What we checked on SonarQube
Writes code
It generates code only as targeted remediation of a finding it already raised, not as a feature authored from a free-form description.
The agent reads your project context, active quality profile, and the specific rule violation to generate a targeted fix.
Debugs and fixes
Gitar AI Code Review diagnoses failing CI and writes the fix, iterating until the pipeline passes, and the Remediation Agent fixes issues it finds.
Inspects every PR, answers questions in context, and applies fixes to keep reviews moving. Automatically diagnoses CI failures and enforces review…
sonarsource.comChecked
Reviews code
Reviewing diffs others wrote is the core job: every pull request is analysed and the quality gate result is posted back as a comment.
Reviews every pull request in full context, writes the fix, and iterates until CI passes. Unlimited public and private repos.
Whole-codebase work
The Remediation Agent takes whole categories of debt across an existing codebase in parallel rather than one file or one diff at a time.
The Remediation Agent works through hundreds of issues in parallel across your existing codebase — the debt that accumulated before today's commit.
Ships it
It stops at the pull request by design: a human reviews, approves and merges, and the vendor states nothing lands without sign-off.
Only verified fixes become pull requests. Your developers review, approve, and merge through their normal workflow.
Runs autonomously
Once issues are assigned or scheduled the agent runs unattended with no prompting, generating and verifying fixes by itself.
No chat, no prompt engineering. Issues are assigned or scheduled, and the agent works autonomously from there.
Agent permissions
The agent may read the repo, patch in a sandbox and open pull requests, but it is documented as unable to merge anything itself.
Nothing enters your codebase without your sign-off.
Claude
Claude is one of the two named models the Remediation Agent can run on under its bring-your-own-LLM option.
Bring your own LLM: GPT-5.5 or Claude Opus 4.6.
GPT
GPT is named alongside Claude as a model the Remediation Agent will generate fixes with when you bring your own LLM.
On the page: How it works, step 2 Generate
Model choice
You can supply your own LLM keys on the Enterprise plan, but the choice the vendor documents is limited to two named commercial models.
45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs
In your editor
A free IDE extension analyses as you type and syncs rules from the server, covering VS Code, Visual Studio, JetBrains, Eclipse, Cursor and Windsurf.
SonarQube for IDE catches coding issues on the fly in your dev environment, with extensions for Cursor, Windsurf, VS Code, Visual Studio, JetBrains…
On the command line
A command-line scanner runs the same analysis from a terminal, a pipeline or a coding agent without the web UI.
Run analysis from any terminal, CI pipeline, or coding agent.
In your pipeline
It gates CI pipelines and decorates pull requests on GitHub, GitLab, Bitbucket and Azure DevOps on the entry self-hosted edition too.
Auto-trigger code reviews and block substandard code in CI/CD pipelines
In a browser
SonarQube Cloud is a hosted SaaS dashboard requiring no infrastructure, with projects auto-provisioned from the connected repo platform.
SonarQube Cloud is a SaaS solution deployed as a multi-tenant, shared-resource architecture that is hosted in Amazon Web Services' (AWS) world-class…
sonarsource.com/trust-centerChecked
Self-hosted
SonarQube Server is the self-managed product, licensed per instance per year in Developer, Enterprise and Data Center editions.
Yes. If you prefer to manage your own infrastructure, SonarQube Server is our self-managed static analysis solution.
Open source
Only the Community Build and the MCP server are open source; the commercial Server editions and Cloud plans are not offered that way.
SonarQube Community Build provides workflow-integrated, automated code review for quality and security, supporting dozens of languages, frameworks,…
Licence
mixed: the vendor describes itself as open core, with a free open-source Community Build beside proprietary commercial editions and plans.
Anchored on our open core principle, we carry a commitment to transparency, security, and continuous improvement of our Open Source solution.
Open-source runtime
The Community Build runs on your own machines with no vendor account, and the MCP server is free, open source and deployable as a local Docker container.
Open source and free. Bring analysis into any MCP-capable agent.
Runs in your cloud
The self-managed Server edition is explicitly for buyers who want to run the analysis platform on infrastructure they own and control.
On the page: FAQ, 'Do you offer pricing for a self-hosted solution?'
Tracing and evals
Agent runs and findings are logged in the dashboard with traceability to the rule and analysis, but no run-level tracing or evaluation tooling is documented.
Every fix traces back to a verified Sonar finding, the rule it violated, and the analysis that confirmed the resolution.
How it meters
SonarQube bills by analysed private lines of code, Server by instance per year, and Gitar by user or by pull request on Enterprise.
You pay upfront for a maximum number of private lines of code to be analyzed in your organization.
Cost of one job
The cheapest paid plan is $34 a month for up to 100k lines of code analysed; prices for larger increments are not published.
SonarQube plan pricing starts at $34 monthly for analysis of up to 100k LOC. Other LOC increments are available.
Free tier
A no-card free tier analyses private projects up to 50k lines of code and never expires, with a 14-day trial of paid features.
SonarQube Team Plan, free for your private projects up to 50k LOC. No card, no expiry.
API access
A web server API is documented for programmatic calls and CI-triggered analysis, authenticated with revocable user tokens over TLS 1.2.
For Web Server API calls or source code analysis triggered from Continuous Integration services, only revocable user tokens are accepted.
sonarsource.com/trust-centerChecked
MCP server
A free open-source MCP server lets another agent query issues, quality gates and analyse snippets, either locally in Docker or via Cloud's embedded channel.
Our native MCP channel for SonarQube Cloud provides a zero-effort, out-of-the-box way to connect your AI tools to the code intelligence you trust.
Bring your own key
Bring-your-own-key for the LLMs is listed as an Enterprise plan capability, so entry-tier buyers use Sonar's own inference.
On the page: Enterprise card, SonarQube Enterprise plan bullet
A company can buy it
A paid subscription creates a private organisation, and an Enterprise plan is sold through sales for teams over fifty developers.
Subscribing to a paid plan on SonarQube allows you to create a private organization containing private projects.
Seat model
SonarQube itself is not sold per seat but per analysed lines of code; only Gitar AI Code Review carries a published per-user price.
$20 /user/mo, billed annually
Pooled budget
The line-of-code allowance is pooled: every private project in the organisation counts against one purchased maximum, not a per-user balance.
LOCs are computed by summing up the lines of code of each project analyzed in SonarQube.
Admin controls
Admins constrain what passes through quality profiles and quality gates that fail pipelines, with rule priority on Enterprise.
Fail pipelines when the code quality and security doesn't meet your defined requirements and prevent issues from being merged or deployed.
Single sign-on
SSO with SCIM provisioning is an Enterprise plan item; the entry Team plan authenticates through the connected DevOps platform instead.
On the page: Enterprise card, SonarQube Enterprise plan bullet
Opt out of training
Zero data retention with the LLMs is advertised only on the Enterprise plan, so cheaper plans do not get that guarantee.
On the page: Enterprise card, SonarQube Enterprise plan bullet
Data residency
Cloud hosting is EU (Frankfurt) by default, with US (Northern Virginia) available only to some customers; self-hosting keeps data wherever you run it.
SonarQube Cloud offers EU-based hosting (sonarcloud.io) by default and has US-based hosting (sonarqube.us) available for some customers.
sonarsource.com/trust-centerChecked
Getting out
You can delete projects and source code at any time and cancel without commitment, but no data export path is documented on the pages read.
Furthermore, customers can delete their projects, and therefore, source code and issue reports from our system at any time.
sonarsource.com/trust-centerChecked
Certifications
ISO 27001:2022 certification and a SOC 2 Type II attestation cover all products, with the report available under NDA.
At the company level, Sonar maintains both ISO 27001:2022 certification and SOC 2 Type II attestation for all products and services.
sonarsource.com/trust-centerChecked
SonarQube price and terms
Terms
- Free plan
- YesYesFree tier for private projects up to 50k lines of code, no card and no expiry
The terms in full
public OSI-licensed repos get SonarQube for OSS and Gitar for OSS free forever; a separate 14-day trial covers paid features.
What needs a higher plan
- SonarQube Enterprise
- Model choice, Bring your own key, Single sign-on, Opt out of training
For AI agents
- MCP server
- Yes
- API
- Yes
Where these prices come from
sonarsource.com/plans-and-pricing, checked
SonarQube alternatives
All 4 alternatives
Questions about SonarQube
- How much does SonarQube cost?
- SonarQube is free to use. From sonarsource.com/plans-and-pricing, checked 24 October 2026.
- Does SonarQube have an API or an MCP server?
- It has an API. It has an MCP server.
- Is SonarQube open source, and can you host it yourself?
- Part of it is open source. You can host it yourself.
- What have we checked on SonarQube?
- 35 facts, under these headings: What it does, how much it does unattended, which models it runs on, where you use it, whose machine it runs on, building with it, what it costs to run, buying it for a team, what happens to your code.
- How do we check SonarQube?
- We hold 35 facts on SonarQube, quoted from 9 pages. Facts and price last checked 24 October 2026.
Sources and changes
Last changed
Is this yours?
AI assistants like ChatGPT and Claude opened The Agents Index pages 2,746 times in September. Claiming is free. You get this page's reader numbers and the verified owner mark. You confirm it with an email at sonarsource.com.
Report an error if a fact is wrong.