SonarQube
Code quality and security analysis platform for 40+ languages, delivered as SonarQube Cloud SaaS or self-managed SonarQube Server.
Deployment
Cloud · Self-Hosted · Air-Gapped
Languages
41+
Pricing model
Per lines of code, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle SonarQube operates.
6 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | SonarQube for IDE gives real-time analysis with quick fixes; 25 languages, connected mode. |
| AI Agent Guardrails | Yes | MCP server plus Sonar Vortex context augmentation; Vortex needs Sonar Agent Essentials subscription. |
| Local Analysis (Pre-Commit) | Yes | SonarQube CLI analyzes local changes and staged files and runs 'sonar analyze secrets'. |
| Inline PR Comments | Yes | PR decoration in GitHub, GitLab, Bitbucket, Azure DevOps; Free limits PRs to main target branch. |
| Quality Gates (Merge Blocking) | Yes | Quality gates block PRs and branches via status checks; custom gates require Team or Enterprise. |
| Full Repo Scan | Yes | Full codebase analysis in CI/CD via SonarScanner CLI, Maven, Gradle, Python, .NET scanners. |
| Scheduled Rescans | Partial | Automatic Analysis re-runs on repository changes for GitHub and Azure DevOps; no scheduled rescan documented. |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
7 yes 1 partial 5 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Injection, arbitrary file read/write, access control, authentication, and cryptography rules. |
| Taint Analysis (Data-Flow) | Yes | Tracks data flow from untrusted sources to dangerous sinks; Advanced SAST sold separately. |
| Secrets Detection | Yes | Hardcoded credentials, API keys, tokens via SonarQube CLI and Cloud staged-file scanning. |
| Secrets Validation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SCA | Yes | SCA is a separate product subscription, available only to Team and Enterprise plans. |
| Reachability Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Malicious Package Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| License Compliance | Yes | License policy management and enforcement ships inside the separately subscribed SCA product. |
| SBOM Generation | Yes | SBOM export in standard formats is part of the separately subscribed SCA product. |
| IaC Scanning | Yes | Ansible, Azure Resource Manager, CloudFormation, Docker, Kubernetes/Helm, Terraform misconfiguration rules. |
| Container Scanning | Partial | Dockerfile analysis only; no container image or layer scanning documented. |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Code quality
6 yes 2 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | 5,000+ rules covering maintenance issues, poor practices, and suboptimal patterns. |
| Complexity Metrics | Yes | Complexity metrics reported alongside issue density and distribution measures. |
| Duplication Detection | Yes | Duplication detection and tracking reported as a first-class metric. |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | Yes | Coverage import for C/C++/Objective-C, Dart, .NET, Go, Java, JavaScript/TypeScript, PHP, Python. |
| Diff Coverage (New Code) | Partial | Configurable new-code definition drives gates on new code; coverage-on-new-code not explicitly documented. |
| Architecture Governance | Yes | Derived vs intended architecture, tangles, oversized components, wrong dependency and location issues. |
| Technical Debt Quantification | Yes | Technical debt calculation plus structural technical debt tracking from architecture analysis. |
| Behavioral Code Analysis | Partial | Velocity and burndown tracking in metrics; no code-hotspot or behavioral analytics documented. |
AI review & fixes
3 yes 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Gitar AI pull-request review is a separate Sonar product; bug classes it detects are unspecified. |
| PR Summaries & Walkthroughs | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Autofix Suggestions | Yes | AI CodeFix proposes LLM fixes for CRITICAL, HIGH, MEDIUM issues; Cloud Team/Enterprise, Server Enterprise/Data Center. |
| Autofix Pull Requests | Yes | Remediation Agent fixes backlog issues on GitHub and Azure DevOps; requires Sonar Agent Essentials. |
| AI Triage (False-Positive Filtering) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Rules & repo support
1 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Partial | Custom quality profiles configure language rule sets on Team and Enterprise; authoring new rules not documented. |
| Monorepo Support | Yes | Multi-project repository analysis with monorepo branch, PR, and scoped analysis. |
AI capabilities
7 yes
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | AI CodeFix is LLM-powered on Team and Enterprise; Gitar AI PR review sold as a separate product. |
| Bring Your Own Model | Yes | Azure OpenAI/AWS Bedrock/self-hosted gateway BYOK on Server Enterprise/Data Center only; Cloud has no BYOK option |
| MCP Server | Yes | SonarQube MCP Server for agent context; Vortex MCP integration tied to Sonar Agent Essentials. |
| AI Code Governance | Yes | Enterprise quality gate and quality profiles specifically govern agentic AI-generated code. |
| Conversational Review | Yes | Gitar (separate Sonar product) takes natural-language PR replies, e.g. 'gitar why was this file changed?' |
| Learning From Feedback | Yes | Gitar persists dismissed and resolved findings across review iterations, learning from developer replies. |
| Code Excluded From Training | Yes | Third-party LLM providers contractually barred from training on input data across all tiers; SonarSource excludes Enterprise/Server data. |
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Organization activity, change history, and access/permission modification logs. |
| SSO (SAML) | Yes | Multiple SSO providers and LDAP/Active Directory options, but Enterprise SSO is Enterprise-only. |
| Role-Based Access Control | Yes | Role-based access control and project-level permissions; permission templates need Team or Enterprise. |
| Compliance Reporting & Exports | Yes | PDF and interactive project/portfolio security reports, CRA reports, audit evidence export; portfolios are Team+. |
Certifications
SOC 2 (stated as 'SOC 2 compliance', type not specified)GDPR
Standards mapping
Cyber Resilience Act (CRA)MISRA (Enterprise quality profiles)
Integrations
10 yes
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub ActionsGitLab CI/CDBitbucket PipelinesCircleCIAmazon CodeCatalystAzure DevOps (Azure DevOps Extension)Any other CI via SonarScanner CLI, SonarScanner for Maven, Gradle, Python, or .NET
IDEs
IntelliJ IDEACLionWebStormPhpStormPyCharmRiderAndroid StudioRubyMineVisual StudioVS CodeEclipse
Issue trackers
JiraServiceNow
Chat & notifications
SlackEmail
Languages
Languages and frameworks named in SonarQube's documentation.
ApexABAPAnsibleAzure Resource ManagerCC++C#COBOLCloudFormationDartDockerFlexGitHub ActionsGoGroovyHTMLJavaJavaScriptJCLJSONKotlinKubernetes/HelmObjective-CPHPPL/IPL/SQLPowerShellPythonRPGRubyRustScalaShellSwiftTerraformT-SQLTypeScriptVB.NETVB6XMLYAML
Need a higher plan: Apex, ABAP, COBOL, JCL, PL/I, RPG
Pricing & plans
$24/month for the entry lines-of-code tier (Team plan); price scales with the LOC tier chosen
Minimum seats: none
Trial: 14 days for new Team plan customers
Free (SonarQube Cloud)$0 perpetualSmall teams and open-source projects
- Basic code analysis
- Unlimited public project analysis
- IDE integration
- Built-in 'Sonar way' quality gate
- Webhooks
- 50,000 LOC for private projects
- Up to 5 organization members
- Pull request analysis only when the target branch is main
- No custom quality gates or profiles, no architecture analysis, no AI CodeFix
- No email or Slack notifications
Team (SonarQube Cloud)$24/month at the entry LOC tier, rising with the chosen tierGrowing teams with advanced analysis needs
- All Free features plus unlimited pull request analysis
- Custom quality profiles and custom quality gates
- Architecture analysis
- AI CodeFix
- Portfolio management and advanced management reporting
- Permission templates, groups, org-wide project configuration, email and Slack notifications
- LOC ceiling of 1,900,000; exceeding the limit is blocked with an error
- SCA and Advanced SAST require separate subscriptions
- Sonar Agent Essentials is annual-subscription only on Team
- No Enterprise languages, MISRA profiles, Enterprise SSO, IP allow lists, or code encryption
- Credit-card auto-renewal; suspension on payment failure (data preserved)
Enterprise (SonarQube Cloud)Contact for custom pricingLarge organizations with extensive governance needs; Sonar recommends it from 5M LOC
- All Team features
- Enterprise languages: Apex, ABAP, COBOL, JCL, PL/I, RPG
- MISRA compliance quality profiles
- Enterprise organization hierarchy with shared or individual LOC allocation
- Sonar Agent Essentials included
- GitHub advanced security integration, IP allow lists, Enterprise SSO, code encryption, custom SLA
- No published price; enterprise sales motion required
- SCA and Advanced SAST still require separate subscriptions
OSS (SonarQube Cloud)$0Open-source projects
- Full analysis of public repositories with unlimited LOC
- Unlimited pull request analysis
- Advanced analysis features including architecture and custom quality gates/profiles
- Portfolio management, groups, webhooks
- GitHub member synchronization
- No private project analysis
- No AI CodeFix, Remediation Agent, or Sonar Vortex
- No permission templates, org-wide configurations, or email/Slack notifications
SonarQube Community Build (self-hosted)$0Teams wanting a free self-managed install
- Free, open-source version of SonarQube Server
- Sonar's docs don't list which analysis features Community Build includes or excludes
SonarQube Server Developer (self-hosted)Not published — contact sales; priced per instance, per year, by lines of codeSmall teams self-hosting; recommended for 100K+ LOC
- 34 languages & frameworks
- Autodetect AI-generated code
- AI Code Assurance
- Advanced bug detection
- Secrets detection
- Architecture management
- No published price; quote via sales
- No AI CodeFix, MISRA C++:2023 compliance, or commercial support tiers (Enterprise+ only)
- No high-availability or distributed architecture (Data Center only)
SonarQube Server Enterprise (self-hosted)Not published — contact sales; priced per instance, per year, by lines of codeLarger self-hosted teams; recommended for 1M+ LOC
- Developer edition, plus:
- 40 total languages & frameworks (incl. Apex, ABAP, COBOL, JCL, PL/I, RPG)
- AI CodeFix
- MISRA C++:2023 compliance
- Commercial support, and 24/7 white-glove support available
- Detailed project health insights
- No published price; quote via sales
- No autoscaling or distributed high-availability architecture (Data Center only)
SonarQube Server Data Center (self-hosted)Not published — contact sales; priced per instance, per year, by lines of codeLarge enterprises needing self-managed high availability; recommended for 20M+ LOC
- Enterprise edition, plus:
- Autoscaling based on demand
- High performance for distributed teams
- Distributed architecture for horizontal scaling and high availability
- No published price; quote via sales
Who it's for
Best for teams that need broad language coverage, including legacy languages, and a choice between SaaS and self-hosting.
A good fit if
- You need 40+ languages, including COBOL, ABAP and other mainframe languages on Enterprise
- You want to choose between SaaS and a self-managed server, or start with the free Community Build
- You want architecture rules that track structural debt in large codebases
Consider alternatives if
- You want SCA and advanced SAST in the base plan
- You need more than 50,000 lines of private code on the free plan
Similar tools
Other Code Quality Platform tools in the directory.
CodacyCode quality and security platform aggregating third-party analyzers across 40+ languages, with SAST, SCA, secrets, coverage and a free IDE extension.CodeSceneBehavioral code analysis platform scoring Code Health, hotspots, knowledge distribution and delivery risk from version-control history.DeepSourceStatic analysis and code security platform that reviews every commit and PR, with an AI review agent and Autofix remediation.QltyGitHub-only static analysis, security scanning and code coverage platform, split between a free open-source CLI and hosted Qlty Cloud.
FAQ
When should you choose SonarQube?
SonarQube is best for teams that need broad language coverage, including legacy languages, and a choice between SaaS and self-hosting. It's a good fit if:
- You need 40+ languages, including COBOL, ABAP and other mainframe languages on Enterprise
- You want to choose between SaaS and a self-managed server, or start with the free Community Build
- You want architecture rules that track structural debt in large codebases
Consider alternatives if:
- You want SCA and advanced SAST in the base plan
- You need more than 50,000 lines of private code on the free plan
What languages does SonarQube support?
SonarQube supports 41+ languages and frameworks, including Apex, ABAP, Ansible, Azure Resource Manager, C, C++, C#, COBOL, CloudFormation, Dart, and 31 more.
What does SonarQube integrate with?
SonarQube integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, CircleCI, Amazon CodeCatalyst and 1 more, plus others through its CLI or API
- IDEs: IntelliJ IDEA, CLion, WebStorm, PhpStorm, PyCharm and 6 more
What tools are similar to SonarQube?
Other code quality platforms tracked here:
What are SonarQube's plans and pricing?
SonarQube has a free plan, and paid plans start at $24/mo. Enterprise pricing is by quote.
Opens www.sonarsource.com in a new tab. Review Radar is not affiliated with Sonar.