Graphite vs Sonar (2026)

Stands at F, re-based off first-party pages after the June basis cited git-tower.com. Recorded rather than credited to another axis: Cursor Cloud Agents now run inside the Graphite pull request, which is a post-acquisition integration and the clearest product evidence that the two are converging.

Stands at F with a citable basis. Breadth is met across IDEs, CI systems and agent runtimes, and the eleven named agent clients are the distinguishing detail: this vendor integrates with the coding agents rather than competing with them, which is what makes it a verification layer rather than a rival. Recorded honestly: these are inbound connections where agents call Sonar, plus outbound reads of repositories and CI, rather than Sonar acting across a broad tool surface of its own.

Upgraded from P. The June basis called this human-collaborative and rules-based rather than an orchestration engine, sourced to a vendor blog post. Reading the plan matrix, the orchestration is real and layered: a stack-aware merge queue with basic and advanced tiers, an automations engine, a CI optimizer, and automatic rebasing of dependent branches as changes land. Sequencing dependent pull requests to keep trunk green while rebasing the chain is genuine multi-step workflow execution over a dependency graph, which is what the axis measures. Recorded honestly: this orchestrates the merge pipeline rather than coordinating multiple agents, so it earns F on the multi-step half rather than the multi-agent half.

DOWNGRADED from F. The July basis credited verification running from the agent inner loop to pre-PR to CI plus a remediation agent that detects, fixes, verifies and opens a pull request, which is real but is a fixed three-stage pipeline the vendor names Guide, Verify, Solve, not orchestration the customer composes. Nothing multi-agent, no branching, no customer-defined workflow, no agent coordination is documented. Compare qodo and cubic, both held at P for a fixed review-then-fix loop, and contrast zencoder and greptile at F for composable multi-agent pipelines. Held at P rather than N because the Remediation Agent genuinely chains detect, fix, re-verify and open a pull request without a human between steps.

Stands at P, re-based off the pricing matrix. Trigger coverage is real within one envelope: pull request events, merge queue events, CI events, plus CLI, VS Code, MCP, web and inbox surfaces, with Slack as a notification output. Held below F because everything is anchored to GitHub and the local development loop, with no chat-initiated or ticket-initiated invocation and no scheduled runs, which is the distinction separating this from warp, goose and ellipsis at F.

Stands at F with a citable basis. All three trigger classes are documented: event-driven on commits and pull requests through CI and Agent Apps for GitHub, continuous inside the agent inner loop where Agentic Analysis fires on each generation, and developer-invoked through IDE, CLI and MCP tool calls. The inner-loop trigger is the genuinely unusual one, since verification fires on the agent's activity rather than on a human action, which few vendors in this lane document.

Stands at F but confidence is lowered from high to medium, because the June basis was graded at high confidence off braintrust.dev, a third-party vendor's customer case study, which the conventions exclude. Whole-codebase context and code indexing are confirmed first-party, but the mechanism is not documented anywhere I reached: no index architecture, retrieval method or scope statement appears on the pricing page or in navigation. The grade holds on the documented existence of code indexing plus admin controls over it; the confidence reflects that the depth claim rests on marketing rather than docs. A fetch of graphite.com/features/ai-reviews would settle it.

Stands at F with a citable basis. Context Augmentation is the Guide stage of the vendor's own framework and is genuinely distinct from how most of this lane grounds: rather than indexing a repository to answer questions, it pushes the organisation's standards, architecture and guidelines into the agent before it writes, so grounding is preventive rather than retrieval-time. Architecture search, call flows and dependency checks are named tools an agent calls through MCP.

Stands at N on re-retrieval. The reviewer tuning itself from accepted and rejected comments is real but is feedback-loop adaptation of a model's behaviour rather than a documented memory layer, and imported style guides and rules are static configuration the customer maintains. Contrast cubic, moved to P because the docs name a Learns from you feature with a described mechanism, and cosine, moved to F for a named Memory feature persisting architecture decisions. Nothing comparable is named here. The distinction is the vendor documenting persistence as a capability rather than a training characteristic.

Stands at P and confidence normalised from a non-canonical 0.6. The July basis reasoned correctly, that the baseline from the last full scan carries context between runs while persistent agent memory is not the framing, and re-retrieval supports it. What persists is analysis state, the project baseline, new-code definition, issue history and accepted or won't-fix dispositions, which is durable and genuinely affects later runs, but it is project state rather than agent memory. Kept separable from Know so one fact does not do double duty: Know rests on Context Augmentation pushing standards to agents, this on the retained baseline.

Stands at P. Oversight is largely structural, since a reviewer's output is advisory findings a human accepts or rejects, which is the same reading applied to qodo. What lifts it toward the gate the axis wants is the merge queue: approved pull requests are sequenced and merged under rules the team configures, with advanced settings on Enterprise, and ACLs bound who can do what. Held below F because no per-action approval gate on the agent's own actions is documented, and no shadow or preview mode exists for the kind cubic ships on auto-approval.

Stands at F with a citable basis. The quality gate is a genuine enforcement mechanism rather than advisory review: it blocks the merge, it is customer-configured, and the vendor positions the MCP server as standardising policy enforcement so gate conditions become CI checks applied consistently. That is control the agent cannot talk its way past, which is the strongest form on this axis. Seventh distinct oversight architecture in this lane and the only one that is deterministic, since a rule-based gate cannot be argued with by a more persuasive prompt.

Upgraded from N. The June basis said no enumerated identity and governance matrix is documented, sourced to the privacy and security docs page; the pricing page's Admin section enumerates it in full. The axis conjunction is met twice over: SOC 2 Type II plus continuous penetration testing on the attestation side, and SAML/SSO, ACLs, SIEM audit log export, code indexing controls, AI privacy controls and GHES support on the named-control side. This is the Sec understatement pattern the process note predicts, and it was found by reading the plan comparison table rather than the security page.

Stands at F with a citable basis. The conjunction is met on the product side rather than the corporate side, which is worth being explicit about: Sonar's security posture here is what the product does for the customer's code, SAST, secrets, SCA and compliance frameworks, not an attestation about Sonar's own operations. No SOC 2 or ISO certification for Sonar itself was retrieved on either pass; the July basis attributed SOC 2 Type II and ISO 27001 to Gitar, the acquired company, which is a different legal entity's attestation and is recorded as such rather than transferred to the parent. Flagged for a trust-page fetch at lane close.

Stands at P, re-based off the pricing matrix after the June basis cited a vendor blog post. Insights and custom analytics are genuine reporting, and the Enterprise SIEM audit log is a real governance artefact, but both measure people and access rather than agent behaviour. Under the lane-wide reading applied to augment-code and sourcegraph, reporting on throughput and cycle time is not a retained per-action trace of what the reviewer did and why. Would move to F on a documented per-review execution record.

Stands at F but confidence lowered from high to medium, because the July basis asserted auditability at high confidence in marketing language, definitive, transparent, auditable, traceable, without naming a mechanism or a page. The grade holds on a real property rather than a claim: deterministic rule-based analysis means every finding maps to a named rule and a code location and reproduces exactly, which is auditability of a stronger kind than a retained log, and it is why compliance buyers can defend the output. Recorded honestly: what is NOT documented on any page reached is an agent execution trace, a session record or an audit log of who ran what and when, so this F rests on finding-level explainability rather than on agent observability. Would benefit from a governance-page fetch at lane close.

Stands at N, but the basis is corrected: the June note said no deployment option beyond hosted is documented, sourced to git-tower.com, and GitHub Enterprise Server support is in fact listed on Enterprise. That is not a deployment option for Graphite, though, it is support for a customer-hosted code host, so the grade does not move. This is the same distinction drawn on blink-new, where portability of the artifact did not confer residency on the platform. No region selection, VPC, private instance or self-host of Graphite itself is documented.

Stands at F with a citable basis. Both halves of the axis are met independently: a genuine self-managed deployment in SonarQube Server, which is the long-established enterprise product rather than a bolted-on option, and data control through Gitar retaining no code after processing plus bring-your-own-Anthropic-key. The MCP server self-hosting path via official container image, and its installation as a Server extension exposing tools at the customer's own /mcp endpoint, means the agentic surface deploys inside the customer boundary too rather than only the analysis engine.

Stands at N on re-retrieval, and this is a considered hold rather than a default. AI review customization covering automations, filters and rules is genuine reusable configuration, and it is what lifted comparable cells to P elsewhere; but the axis rewards prebuilt assets the customer installs or adopts, and every one of these is authored by the customer from scratch. Graphite ships a single reviewer agent with no library, gallery, template set or marketplace. Same reading that held cosine at N for vendor-built components. Searched: the pricing matrix, the features navigation and the homepage.

Stands at F with a citable basis. Vendor-supplied rule sets and quality profiles across forty-plus languages are the largest body of prebuilt, adoptable assets of any vendor in this lane, and they are exactly what the axis rewards: the customer adopts them ready-made rather than authoring them. The agent plugins and slash commands for named harnesses are a second, newer layer of the same thing. Recorded honestly: these are rules and profiles rather than agents, so this is a broad reading of the axis, but the assets are unambiguously prebuilt, vendor-maintained and installed rather than built.

Stands at N on re-retrieval, and the temptation to move it was checked. AI privacy controls and code indexing controls are admin capabilities over data handling, not model selection, and the same distinction was applied to cubic, where bring-your-own API keys did not lift Model because supplying a key is not choosing a model. No provider is named as powering reviews on any first-party surface. Worth flagging as a likely mover: Cursor's stated plan on acquisition was to leverage its coding models to make Graphite's AI features more intelligent and to merge Graphite's reviewer with Cursor's Bugbot, so the model layer here may change materially.

Stands at P and confidence normalised from a non-canonical 0.6. The July basis reasoned correctly and is preserved: core analysis is deterministic and model-free, so most of the product has no model to choose, and the LLM-touching parts, AI CodeFix and Gitar, support bring your own Anthropic key. That is a real customer-facing model control, which clears the P floor, but it is a single named provider with no selection across providers and no routing, so F is not available. Worth noting this is the one vendor in the lane where a low Model grade is a design virtue rather than a limitation, since determinism is the selling point.

Upgraded from N. The June basis said no MCP server is documented, sourced to git-tower.com, a third-party blog; the pricing page lists MCP as a Hobby-tier feature on every plan, grouped under Stacking alongside the CLI and VS Code extension. Held at P rather than F because the grouping indicates an MCP server exposing Graphite's stacking operations to other agents rather than a general platform API, and no REST API, SDK or webhook surface is documented anywhere. F would need a documented API or SDK for building on Graphite.

Stands at F, now with a citable basis and an evidenceUrl; the July row named no page and carried a null URL. This is among the strongest Ext cells in the lane and unusual in kind: the MCP server is the product's primary agentic surface rather than an add-on, exposing a documented tool bag other vendors' agents call, and the supported-client list includes eleven named agents. Worth pairing against zed, which authored a protocol, and greptile, which hosts one alongside a REST API.

Stands at F on the qodo and cubic precedent, where the axis and the product coincide: the customer points a shipped review product at their own code and it finds defects. Recorded honestly and worth noting against the seven downgrades this axis has taken in this lane: those were agents running a project's existing tests, whereas this is a defect-detection product with customer-configurable rules and filters. No harness for evaluating agent behaviour exists, which is the F bar on the other reading of this axis, so this F rests on the product-coincides reading alone.

Stands at F with a citable basis. This is the qodo, cubic and greptile precedent in its purest form, where the axis and the product coincide: verification is not a feature of Sonar, it is Sonar. The distinguishing property against every other reviewer in this lane is determinism, since rule-based static analysis returns the same finding for the same code rather than varying by prompt, which is what makes the output auditable. Recorded honestly: the 44 percent outage-reduction and 8 percent token-reduction figures are vendor-reported from a press release with no published methodology.

DOWNGRADED from P, the seventh correction of this identical axis error in the 30 June cohort. The June basis credited reviewing and navigating code, applying commits, rebasing branches via the CLI and self-healing CI as computer use; every one of those runs through git and the GitHub API, which are programmatic interfaces and exactly what the axis excludes. Both passes reached the pricing matrix, the features navigation and the homepage and found no browser, screenshot or GUI automation anywhere. Worth watching rather than assuming: Cursor Cloud Agents now run inside the pull request, and if those agents carry browser tooling this could change, but that capability belongs to cursor's record and is not documented on any Graphite surface.

Stands at N and confidence raised from a non-canonical 0.6 to 0.85, because this is graded from what the vendor says the product is rather than from absence. The July basis reasoned correctly, and it is one of the few in either cohort that did. Sonar analyses source code and exposes tools to agents; there is no browser, no GUI automation and no software operated without a programmatic interface anywhere in the product. Searched the AI capabilities documentation, the MCP server documentation and the product pages.