SonarQube
Deterministic static analysis platform (Server and Cloud) with PR decoration and LLM-generated AI CodeFix suggestions.
Visit Website [↗][ Facts ]
- Category
- Code Quality
- Open source
- Yes (LGPL-3.0 (Community Build); commercial editions proprietary)
- Pricing
- Cloud: free tier up to 50k LoC private, Team from $34/mo (100k LoC), Enterprise custom. Server: Community Build free; Developer/Enterprise/Data Center priced per instance/yr by LoC (quote-based) source
- Self-hosted
- Yes — full stack — SonarQube Server is self-managed, incl. the free LGPL Community Build; AI CodeFix can use a fully self-hosted LLM gateway.
- Platforms
- github, gitlab, bitbucket, azure-devops
- Model control
- AI CodeFix: Sonar-hosted GPT-5.1/GPT-4o, your Azure OpenAI/Bedrock, or a self-hosted OpenAI-compatible gateway; core analysis has no LLM
- Last verified
- 2026-08-11
[ Against the 9 Standards ]
Based on public documentation as of 2026-08-11. ✓ documented · ~ partial · ✗ not offered · ? unknown. Methodology on the about page.
Whole-project analysis with cross-file taint in paid editions; no multi-repo or ticket context.
Deterministic rule engine with per-project quality profiles and gates; flags only configured rule violations.
Same rules locally via SonarQube for IDE (SonarLint) connected mode and in CI with PR decoration.
No issue-tracker or requirements integration; validates code against static rules only.
Issues can be accepted or marked false-positive individually; no generalized learning from team feedback.
AI CodeFix supports customer-managed or self-hosted LLMs; commercial pricing is LoC-based quotes.
AI CodeFix generates fix suggestions for supported rules and languages; many findings remain explain-only.
Tracks code quality metrics and quality-gate trends; no DORA or review-ROI attribution.
[ In Our Coverage ]
Evaluating SonarQube?
Run it through the two-week trial protocol before you commit.