Issues fixed, not just found.
Remediation Agent fixes issues in your pull requests and existing backlog, then re-scans each fix with Sonar's analysis engine to validate. Only verified fixes become PRs. You review and merge — nothing enters your codebase without your sign-off.
57 String q = "SELECT * FROM users 58 WHERE id = " + userId; 59 stmt.execute(q); // taint
57 String q = "SELECT * FROM users 58 WHERE id = ?"; 59 ps.setInt(1, userId);
Why high-velocity teams choose the remediation agent
Stop letting pull requests become bottlenecks. Let the agent handle the cleanup so your engineers can focus on architecture and innovation.
Accelerate cycle time
Slash the 'Waiting for Review' tax. Turn red quality gates green in minutes, not hours, by letting the agent fix routine issues asynchronously.
Unmatched trust
Unlike generic AI, the Agent verifies every generated patch against the Sonar analysis engine. No hallucinations—only fixes that compile and pass.
Elevate code health
Fix the 'boring' stuff on demand. Tackle code smells and maintenance issues that tend to get deprioritized in human reviews — without waiting for a dedicated sprint to address them.
Seamless integration
Lives where you work. Integrated directly with GitHub Pull Requests and SonarQube Cloud Enterprise. No IDE plugins required.
Closed-loop verification
Most AI tools guess. We verify. Our agent doesn't just predict the next token; it solves for specific, mathematically defined rule violations across the Guide, Verify, and Solve stages.
Detect
Generate
Verify
Remediate
1. Detection
A PR is opened. SonarQube analysis runs and detects a failed quality gate with new issues.
2. Generation
The Agent (Claude Opus 4.6) reads the project context and active ruleset to generate a fix.
3. Verification
The LoopThe fix is applied to a sandbox. The Sonar engine re-runs analysis. Fail? Discard & retry.
4. Remediation
Only verified fixes are posted to the PR. The developer reviews and commits with one click.
Value for every role on your team
Reclaim your focus
Don't let quality gate failures break your flow. The Remediation Agent runs asynchronously in your Pull Requests, finding and fixing code smells and bugs while you keep coding. No more context switching—just review the verified fix and merge.
Standardize quality at scale
Operationalize your code quality and security standards across thousands of repositories without the friction. The Agent ensures your organization's quality profile is applied consistently — developers can remediate legacy debt and new issues on demand, keeping your code health metrics green without waiting on manual triage.
Velocity without compromise
Eliminate the trade-off between speed and quality. By removing the manual effort from the 'fix' phase of the development loop, you reduce cycle time, lower change failure rates, and free up your senior engineers to focus on innovation rather than maintenance.
Self-healing application securit
Shift from detection to remediation. When a vulnerability or hotspot is detected, developers can trigger the Agent to propose a verified, non-hallucinated patch — drastically reducing Mean Time to Remediate (MTTR) and helping secure your software supply chain.
Our differentiation
Closed-loop verification
We don’t just generate fixes; we validate them. Every proposed patch is run against the Sonar analysis engine in a sandbox environment. If it fails the quality gate or introduces new issues, it is rejected before it ever reaches your Pull Request.
Deep analysis context
Generic coding assistants only see the file active in your IDE. The Remediation Agent leverages over 16+ years of code analysis expertise, understanding the full cross-file context, taint analysis paths, and your organization’s specific quality profiles.
One-action workflow
No chatting, no prompting. When a PR fails its quality gate, a developer triggers the agent with a single action. From there it works autonomously — analysing the failing issues, generating a fix, verifying it against Sonar’s own engine, and opening a pull request.
SWE-Bench
The Remediation Agent is built on Sonar Foundation Agent — ranked #1 on SWE-Bench, the industry benchmark for AI agents solving real-world software engineering problems.
Frequently asked questions
No. Unlike a chatbot, you don't prompt it or have a conversation with it. When a PR fails its quality gate, a developer triggers the agent with a single action — from there, it autonomously analyses the issues, generates a fix, verifies it against Sonar's own engine, and opens a pull request. Same with backlog: select the issues, assign them to the agent, and it handles the rest. The interaction is one action, not a back-and-forth.
Currently, the agent supports Java, JavaScript, TypeScript, and Python. These cover the highest volume of modern web and backend development.
It's our secret sauce: 1) LLM proposes a patch. 2) We apply it to a sandbox. 3) We run the full SonarQube analysis. 4) If the issue is gone and no new bugs are introduced, we post it to the PR.
Yes. We have a Zero Data Retention policy. Code snippets sent to the LLM (Claude Opus 4.6) are processed for the fix and immediately discarded. Anthropic does not train on your code.