the Right Toolset for Legacy Code

There is no single “perfect” tool—only the right tools for your specific use case. As the overview shows, all the solutions presented here have their place. Ultimately, factors such as integration effort, cost, and the focus of your current project will determine which tool is the right choice.

Built-in tools like Git and IntelliJ greatly lower the barrier to entry for an initial analysis. They’re usually already available and quickly provide initial insights. For more in-depth security analyses or architecture reviews, however, specialized tools like Veracode or Teamscale are often the better choice. The key is not to get overwhelmed by the variety of tools, but to clearly define your own goals and select the right tools for the job. Often, different tools even complement each other very well.

In the next parts of this series, we’ll look at how some of these tools can be applied in practice. There, we’ll answer questions such as: Which file should you look at first? Who has the most knowledge about a module? And how are components structurally related?

To do this, we’ll take a very close look at Git—focusing on frequently modified files, knowledge silos, and looking back at history—as well as IntelliJ IDEA with some interesting features, including the Dependency Matrix, and jQAssistant.

Why these tools in particular?

Covering all tools in detail would simply be too extensive. Specialized solutions like security scanners are designed for very specific use cases and are usually only worthwhile once the basics have been clarified. Above all, however, we want to provide beginners in source code archaeology with a solid set of tools that can already answer the most fundamental questions. Git, IntelliJ, and jQAssistant are ideal for this: Git and IntelliJ are already in use in most teams, and jQAssistant is open source. Together, they cover history, knowledge silos, and architecture. This way, you can get started right away without first having to acquire licenses or set up infrastructure. And if you want to dive deeper into topics like security later on, the tool overview above will show you which specialized tools are suitable for that.

---

The “Source Code Archaeology” Blog Series

• Part 1_ Fundamentals & Business Perspective: – What source code archaeology achieves and why the most reliable way to modernize legacy systems begins with understanding the existing business logic and the technical state of the application.
• Part 2: The Tool Market – Which tools exist in the field of source code archaeology and which tool is suitable for which problem.
• Part 3: Analysis with On-Board Tools – How development teams can uncover valuable system knowledge using existing standard tools without an additional budget.
  (To be published on November 17, 2026)
• Part 4: Graph-Based Code Analysis – A comparison of conventional tools with AI-powered code graphs, and how both approaches can be combined.
  (To be published on November 24, 2026)
• Part 5: Artificial Intelligence & Autonomy – From MCP servers to AI agents: Can generative AI soon take over source code archaeology entirely? (To be published on December , 1 2026)