SONARQUBE

Code confidence for the agentic software factory

SonarQube delivers independent, zero-trust, multilayered verification and governance for every change, whether a developer or an AI wrote it.

Get started for free Compare plans
SonarQube Server dashboard showing code quality and security results
Trusted by over 7M developers and 75% of the Fortune 100
Mercedes Benz
Nvidia
Santander
BUILD CONFIDENCE

The four components of code confidence

Here’s how SonarQube brings confidence to agentic software development across every code change, from generation through review and audit.

Intent

Goals and standards, clearly specified

Architects and tech leads set the standards: quality profiles, intended architecture, and security policies. SonarQube turns them into one definition of “right” that every developer and coding agent works to.

Guiderails

That guide and govern

SonarQube plugs into your IDEs and coding agents via plugins, CLI, and MCP, so the standards you set apply wherever code is written, by a person or an agent.

Verification

Thorough, independent, actionable

Every pull request gets a zero-trust, multilayered review that finds reliability, security, and maintainability issues and fixes them before the change ships.

Evidence

Consistent, auditable, repeatable

Quality gates decide what merges and record every check. Each result is time-stamped and tied to the commit, so you can show auditors why a change shipped.

Cloud and Server

Same verification. Run it where your code lives.

Verify AI and human code the same way, with Sonar hosting it or inside your own perimeter. Pick the deployment that fits your security and compliance needs.

SaaS

SonarQube Cloud: fully managed by Sonar

Verification that runs and maintains itself, so your team spends its time on code, not infrastructure.

  • Start verifying code today. Connect a repo and the quality gate is live the same day, with no servers to run.
  • Stay current without upgrade projects. New rules and AI-code checks arrive automatically, so your gate never lags the code being written.
  • Keep your team shipping. Sonar runs and maintains it.
Best forTeams that want verification live this week
MaintenanceHandled by Sonar
Start for free Learn more
Self-Hosted

SonarQube Server: self-managed inside your perimeter

The same verification on infrastructure you control, built for teams that must keep code and findings in-house.

  • Keep code and findings inside your perimeter. Runs on your infrastructure, including air-gapped, so residency and privacy rules are met by design.
  • Fit verification to your enterprise. Custom configuration and integrations match how your org already governs releases.
  • Prove every merge decision to auditors. The same time-stamped, traceable quality-gate evidence, on your terms.
Best forRegulated teams that must self-host
MaintenanceYou control upgrades and infrastructure
Start for free Learn more
In both

Same systematic code analysis, same quality gates, same evidence.

Capabilities

SonarQube capabilities

Apply one standard for code quality, security, and governance to every developer and every coding agent.

Catch bugs and debt before they merge.

  • Finds the issues that slow you down later. Reviews every branch and pull request for bugs, maintainability issues, and technical debt across 45+ languages.
  • Gives the same answer every time. The same code gets the same findings, so results are explainable and repeatable for human and AI-written code.
  • Keeps feedback inside your workflow. Findings show up in your IDE, agent session, and pull request, so nobody switches tools to see them.
  • Moves from finding to fixing. AI CodeFix suggests a fix in the IDE or PR, and the Remediation Agent opens pull requests that are verified before you see them.
Learn more

Find vulnerabilities while the code is still being written.

  • Catches the vulnerabilities attackers use. SAST and taint analysis trace untrusted input across files and functions to find injection flaws, with fewer false positives.
  • Stops leaked credentials before commit. Secrets detection flags API keys, tokens, and passwords in the IDE, commits, and pull requests.
  • Covers mobile apps too. Android and iOS code is checked against the OWASP Mobile Top 10 before it reaches the app store.
  • Shows how secure you are. Security reports and a posture rating give leads one view across projects.
Learn more

Know what's in your software, and what it exposes.

  • Finds risky dependencies before they ship. SCA detects known vulnerabilities (CVEs) and malicious packages, with severity and exploit data to help you prioritize. Requires SonarQube Advanced Security.
  • Proves what you ship. License checks run on every pull request, and a software bill of materials (SBOM) is ready for auditors.
  • Catches cloud misconfigurations in review. IaC scanning checks Terraform, CloudFormation, Kubernetes, Docker, Helm, Ansible, and ARM for exposed services and insecure defaults.
Learn more

Define your architecture. See where code drifts from it.

  • Shows the architecture you actually have. SonarQube derives a living map from the code, with no diagramming by hand.
  • Holds code to the design you intended. Architects define the intended structure, and deviations are flagged in your standard quality gates.
  • Keeps AI-generated code in line. Humans and agents are checked against the same design, so a codebase stays modular as volume grows.
  • Fixes drift in the workflow. Architectural issues are tracked and managed alongside every other finding.
Learn more

Works where your team already works.

  • In your agent session. Claude Code, Cursor, GitHub Copilot CLI, Devin, Windsurf, Gemini CLI, and Antigravity CLI.
  • In your pull request. GitHub, GitLab, Bitbucket, and Azure DevOps show quality gate results right in the PR.
  • In your pipeline. Jenkins, CircleCI, Harness, Maven, CodeMagic, and Amazon CodeCatalyst.
  • In your editor. VS Code, Visual Studio, JetBrains IDEs, Eclipse, and Android Studio.
  • In your wider toolchain. Jira, Slack, Datadog, JFrog, Docker Scout, and more.
See all integrations

Governance and reporting

  • Governance and compliance: Provides centralized oversight and reporting necessary to enforce regulatory standards and corporate security policies across your organization.
  • Security reports: See where you stand against OWASP Top 10, OWASP Mobile Top 10, CWE Top 25, OWASP ASVS, OWASP MASVS, OWASP Top 10 for LLM Applications, PCI DSS, STIG ASD, and CASA, then download them as a PDF. Available starting in Enterprise Edition.
  • Project and portfolio management: High-level visibility and aggregated data across all projects, allowing leaders to monitor risk, track compliance, and ensure coding standards.
  • Reporting and analytics: Provides actionable insights and automated reports to monitor trends, evaluate risk, and drive data-backed decisions across the organization.
Learn more
Extend your SonarQube platform

Verification and governance for agentic software factories

Three agents that build on the same rules, quality gates, and evidence you already trust.

sonar-vortex-icon.svg

Sonar Vortex

Gives AI coding agents the context and constraints they need when they write, verifies their output in real time, and provides immediate feedback when something needs fixing.

Sonar Vortex

recurring.svg

SonarQube Remediation Agent

Autonomously clears tech debt from your existing codebase by opening verified, ready-to-merge pull requests. Each fix is scanned and verified by Sonar's engine before you see it.

SonarQube Remediation Agent

sonar-hunter-agent-icon.svg

SonarQube Hunter Agent

An AI-powered agent that runs a deep analysis of your SonarQube projects, hunting broken access control, business logic, and authentication flaws that traditional analysis was never built to catch.

SonarQube Hunter Agent

Security Capabilities

Developer-led code security

Empower developers with real-time, actionable guidance to detect and fix vulnerabilities as code is written and reviewed, directly in their workflow.

Static Application Security Testing (SAST)

Our SAST engine automatically finds critical vulnerabilities in your development workflow, stopping them before they reach production.

  • Detect critical vulnerabilities: Identifies OWASP Top 10 and beyond — injection, authentication flaws, XSS, and more — with high precision and low false-positive rates.
  • Broad language support: Covers the most popular programming languages, including Java, JavaScript, Python, C++, C#, and many more.
  • Seamless workflow integration: Get immediate feedback directly in your IDE and CI/CD pipeline without context switching.
  • Rapid remediation: Resolve issues faster with clear guidance and AI-powered CodeFix suggestions.
  • Customizable policies: Enforce your organization’s specific security standards by creating custom detection rules.
Learn more about SAST

Taint analysis

Our taint analysis engine tracks data flow to find and stop critical injection vulnerabilities.

  • Find critical injection flaws: Accurately detects a wide range of vulnerabilities, including SQL injection, Cross-site scripting (XSS), SSRF, and more.
  • Minimize false positives: Utilizes sophisticated cross-file and cross-function analysis to deliver highly accurate, actionable results.
  • Framework-aware intelligence: Understands the native security controls in popular frameworks, leading to smarter and more relevant findings.
Explore taint analysis

Secrets detection

SonarQube detects leaked code secrets throughout your development workflow, identifying them directly in the IDE and within your CI/CD pipeline.

  • Comprehensive coverage: Finds API keys, passwords, and security tokens with hundreds of patterns covering all popular cloud providers and services.
  • High-fidelity scanning: Goes beyond basic pattern matching, using a powerful combination of regular expressions and semantic analysis to minimize false positives.
  • Customizable rules: Easily define your own patterns to detect organization-specific secrets for internal applications and private services in the Enterprise Edition.
  • Shift-left detection: Get immediate feedback directly in your IDE, allowing you to remove secrets before they are ever committed to the repository.
Learn more about secrets detection

Infrastructure as Code (IaC) scanning

Find and fix Infrastructure as Code (IaC) misconfigurations before they reach production to secure your cloud.

  • Broad IaC coverage: Scans popular tools including Terraform, CloudFormation, Kubernetes, Azure Resource Manager (ARM), and Ansible.
  • Identify key risks: Catches critical security issues like overly permissive access, publicly exposed services, and insecure defaults.
  • Actionable remediation: Get clear, precise results with step-by-step guidance to help you fix misconfigurations quickly and efficiently.
Learn about IaC scanning

Advanced SAST

Advanced SAST helps identify deeper and more complex vulnerabilities due to the interaction of your application code with third-party (open-source) code.

  • Dependency-aware scanning: Traces data flows not just through your application, but deep into the third-party libraries it relies on.
  • Uncover hidden vulnerabilities: Cross-file taint analysis that goes deep into third-party libraries for detecting hard to find vulnerabilities.
  • Effortless and fast: Runs automatically with zero configuration and no performance overhead, delivering quick and accurate results.
  • Language support: Currently available for Java, C#, JavaScript, and TypeScript.
Discover Advanced SAST

Software Composition Analysis (SCA)

Secure your open-source dependencies by finding vulnerabilities, managing licenses, and inventorying your software supply chain.

  • Vulnerability detection: Automatically find, track, and prioritize known vulnerabilities (CVEs) within your third-party components.
  • License compliance: Check for and flag incompatible or unapproved licenses in your dependencies to avoid legal and compliance risks.
  • Software bill of materials (SBOM): Generate a complete and accurate inventory of every component in your software for essential transparency and security audits.
Learn more about SCA
Languages

Your programming language, covered

Coverage for dozens of the most popular languages, frameworks and IaC platforms.

What Sonar users are saying

Trusted by 7M+ developers

We’re not just keeping quality high; we’re actually able to go faster… AI makes it easier to deliver velocity, but only if you provide the right context from tools like SonarQube.
Stephen Byrnes Distinguished Engineer Cisco
Overall I love the tool and I’m excited to dial up our usage, particularly as tools like Claude Code gain much wider adoption and we may be forced to reckon with the quality of what we’re creating.
Eliott Weiser Sr. Engineering Manager Sirius XM
With over 2,000 repos, manual enforcement isn’t feasible… now, every pull request automatically goes through quality gate checks, security analysis, and secret detection.
Pravien Sammandhankumar Head of DevOps Freshworks
The central verification platform is how we… avoid that trade-off [between speed and safety]. It keeps the checks early. It keeps them consistent, creates visibility so the devs can move quickly.
Abhay Sharma Head of Cloud and DevOps Australian Unity
As we move toward using AI tooling for code generation, it is reassuring to know that all our code is checked and scanned to provide a sanity check on the quantity of code being produced.
Sarah Burgess Lead Product Manager, Security Xero

Gartner® names Sonar a Magic Quadrant™ Leader

AI is generating code faster than teams can govern it. Sonar was named a Leader, and placed highest on Ability to Execute. We built the verification layer the AI development cycle actually needs.

Download the report
A G2 Leader for 6 years running
4.6 / 5
Sonarqube

Frequently asked questions

What is SonarQube?

SonarQube is the platform that verifies code, whether a developer or an AI agent wrote it, before it ships.

It checks every change for bugs, vulnerabilities, and maintainability issues, applies your quality gates, and records the result. Trusted by over 7M developers and 75% of the Fortune 100, it runs in your IDE, in coding agents, in pull requests, and in your CI/CD pipeline, on SonarQube Cloud or your own Server.

How does SonarQube verify AI-generated code?

It checks AI-generated code the same way it checks developer-written code: independently, and against the same rules and quality gates.

Agents get your standards and real-time feedback while they write, through the SonarQube MCP Server, CLI, and agent plugins. Every pull request is then reviewed before merge, so code written by vibe coding or by an agent has to pass the same bar as everything else. Each result is recorded and tied to the commit.

How do coding agents work with SonarQube?

SonarQube connects to agents in three ways: the MCP Server, the SonarQube CLI, and agent plugins for tools such as Claude Code, Cursor, and GitHub Copilot CLI.

Agents use them to get your standards, check their own output, and fix issues inside the session. Beyond that, the Remediation Agent opens verified, ready-to-merge pull requests for your existing technical debt, and the Hunter Agent looks for broken access control, business logic, and authentication flaws.

What is Sonar Vortex?

Sonar Vortex gives AI coding agents the context and constraints they need while they write code.

It verifies their output in real time and gives immediate feedback when something needs fixing, so agent-written code is checked before it ever reaches a pull request.

What is SonarQube Hunter Agent?

SonarQube Hunter Agent is an AI-powered agent that runs a deep analysis of your SonarQube projects.

It hunts for broken access control, business logic, and authentication flaws that traditional analysis was never built to catch.

What is SonarQube Remediation Agent?

SonarQube Remediation Agent autonomously clears technical debt from your existing codebase by opening verified, ready-to-merge pull requests.

Each fix is scanned and verified by Sonar's engine before you see it, so reviewers approve changes that already work.

Should I choose SonarQube Cloud or Server?

Choose Cloud if you want verification running quickly with Sonar hosting and maintaining it. Choose Server if code and findings must stay inside your perimeter, including air-gapped environments.

Both give you the same rules, quality gates, and evidence, so you can decide on deployment needs alone.

Is SonarQube a SAST tool?

Yes. SonarQube includes SAST, and goes beyond it.

Its SAST and taint analysis find injection flaws and other vulnerabilities across files and functions. It also covers secrets detection, infrastructure as code scanning, and, with SonarQube Advanced Security, software composition analysis (SCA) and Advanced SAST for third-party code.

How does SonarQube keep standards consistent across teams?

Quality gates and shared rules apply the same standards everywhere code is written.

Connected mode synchronizes rules and settings between the IDE and your CI/CD pipeline, so developers see what the pipeline will enforce before they commit. Portfolio-wide dashboards show how every team is doing.

How does SonarQube work with pull requests and CI/CD?

SonarQube analyzes every branch and pull request and shows the quality gate result in the PR.

It works with GitHub, GitLab, Bitbucket, and Azure DevOps, and with build tools such as Jenkins, CircleCI, and Harness. A failing gate can block the merge, so problems stop at the pull request, not in production.

Is there a free option?

Yes. SonarQube Community Build and the free tier of SonarQube Cloud let you start at no cost, and SonarQube for IDE is free to install.

Paid plans add enterprise capabilities such as advanced security analysis, governance, reporting, and support. Compare plans on the pricing page.

Which programming languages does SonarQube support?

SonarQube supports more than 45 languages, frameworks, and Infrastructure-as-Code platforms.

They include Java, JavaScript, TypeScript, Python, C#, C++, PHP, Kotlin, and many more. See the Languages section above for the full list.

What reports does SonarQube provide for audits?

SonarQube Enterprise Edition and above includes security reports that show where you stand against OWASP Top 10, CWE Top 25, PCI DSS, STIG ASD, OWASP ASVS, OWASP Mobile Top 10, and other standards.

You can download them as a PDF. Quality gate results are time-stamped and tied to the commit, so you can show why a change shipped.

What is SonarQube AI CodeFix, and how do I enable it?

AI CodeFix uses large language models to suggest a fix for an issue SonarQube finds, for both AI-generated and developer-written code.

You review the suggestion in your IDE with SonarQube for IDE connected to SonarQube Cloud or Server. For backlog cleanup at volume, the Remediation Agent opens verified pull requests so no one has to work through issues by hand.

Build code confidence into your software factory

Start free trialCompare plans