SonarQube

SonarQube is the platform that verifies code, whether a developer or an AI agent wrote it, before it ships. It checks every change for bugs, vulnerabilities and maintainability issues, applies quality gates and records the result.

Choose Cloud if you want verification running quickly with Sonar hosting and maintaining it. Choose Server if code and findings must stay inside your perimeter, including air-gapped environments.

Yes. SonarQube includes SAST and taint analysis that find injection flaws and other vulnerabilities across files and functions, plus secrets detection and infrastructure-as-code scanning. Advanced Security adds SCA and Advanced SAST for third-party code.

Yes. SonarQube Community Build and the free tier of SonarQube Cloud let you start at no cost, and SonarQube for IDE is free to install. Paid plans add enterprise capabilities such as advanced security analysis, governance, reporting and support.

SonarQube supports more than 45 languages, frameworks and Infrastructure-as-Code platforms, including Java, JavaScript, TypeScript, Python, C#, C++, PHP and Kotlin.

SonarQube analyzes every branch and pull request and shows the quality gate result in the PR. It works with GitHub, GitLab, Bitbucket and Azure DevOps, and with build tools such as Jenkins, CircleCI and Harness; a failing gate can block the merge.

It checks AI-generated code the same way it checks developer-written code: independently, against the same rules and quality gates. Agents get standards and real-time feedback through the MCP Server, CLI and agent plugins, and every pull request is reviewed before merge.

AI CodeFix uses large language models to suggest a fix for an issue SonarQube finds, for both AI-generated and developer-written code. You review the suggestion in your IDE with SonarQube for IDE connected to SonarQube Cloud or Server.