Graphite vs Sonar (2026)

Deep GitHub integration spans repositories, pull requests, CI and merge, with GitHub Enterprise Server supported on Enterprise. Developers work through a CLI for stacked pull requests and simplified git commands, a VS Code extension, a Mac menu bar app, MCP, a web pull request page and a PR inbox. Slack notifications and a Linear integration ship from Starter, with advanced integrations on Team and above.

The CI optimizer integrates Buildkite and GitHub Actions. Cursor Cloud Agents appear inside the pull request for authors on a paid Cursor plan, opening draft pull requests and committing fixes to the branch. The agent acts by commenting inline, applying suggested fixes, generating PR titles and descriptions, summarizing CI failures, restacking and merging through the queue.

Sourcegraphite.com/pricing, docs/integrations and docs/agentsread 2026-10-28

Integration spans IDEs through SonarQube for IDE plugins, CI and source platforms including GitHub, GitLab, Bitbucket, Azure DevOps and Jenkins, and agent runtimes through the MCP server, which connects Claude Code, Codex CLI, Cursor, Gemini CLI, GitHub Copilot CLI, GitHub Copilot Cloud Agent, Kiro, VS Code, Windsurf and Zed, with Devin and Antigravity on the integrations list.

Dedicated SonarQube plugins ship for Claude Code, Cursor, Codex, Antigravity and GitHub Copilot CLI, and a CLI with a sonar integrate command plus hooks cover scripted and agentic environments. Gitar reviews pull requests on GitHub, GitLab, Bitbucket and Azure DevOps including self hosted instances, reads CI from GitHub Actions, GitLab Pipelines, CircleCI, Buildkite, Bitrise, Harness, TeamCity and Jenkins, and connects Jira, Linear and Slack.

Sourcesonarsource.com, sonarsource.com/products/gitar and sonarsource.com/products/sonar-vortexread 2026-10-28

A stack aware merge queue sequences approved pull requests to keep the trunk branch green. It comes as Basic on Team and as Advanced, with additional settings, on Enterprise, and an external merge queue integration is in beta.

The queue also rebases stacked branches automatically as earlier changes land, so a chain of dependent pull requests stays current without manual intervention. An Automations engine and a CI optimizer batch and selectively trigger test runs, integrated with Buildkite and GitHub Actions. Within the pull request, Graphite Agent chains review into suggested fixes, CI summaries and collaborative merge.

Sourcegraphite.com/pricing, docs/graphite-merge-queue and docs/external-merge-queue-integrationread 2026-10-28

The Agent Centric Development Cycle defines a fixed continuous three stage loop applied to every AI assisted change. Guide provides project context to agents before they write, Verify analyzes the resulting code, and Solve fixes what verification found.

Sonar Vortex runs Guide and Verify inside the agent's inner loop, the Remediation Agent chains detection, fix, re verification and opening a pull request, and Gitar reviews a pull request, commits fixes, reads the CI result, diagnoses failures and iterates until the pipeline is green, under merge rules the team writes in plain language. Sonar ships these loops as defined, and customers do not compose their own workflows on them. There is no multi agent coordination, branching logic, customer defined stages or agent handoff.

Sourcesonarsource.com, sonarsource.com/products/gitar and docs.sonarsource.com/agent-centric-development-cycleread 2026-10-28

Every pull request gets an automatic review from Graphite Agent when it is opened or updated. Automations act on pull request events to assign reviewers and add labels. Developers also reach the agent from the PR page, Graphite Chat, the CLI, VS Code and MCP.

Sourcegraphite.com/docs/ai-reviews, docs/automations and graphite.com/pricingread 2026-10-28

Analysis runs automatically on CI builds and pull requests through GitHub, GitLab, Bitbucket, Azure DevOps and Jenkins, Gitar reviews when a pull or merge request opens and reacts when CI fails, and the Remediation Agent starts on an automated backlog remediation schedule, from Fix with Agent on the Issues page, or from Fix automatically in a failed quality gate comment on a pull request. Sonar Vortex runs inside a coding agent's loop, and developers and agents invoke analysis through IDE plugins, the CLI and MCP tool calls.

Sourcesonarsource.com/products/gitar, docs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-features and sonarsource.com/products/sonar-vortexread 2026-10-28

Optional code indexing keeps an index of the files in each synced repository and speeds Graphite Chat's tool calls and the PR page; reviews that draw on related files through the index, and faster merges, are marked coming soon, so for now the agent's reviews are not grounded in it. By default Graphite stores no code and reads it from GitHub, and an index that is turned off is deleted within 30 days. Style guides and rules work as instructions to the review agent.

Sourcegraphite.com/docs/code-indexing and docs/ai-review-customizationread 2026-10-28

Sonar Vortex injects project context and constraints before an agent writes its first line, drawing on the repository map, architecture rules, security policies, team conventions, approved libraries and API contracts, and exposes code architecture search, call flows, coding guidelines and dependency checks through the MCP server and the CLI's sonar integrate command.

Analysis is grounded in full project context together with the organization's own quality profiles, rule sets and architecture standards, SonarQube Architecture enforces architectural standards as a distinct product, and Gitar reviews with full codebase context plus organization instructions and Jira context. Sonar Vortex is sold as a package tier through sales.

Sourcesonarsource.com/products/sonar-vortex, docs.sonarsource.com/agent-centric-development-cycle and sonarsource.com/products/gitarread 2026-10-28

Team written custom rules and file based rules persist and apply to every review. Graphite Agent also learns from whether developers accept or reject its comments, though no scope, lifetime or purge path is stated for what it learns.

Sourcegraphite.com/docs/ai-review-customization and docs/ai-reviews; graphite.com/docs/ai-reviewsread 2026-10-28

Analysis state persists between runs. The baseline from the last full project scan carries forward so subsequent analyses evaluate new code against it, issue history and dispositions such as accepted or won't fix persist per project, and quality profiles, gates and Gitar's merge rules are stored and applied consistently across runs. That state belongs to the project and its analysis, and nothing in it carries learned context, corrections or preferences across agent sessions.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities and sonarsource.com/products/gitarread 2026-10-28

Review output is advisory. Findings land as inline comments and suggested fixes that a developer chooses to apply. Graphite Chat lets the developer interrogate and refine a suggestion before committing, and the person stays accountable for the merge.

Teams constrain the review agent through AI review customization, which covers automations, filters and rules, and through an imported style guide. The merge queue gates what reaches trunk under rules the team configures, with advanced settings on Enterprise, and ACLs on Enterprise limit access. Graphite names no approval gate for each agent action, no permission scoping for the agent itself and no shadow mode.

Sourcegraphite.com/pricing, docs/graphite-chat and graphite.com/featuresread 2026-10-28

Oversight comes from gates and rules rather than an approval step inside Sonar.

Quality gates the organization defines block merges that fail deterministic checks, AI CodeFix is switched on by an admin for all or selected projects, the Remediation Agent proposes its fixes as a new pull request for the customer to review on its own code host, and Gitar follows merge rules written in plain language that set what it reviews, what it may fix, what it must escalate, what blocks a merge and when it can approve, with fixes committed automatically or on demand.

Review of the agent's work happens in the customer's own merge process, and there is no step where a person approves an agent action before Sonar executes it.

Sourcesonarsource.com/products/gitar and docs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-featuresread 2026-10-28

The Enterprise plan includes SAML and SSO, access control lists, an audit log with SIEM export, GitHub Enterprise Server support, a custom MSA and private uploads. Admins also get code indexing controls and AI privacy controls. Graphite is SOC 2 Type II compliant and continuously penetration tested, with GitHub tokens encrypted at rest under AES 256 and keys held in AWS Secrets Manager. Its AI features are opt in and do not train on customer code. The security page now sends SOC 2 report requests to trust.cursor.com.

Sourcegraphite.com/pricing and graphite.com/docs/privacy-and-securityread 2026-10-28

At the company level Sonar maintains ISO 27001:2022 certification and a SOC 2 Type II attestation for all products and services, both available from its trust center with the SOC 2 report under NDA, and Gitar states SOC 2 Type II, ISO 27001, GDPR and zero data retention agreements with its LLM providers. SonarQube Enterprise adds SSO with SCIM provisioning, organization, portfolio, project and enterprise permissions with permission templates, IP allow lists, customer managed encryption keys with rotation, zero data retention and bring your own key for LLMs, and audit logs of sign ins and permission changes.

Sourcesonarsource.com/trust-center (read 29 September 2026), sonarsource.com/plans-and-pricing, sonarsource.com/products/gitar and docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-securityread 2026-10-28

Team insights ship from Starter, with custom analytics on Enterprise, and give engineering leaders throughput and cycle time reporting. An audit log with SIEM export is available on Enterprise. A PR inbox centralizes reviews, review findings persist as durable inline comments on the pull request, and CI summaries explain failures in place. These report on team throughput and account access. Graphite names no trace of each step in the review agent's own reasoning, and no agent execution record, session history or replay.

Sourcegraphite.com/pricing and docs/insightsread 2026-10-28

Every Remediation Agent run is recorded on an Agent activity page with its status and duration, what started it (the backlog schedule, Fix with Agent or Fix automatically on a failed gate), where it worked and a link to its pull request.

Gitar analytics dashboards report time to merge, review cycle length, CI failure patterns, flake rates and fix rates across repositories. Enterprise audit logs, readable through an API, record sign ins, user, group and permission changes and key rotation events, and deterministic findings trace to a named rule and code location. Nothing records each step or tool call an agent made within a run.

Sourcedocs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-features, sonarsource.com/products/gitar and /administering-sonarcloud/enterprise-security/audit-logsread 2026-10-28

The product is hosted software on AWS, delivered through a GitHub app with a CLI and VS Code extension as clients. The Enterprise tier adds GitHub Enterprise Server support and private uploads, which let Graphite work with a code host the customer runs itself. Graphite itself does not run in the customer's environment. There is no self hosted, on premises, VPC or private instance option on any tier, Enterprise included, and customers cannot choose a region.

Sourcegraphite.com/pricing and docs/privacy-and-securityread 2026-10-28

SonarQube Server is a self managed deployment priced per instance and installable in the customer's own environment, and since SonarQube Server 2026.5 LTA, generally available on 29 September 2026, Sonar Vortex, the Remediation Agent and the Hunter Agent run on self managed Enterprise and Data Center editions, including on premises, air gapped and VPC restricted environments, beside SonarQube Cloud as SaaS and a free IDE plugin.

The MCP Server installs as an extension on SonarQube Server 2026.3 and later, so the customer's own server proxies agent tools at its own /mcp endpoint, or self hosts standalone through the official container image. Gitar retains no code after processing, supports bring your own Anthropic key, and offers Enterprise customers a regional cloud instance, in beta for the EU, Singapore, Australia and Japan.

Sourcesonarsource.com/company/press-releases/sonarqube-server-2026-5-lta-release, sonarsource.com/products/gitar and docs.sonarsource.com/sonarqube-mcp-serverread 2026-10-28

A single agent, Graphite Agent, does the reviewing. The custom rule dialog offers built in templates for common scenarios, such as language specific style guides, security best practices and accessibility standards, that a team picks and adapts. The template set is named by category only, with no full list.

Sourcegraphite.com/docs/ai-review-customizationread 2026-10-28

Sonar ships prebuilt rule sets and quality profiles covering more than forty languages, maintained by Sonar and adopted by the customer as defaults or customized, together with prebuilt quality gates and architecture standards, and compliance rule mappings for OWASP, CWE and STIG, PCI DSS and CASA.

Its named agents each do their own job: Gitar reviews and fixes pull requests, the Remediation Agent clears backlog issues, the Hunter Agent hunts access control, business logic and authentication flaws, and Sonar Vortex guides and verifies inside the agent loop.

Dedicated SonarQube plugins ship for Claude Code, Cursor, Codex, Antigravity and GitHub Copilot CLI, and Agent Apps for GitHub package the SonarQube agent for direct installation on the platform.

Sourcesonarsource.com, docs.sonarsource.com/agent-centric-development-cycle/developer-tools/agent-plugins and sonarsource.com/plans-and-pricing; docs.sonarsource.com/agent-centric-development-cycleread 2026-10-28

The AI features run on models from Anthropic and OpenAI, Graphite's two AI subprocessors, and the terms of service say either may generate outputs. Graphite makes the model choice itself and names no model picker, routing setting or bring your own key option for Graphite Agent; the model menu in the Agents tab belongs to Cursor Cloud Agents.

Sourcegraphite.com/docs/ai-privacy-and-security, terms-of-service and docs/agentsread 2026-10-28

For the Remediation Agent, a SonarQube Cloud organization admin adds the organization's own OpenAI or Anthropic key, up to three. A SonarQube Server admin can instead point it at Azure AI Foundry, AWS Bedrock or any OpenAI compatible endpoint, so the customer chooses the model maker, and SonarQube Server 2026.5 LTA adds centralized LLM governance covering Anthropic and OpenAI models. Gitar optionally runs on the customer's own Anthropic key.

Sourcedocs.sonarsource.com remediation-agent and administer-remediation-agent, the 2026.5 LTA press release and sonarsource.com/products/gitarread 2026-10-28

GT MCP, in beta and built into the Graphite CLI from version 1.6.7, lets AI agents such as Cursor and Claude Code create stacked pull requests through Graphite's stacking operations, and MCP ships on every plan including the free Hobby tier. The CLI is a substantial client for stack management and simplified git commands, and Graphite publishes source on GitHub under the withgraphite organization. Graphite names no public REST API, SDK or webhooks for building on the platform.

Sourcegraphite.com/docs/gt-mcp and graphite.com/pricingread 2026-10-28

The SonarQube MCP Server, open source and free, connects an AI coding agent to SonarQube's code quality and security data, with tools to analyze code, retrieve issues, check quality gates, inspect security hotspots and measure coverage. It works with Claude Code, Codex CLI, Cursor, Gemini CLI, GitHub Copilot CLI, GitHub Copilot Cloud Agent, Kiro, VS Code, Windsurf and Zed, and powers the SonarQube agent through Agent Apps for GitHub.

SonarQube Cloud includes a hosted MCP server needing no local setup, and on SonarQube Server 2026.3 and later it installs as an extension so the server proxies tools at a single /mcp endpoint. A SonarQube CLI runs analysis from any terminal, CI pipeline or coding agent and its sonar integrate command sets up the agent context without manual MCP configuration, alongside IDE plugins, hooks and plugins for Claude Code, Cursor, Codex, Antigravity and GitHub Copilot CLI. The license is the SONAR Source Available License v1.0.

Sourcedocs.sonarsource.com/sonarqube-mcp-server, sonarsource.com/products/sonar-vortex and sonarsource.com/plans-and-pricingread 2026-10-28

AI reviews check every pull request for bugs, logic errors and security issues before merge, with suggested fixes, CI summaries and rules the team tunes, and a dashboard tracks acceptance rates and rule effectiveness. The review works as a quality gate in the release path, where customers test their own changes.

Sourcegraphite.com/docs/ai-reviews and graphite.com/pricingread 2026-10-28

Deterministic rule based static analysis checks code against quality and security standards across more than forty languages, spanning SAST, secrets detection, software composition analysis and architecture enforcement, tracking test coverage and re verifying every fix before merge.

Sonar Vortex brings verification into the agent's inner loop so agents check their own work as they write, AI CodeFix suggests LLM generated fixes for found issues under organization admin control, the Remediation Agent fixes issues and opens verified pull requests, and Gitar reviews each pull request, commits fixes, reads the CI result, root causes failures and iterates until the pipeline is green.

Sonar reports 44 percent fewer AI caused outages and up to 8 percent lower agent token usage, and up to 36 percent fewer tokens on refactoring with Vortex, from its own survey and research.

Sourcesonarsource.com, sonarsource.com/products/gitar and sonarsource.com/products/sonar-vortex; docs.sonarsource.com/sonarqube-cloud/ai-capabilitiesread 2026-10-28

Every Graphite action runs through programmatic interfaces. These are the GitHub API for pull requests, comments, suggested fixes and merges, git for stacking and automatic rebase of stacks, the CLI, the VS Code extension, MCP, and CI integrations with Buildkite and GitHub Actions. Graphite names no browser control, screenshot capture or visual verification, and no way to operate software that lacks a programmatic interface. The Cursor Cloud Agents surfaced in the Agents tab run on Cursor's own machines and are Cursor's product.

Sourcegraphite.com/pricing, graphite.com/features and docs/agentsread 2026-10-28

The products operate on source code within developer, CI and agent environments through programmatic interfaces throughout, namely static analysis of repositories, MCP tool calls, IDE plugins, a CLI, CI integrations and source platform APIs, and Gitar reads CI results through the pipeline's own API. There is no browser control, screenshot capture, visual verification or operation of software lacking a programmatic interface.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities, docs.sonarsource.com/sonarqube-mcp-server and sonarsource.com/products/gitarread 2026-10-28