SonarQube
Industry-standard static code analysis now with AI CodeFix and AI Code Assurance.
About
SonarQube is the industry default for static code analysis, with Sonar reporting over 7 million developers and 22,000+ customers including Nvidia, ServiceNow, Booking.com, Goldman Sachs, and Ford. It supports 40+ programming languages, frameworks, and IaC technologies across three deployment shapes: SonarQube Cloud (SaaS), SonarQube Server (self-managed, with an air-gapped option), and SonarQube for IDE (in-editor scanning via SonarLint).
In the AI era SonarQube has repositioned around code verification with AI CodeFix, which uses an LLM (Anthropic Claude Sonnet 4 recommended, OpenAI GPT-5.1 or your own Azure OpenAI deployment as alternatives) to propose concrete one-click fixes for flagged issues, covering Java, JavaScript, TypeScript, Python, HTML, CSS, C#, and C++. AI Code Assurance lets teams label projects as AI-generated and apply a stricter quality gate before changes ship, with audit trails and badges. The 2026.2 release expanded AI CodeFix coverage toward autofixes for up to 70% of issue types in supported languages.
Limitation: AI CodeFix is only available on paid tiers (Cloud Team/Enterprise plans, Server Enterprise/Data Center editions), and sending code to an LLM requires trust in the provider's zero-retention policies. Self-hosted LLM options exist for air-gapped environments but need your own infrastructure.
What it can do
- Static analysis across 40+ languages with quality gates
- AI CodeFix one-click LLM-generated fixes for flagged issues
- AI Code Assurance quality gates for AI-generated code
- Self-managed server with air-gapped deployment option
Setup
Use SonarQube Cloud (sign up) or deploy SonarQube Server self-managed; connect via CI scanner or SonarLint IDE extension.
Prerequisites
A code repository; for AI CodeFix, a Team/Enterprise Cloud plan or Enterprise/Data Center Server edition.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 59; Trending score 90/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.