# SonarQube — Automated code review and verification for AI-generated and human-written code, in IDE, CI and cloud. > Source: The Agents Index — https://theagentsindex.com/sonarqube (structured, researched, re-verified) SonarQube is Sonar's code verification platform that analyses every pull request for bugs, vulnerabilities, secrets and technical debt across dozens of languages. It adds agents that give coding agents context, hunt logic flaws and open verified fix pull requests. **Not for:** Teams that want an agent to write features or merge on its own. It reviews code and fixes only what it has flagged. **Best for:** Engineering teams reviewing AI-generated code before it merges | Fact | Value | | --- | --- | | Website | https://sonarsource.com | | Category | AI code review | | API | Yes | | Open source | Partly | | Price | Free | | Price source | https://www.sonarsource.com/plans-and-pricing/ | | Price checked | 24 October 2026 | | MCP server | Yes | | Self-host | Yes | | Facts | 35 facts from 9 sources | | Facts checked | 24 October 2026 | Screenshot of SonarQube: https://theagentsindex.com/img/1920/screenshots/sonarqube.webp, captured 26 October 2026 **What we checked** - Pages last read: 24 October 2026 - Facts checked: 35 facts (From 9 sources) - AI answers: Named in 1 of 151 (Our October check) ## What we checked on SonarQube ### What it does **Writes code** · Partly — It generates code only as targeted remediation of a finding it already raised, not as a feature authored from a free-form description. > The agent reads your project context, active quality profile, and the specific rule violation to generate a targeted fix. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · How it works, step 2 Generate, checked 24 October 2026 **Debugs and fixes** · Yes — Gitar AI Code Review diagnoses failing CI and writes the fix, iterating until the pipeline passes, and the Remediation Agent fixes issues it finds. > Inspects every PR, answers questions in context, and applies fixes to keep reviews moving. Automatically diagnoses CI failures and enforces review policies you write in plain language. > — https://www.sonarsource.com/ · Explore our offerings, Gitar AI Code Review card, checked 24 October 2026 **Reviews code** · Yes — Reviewing diffs others wrote is the core job: every pull request is analysed and the quality gate result is posted back as a comment. > Reviews every pull request in full context, writes the fix, and iterates until CI passes. Unlimited public and private repos. > — https://www.sonarsource.com/plans-and-pricing/ · Team plan card, Gitar AI Code Review row, checked 24 October 2026 **Whole-codebase work** · Yes — The Remediation Agent takes whole categories of debt across an existing codebase in parallel rather than one file or one diff at a time. > The Remediation Agent works through hundreds of issues in parallel across your existing codebase — the debt that accumulated before today's commit. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · The difference, 'Built for backlogs, not just diffs', checked 24 October 2026 **Ships it** · No — It stops at the pull request by design: a human reviews, approves and merges, and the vendor states nothing lands without sign-off. > Only verified fixes become pull requests. Your developers review, approve, and merge through their normal workflow. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · How it works, step 4 Deliver, checked 24 October 2026 ### How much it does unattended **Runs autonomously** · Yes — Once issues are assigned or scheduled the agent runs unattended with no prompting, generating and verifying fixes by itself. > No chat, no prompt engineering. Issues are assigned or scheduled, and the agent works autonomously from there. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · The difference, 'No prompting required', checked 24 October 2026 **Agent permissions** · Partly — The agent may read the repo, patch in a sandbox and open pull requests, but it is documented as unable to merge anything itself. > Nothing enters your codebase without your sign-off. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · Hero paragraph, checked 24 October 2026 ### Which models it runs on **Claude** · Yes — Claude is one of the two named models the Remediation Agent can run on under its bring-your-own-LLM option. > Bring your own LLM: GPT-5.5 or Claude Opus 4.6. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · How it works, step 2 Generate, checked 24 October 2026 **GPT** · Yes — GPT is named alongside Claude as a model the Remediation Agent will generate fixes with when you bring your own LLM. > Bring your own LLM: GPT-5.5 or Claude Opus 4.6. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · How it works, step 2 Generate, checked 24 October 2026 **Model choice** · Partly — You can supply your own LLM keys on the Enterprise plan, but the choice the vendor documents is limited to two named commercial models. > 45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs > — https://www.sonarsource.com/plans-and-pricing/ · Enterprise card, SonarQube Enterprise plan bullet, checked 24 October 2026 ### Where you use it **In your editor** · Yes — A free IDE extension analyses as you type and syncs rules from the server, covering VS Code, Visual Studio, JetBrains, Eclipse, Cursor and Windsurf. > SonarQube for IDE catches coding issues on the fly in your dev environment, with extensions for Cursor, Windsurf, VS Code, Visual Studio, JetBrains and Eclipse. > — https://www.sonarsource.com/open-source-editions/sonarqube-community-edition/ · Full DevOps integration, IDE integration card, checked 24 October 2026 **On the command line** · Yes — A command-line scanner runs the same analysis from a terminal, a pipeline or a coding agent without the web UI. > Run analysis from any terminal, CI pipeline, or coding agent. > — https://www.sonarsource.com/plans-and-pricing/ · Works with your coding agents, SonarQube CLI card, checked 24 October 2026 **In your pipeline** · Yes — It gates CI pipelines and decorates pull requests on GitHub, GitLab, Bitbucket and Azure DevOps on the entry self-hosted edition too. > Auto-trigger code reviews and block substandard code in CI/CD pipelines > — https://www.sonarsource.com/plans-and-pricing/sonarqube/ · Compare SonarQube Server plans, Analysis section row, checked 24 October 2026 **In a browser** · Yes — SonarQube Cloud is a hosted SaaS dashboard requiring no infrastructure, with projects auto-provisioned from the connected repo platform. > SonarQube Cloud is a SaaS solution deployed as a multi-tenant, shared-resource architecture that is hosted in Amazon Web Services' (AWS) world-class data centers. > — https://www.sonarsource.com/trust-center/ · SonarQube Cloud, Hosting & resilience, checked 24 October 2026 ### Whose machine it runs on **Self-hosted** · Yes — SonarQube Server is the self-managed product, licensed per instance per year in Developer, Enterprise and Data Center editions. > Yes. If you prefer to manage your own infrastructure, SonarQube Server is our self-managed static analysis solution. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'Do you offer pricing for a self-hosted solution?', checked 24 October 2026 **Open source** · Partly — Only the Community Build and the MCP server are open source; the commercial Server editions and Cloud plans are not offered that way. > SonarQube Community Build provides workflow-integrated, automated code review for quality and security, supporting dozens of languages, frameworks, and cloud technologies. > — https://www.sonarsource.com/open-source-editions/sonarqube-community-edition/ · FREE & OPEN SOURCE EDITION hero, checked 24 October 2026 **Licence** · Partly — mixed: the vendor describes itself as open core, with a free open-source Community Build beside proprietary commercial editions and plans. > Anchored on our open core principle, we carry a commitment to transparency, security, and continuous improvement of our Open Source solution. > — https://www.sonarsource.com/company/about/ · COMMITMENT TO OPEN SOURCE, 'Open source DNA', checked 24 October 2026 **Open-source runtime** · Yes — The Community Build runs on your own machines with no vendor account, and the MCP server is free, open source and deployable as a local Docker container. > Open source and free. Bring analysis into any MCP-capable agent. > — https://www.sonarsource.com/plans-and-pricing/ · Works with your coding agents, SonarQube MCP Server card, checked 24 October 2026 **Runs in your cloud** · Yes — The self-managed Server edition is explicitly for buyers who want to run the analysis platform on infrastructure they own and control. > Yes. If you prefer to manage your own infrastructure, SonarQube Server is our self-managed static analysis solution. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'Do you offer pricing for a self-hosted solution?', checked 24 October 2026 ### Building with it **Tracing and evals** · Partly — Agent runs and findings are logged in the dashboard with traceability to the rule and analysis, but no run-level tracing or evaluation tooling is documented. > Every fix traces back to a verified Sonar finding, the rule it violated, and the analysis that confirmed the resolution. > — https://www.sonarsource.com/products/sonarqube/remediation-agent/ · Why Remediation Agent, 'Audit trail by default', checked 24 October 2026 ### What it costs to run **How it meters** · Yes — SonarQube bills by analysed private lines of code, Server by instance per year, and Gitar by user or by pull request on Enterprise. > You pay upfront for a maximum number of private lines of code to be analyzed in your organization. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'How does pricing work for private projects?', checked 24 October 2026 **Cost of one job** · Partly — The cheapest paid plan is $34 a month for up to 100k lines of code analysed; prices for larger increments are not published. > SonarQube plan pricing starts at $34 monthly for analysis of up to 100k LOC. Other LOC increments are available. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'How does pricing work for private projects?', checked 24 October 2026 **Free tier** · Yes — A no-card free tier analyses private projects up to 50k lines of code and never expires, with a 14-day trial of paid features. > SonarQube Team Plan, free for your private projects up to 50k LOC. No card, no expiry. > — https://www.sonarsource.com/plans-and-pricing/ · Developers card, Free forever, checked 24 October 2026 **API access** · Yes — A web server API is documented for programmatic calls and CI-triggered analysis, authenticated with revocable user tokens over TLS 1.2. > For Web Server API calls or source code analysis triggered from Continuous Integration services, only revocable user tokens are accepted. > — https://www.sonarsource.com/trust-center/ · SonarQube Cloud, Authentication, checked 24 October 2026 **MCP server** · Yes — A free open-source MCP server lets another agent query issues, quality gates and analyse snippets, either locally in Docker or via Cloud's embedded channel. > Our native MCP channel for SonarQube Cloud provides a zero-effort, out-of-the-box way to connect your AI tools to the code intelligence you trust. > — https://www.sonarsource.com/products/sonarqube/mcp-server/ · Bridge the gap between AI and quality, checked 24 October 2026 **Bring your own key** · Partly — Bring-your-own-key for the LLMs is listed as an Enterprise plan capability, so entry-tier buyers use Sonar's own inference. > 45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs > — https://www.sonarsource.com/plans-and-pricing/ · Enterprise card, SonarQube Enterprise plan bullet, checked 24 October 2026 ### Buying it for a team **A company can buy it** · Yes — A paid subscription creates a private organisation, and an Enterprise plan is sold through sales for teams over fifty developers. > Subscribing to a paid plan on SonarQube allows you to create a private organization containing private projects. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'How does pricing work for private projects?', checked 24 October 2026 **Seat model** · Partly — SonarQube itself is not sold per seat but per analysed lines of code; only Gitar AI Code Review carries a published per-user price. > $20 /user/mo, billed annually > — https://www.sonarsource.com/plans-and-pricing/ · Team plan card, Gitar AI Code Review price cell, checked 24 October 2026 **Pooled budget** · Partly — The line-of-code allowance is pooled: every private project in the organisation counts against one purchased maximum, not a per-user balance. > LOCs are computed by summing up the lines of code of each project analyzed in SonarQube. > — https://www.sonarsource.com/plans-and-pricing/ · FAQ, 'What is a Line of Code on SonarQube?', checked 24 October 2026 **Admin controls** · Yes — Admins constrain what passes through quality profiles and quality gates that fail pipelines, with rule priority on Enterprise. > Fail pipelines when the code quality and security doesn't meet your defined requirements and prevent issues from being merged or deployed. > — https://www.sonarsource.com/products/sonarqube/cloud/ · What is SonarQube Cloud?, 'Clear go/no-go Sonar Quality Gate', checked 24 October 2026 **Single sign-on** · Partly — SSO with SCIM provisioning is an Enterprise plan item; the entry Team plan authenticates through the connected DevOps platform instead. > 45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs > — https://www.sonarsource.com/plans-and-pricing/ · Enterprise card, SonarQube Enterprise plan bullet, checked 24 October 2026 ### What happens to your code **Opt out of training** · Partly — Zero data retention with the LLMs is advertised only on the Enterprise plan, so cheaper plans do not get that guarantee. > 45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs > — https://www.sonarsource.com/plans-and-pricing/ · Enterprise card, SonarQube Enterprise plan bullet, checked 24 October 2026 **Data residency** · Partly — Cloud hosting is EU (Frankfurt) by default, with US (Northern Virginia) available only to some customers; self-hosting keeps data wherever you run it. > SonarQube Cloud offers EU-based hosting (sonarcloud.io) by default and has US-based hosting (sonarqube.us) available for some customers. > — https://www.sonarsource.com/trust-center/ · SonarQube Cloud, Hosting & resilience, checked 24 October 2026 **Getting out** · Partly — You can delete projects and source code at any time and cancel without commitment, but no data export path is documented on the pages read. > Furthermore, customers can delete their projects, and therefore, source code and issue reports from our system at any time. > — https://www.sonarsource.com/trust-center/ · SonarQube Cloud, Data security, checked 24 October 2026 **Certifications** · Yes — ISO 27001:2022 certification and a SOC 2 Type II attestation cover all products, with the report available under NDA. > At the company level, Sonar maintains both ISO 27001:2022 certification and SOC 2 Type II attestation for all products and services. > — https://www.sonarsource.com/trust-center/ · Trust Center intro paragraph, checked 24 October 2026 ## SonarQube price and terms **Terms** - Free plan: Yes — Free tier for private projects up to 50k lines of code, no card and no expiry — public OSI-licensed repos get SonarQube for OSS and Gitar for OSS free forever; a separate 14-day trial covers paid features. **What needs a higher plan** - SonarQube Enterprise: Model choice, Bring your own key, Single sign-on, Opt out of training ## For AI agents - MCP server: Yes - API: Yes Read on https://www.sonarsource.com/plans-and-pricing/, 24 October 2026. ## SonarQube alternatives - [CodeRabbit](https://theagentsindex.com/coderabbit) · From $30 a seat a month: AI code review across pull requests, IDE and CLI, with agentic fixes, pre-merge checks and security review. - [Gemini Code Assist](https://theagentsindex.com/gemini-code-assist) · Price on request: Google's per-seat AI coding assistant and agent for IDEs, the terminal and GitHub pull requests. - [Greptile](https://theagentsindex.com/greptile) · Free plan, then $1 per credit: AI code review agents that review and test every pull request with full codebase context. - [Qodo](https://theagentsindex.com/qodo) · From $0.012 per credit: Agentic code review and governance platform for pull requests, IDEs and coding agents. 3 of the 4 publish a price. [All 4 alternatives](https://theagentsindex.com/sonarqube/alternatives/) ## Questions about SonarQube ### How much does SonarQube cost? SonarQube is free to use. From sonarsource.com/plans-and-pricing, checked 24 October 2026. ### Does SonarQube have an API or an MCP server? It has an API. It has an MCP server. ### Is SonarQube open source, and can you host it yourself? Part of it is open source. You can host it yourself. ### What have we checked on SonarQube? 35 facts, under these headings: What it does, how much it does unattended, which models it runs on, where you use it, whose machine it runs on, building with it, what it costs to run, buying it for a team, what happens to your code. ### How do we check SonarQube? We hold 35 facts on SonarQube, quoted from 9 pages. Facts and price last checked 24 October 2026. How we check every listing: https://theagentsindex.com/methodology/ ## Sources and changes Last changed 26 October 2026 **Sources on sonarsource.com** (9) - https://www.sonarsource.com/plans-and-pricing/, read 24 October 2026 - https://www.sonarsource.com/products/sonarqube/remediation-agent/, read 24 October 2026 - https://www.sonarsource.com/trust-center/, read 24 October 2026 - https://www.sonarsource.com/open-source-editions/sonarqube-community-edition/, read 24 October 2026 - https://www.sonarsource.com/, read 24 October 2026 - https://www.sonarsource.com/company/about/, read 24 October 2026 - https://www.sonarsource.com/plans-and-pricing/sonarqube/, read 24 October 2026 - https://www.sonarsource.com/products/sonarqube/cloud/, read 24 October 2026 - https://www.sonarsource.com/products/sonarqube/mcp-server/, read 24 October 2026 ## Is this yours? AI assistants like ChatGPT and Claude opened The Agents Index pages 2,746 times in September. Claim SonarQube: https://theagentsindex.com/claim/sonarqube Report an error if a fact is wrong: hello@theagentsindex.com, subject "Report an error: SonarQube (sonarqube)".