home of {}
Catch the bug right where it starts.
With static code analysis and independent verification, we help make code written by people and by AI secure.
Let's talk about your projectScroll to explore
Selected service
Implementation
Installation on your own infrastructure, CI/CD and DevOps integration, Quality Gates.
SonarQube Server
self-managed
SonarQube Cloud
SaaS
SonarQube for IDE
formerly SonarLint
About SonarQube
What does
SonarQube do?
SonarQube is a static code analysis platform: it examines source code without running it and shows bugs, vulnerabilities and maintainability issues on every change. It applies the same standard to code written by people and by AI.
It is not an after-the-fact audit but part of the development workflow: from the developer's machine through pull requests and CI to release, and the Quality Gate decides whether the code can move on.
Where does it fit in?
-
01 · IDE
2 new issues in this fileWhile coding
SonarQube for IDE flags issues as you type in VS Code, JetBrains IDEs, Visual Studio or Eclipse.
-
02 · Pull request
Comment on the pull requestIn pull requests
Analysis results appear directly in GitHub, GitLab, Azure DevOps or Bitbucket pull requests.
-
03 · CI/CD
New code: 0 new issuesOn every build
Analysis runs on the whole codebase on every build; results for new code are shown separately, and the Quality Gate sets its conditions on new code (Clean as You Code).
-
04 · Quality Gate
Quality Gate: PassedAt the gate
If new code does not meet the defined conditions, the gate stops the merge or the release.
What does it find?
A few examples of what SonarQube flags before it reaches production.
- Bug
Bugs that cause incorrect behaviour at runtime
if (user = null) { … } - Vulnerability
Vulnerabilities: SQL injection, XSS, path traversal
"SELECT … WHERE id=" + id - Dependency
Vulnerable or malicious dependencies (Advanced Security)
"lodash": "4.17.15" - Secret
Hard-coded passwords, keys and tokens
AWS_KEY = "AKIA4XK…" - Code smell
Maintainability issues and technical debt
function process() { /* 340 lines */ } - Metrics
Test coverage and code duplication
coverage 62% · duplication 4.1%
Which edition do you need?
SonarQube Server comes in three editions (Developer, Enterprise, Data Center); the free, open-source SonarQube Community Build is a separate product. Licences are per instance, per year, based on lines of code (LOC): the sum of the largest branch or pull request of each project.
| Feature | Community Build | Developer | Enterprise | Data Center |
|---|---|---|---|---|
| Price | Free, open source | Annual licence, by LOC | Annual licence, by LOC | Annual licence, by LOC |
| Recommended for | Small teams, evaluation | 100K+ lines of code | 1M+ lines of code | Large, critical environments |
| Languages | 18 (+ secrets detection) | 40 (+ C, C++, Objective-C, Swift, ABAP, PL/SQL, T-SQL…) | 48 (+ COBOL, Apex, PL/I, RPG, JCL, VB6…) | 48 |
| Branch and pull request analysis | — | |||
| Taint analysis (injection vulnerabilities) | — | |||
| Secrets detection | ✓ + custom patterns | ✓ + custom patterns | ||
| AI Code Assurance | — | |||
| AI CodeFix | — | — | ||
| Portfolios, executive and compliance reports (OWASP, CWE, PCI DSS, CRA…) | — | — | ||
| Advanced Security (SCA, SBOM) | — | — | Add-on | Add-on |
| High availability, horizontal scaling | — | — | — |
As of November 2026, based on Sonar's public product pages. Sonar does not publish prices: ask us for a quote and we will help you choose the right edition.
Request a quoteThe layers beneath your code
Your own code is only the top layer. Beneath it are the libraries you pull in and their transitive dependencies. SonarQube Advanced Security, a paid add-on from Enterprise edition, makes this layer visible.
SCA – dependency analysis
Known vulnerabilities in direct and transitive dependencies, malicious packages and licences that break your policy. Reachability analysis (for Java, Kotlin, Python, C# and VB.NET) shows whether your code actually calls the vulnerable function.
SBOM – software bill of materials
Export of the full dependency inventory in CycloneDX or SPDX format, for example for DORA or CRA record-keeping.
Advanced SAST
Extends the analysis to the code of open-source dependencies and examines how your own code and third-party code interact. Languages: JavaScript/TypeScript, Java, C#/.NET.
Your source code stays in-house
In the default local-parsing mode, manifest and lock files are processed by your own SonarQube Server and only vulnerability and licence data lookups go to Sonar. In the optional cloud mode the manifest and lock files are sent to Sonar, but never source code. Long-lived branches are re-analysed automatically for new dependency risks: daily by default, or weekly, or switched off.
AI in SonarQube – on an independent foundation
SonarQube Server 2026.5 offers the following AI features, each at a different point of the development workflow.
- 01 Coding
- 02 Fixing in the IDE
- 03 Pull request
- 04 Main branch and backlog
01 · Coding
Sonar Vortex
Gives the AI agent project context before it writes and verifies the result afterwards.
01 · Coding
MCP Server
Connects AI agents to SonarQube; can run in read-only mode.
02 · Fixing in the IDE
AI CodeFix
Suggests a fix for an issue. The model is configurable, including your own model running offline.
03 · Pull request
AI Code Assurance
Applies a Quality Gate tailored to AI code to projects marked as containing AI-generated code.
04 · Main branch and backlog
Hunter Agent
Hunts for business-logic and authorisation flaws that rule-based analysis cannot see.
04 · Main branch and backlog
Remediation Agent
Fixes issues and opens a pull request; a human decides whether to merge.
The foundation: SonarQube's deterministic analysis
Rule-based, repeatable and independent of whoever wrote the code. The AI tools build on it rather than replace it.
Tools marked as separate subscriptions are available on top of Enterprise or Data Center edition and run on your own infrastructure. While running, Hunter Agent and Remediation Agent send code and issue data to the configured LLM provider.
What it looks like in practice
Screenshots from our own SonarQube Server 2026.5 instance, on real projects. Project names are blurred.
Project overview
The state of the project at a glance: Quality Gate, AI Code Assurance, vulnerabilities, bugs, maintainability, duplication and dependency risks.
Right where developers work
SonarQube applies the same standard at every point of development: in the editor, in the AI agent and in the pull request.
While coding
IDEs
SonarQube for IDE (formerly SonarLint) flags issues as you type; in connected mode it uses the same rules as the server.
-
VS Code -
JetBrains -
Visual Studio -
Eclipse -
Windsurf - + and many more
AI agents
MCP Server and Sonar Vortex
AI coding agents write with SonarQube's analysis at hand and check their own work against it.
-
Claude Code -
Cursor -
Codex -
GitHub Copilot -
Antigravity -
Devin
Pull request and build
DevOps platforms and CI
Results appear in the pull request, and the Quality Gate stops code that does not meet the bar.
-
GitHub -
GitLab -
Azure DevOps -
Bitbucket -
Jenkins - + and many more
Benefits that matter
Security & Analysis
Development & Efficiency
Szitár-Net Kft. is an official Silver partner of SonarSource SA in Hungary.
Knowledge base
Latest articles
What makes SonarQube special
40+ languages, frameworks and IaC platforms
Fast analysis
Shorter development cycles
More effective code review for better work
Cloud DevOps platform integration
Developers in focus!
cleaner code
less maintenance
less coding
more innovation
lower risk
stronger reputation
