Introduction to SonarQube Remediation Agent

You already know SonarQube flags the bugs, vulnerabilities, and code smells in your codebase. The question is: who actually fixes them? Coding agents ship code faster than any team can review by hand, so that backlog only grows— until it's the thing slowing you down. SonarQube Remediation Agent closes that loop: it takes an issue from flagged to fixed, automatically. It runs in three different ways, and you're in control of every one. Automated backlog remediation works on a schedule you set — daily or weekly — and opens a pull request that tackles the 5 most pressing issues in your code. Manual remediation is targeted: select issues from your backlog, hit Assign to Agent, and it groups the fixes by rule and file type into a single PR. Pull request remediation triggers the instant a quality gate fails in your devops platform — one checkbox, and the agent generates a fix. If CI fails on one of its own pull requests, it reads the build logs, pushes a new commit, and retries — up to three times — before it ever hands the PR back to you. SonarQube Remediation Agent can fix reliability, maintainability, and select security issues across the languages your team already uses, plus any exposed secret, plus dependency vulnerabilities from SCA, with version bumps for npm, PyPI, and Maven. And every one of those fixes is verified before you ever see it. SonarQube re-analyzes each change the agent proposes, and a pull request is only created if the fix passes the gate and introduces no new issues. You can bring your own OpenAI or Anthropic key, and monitor your token usage and cost. Nothing merges without you. Every fix still lands as a normal pull request for you to review and approve. It's the same verification you already trust in CI — just running earlier, on the debt that's already piled up. The backlog that used to only grow now clears itself, one verified PR at a time. SonarQube Remediation Agent — verified fixes, on demand. Learn more at sonar.com.