Greptile vs Sonar (2026)

Stands at F, re-based off the vendor's own changelog after the June basis cited aicodereview.cc. Breadth across classes is comfortably met, and the notable addition since the record was built is Fix with your Agent, which routes findings outward into five named coding agents through a local bridge CLI. That is an unusual integration direction for a reviewer and worth recording: Greptile positions as the reviewer that hands work to whichever agent the customer already runs.

Stands at F with a citable basis. Breadth is met across IDEs, CI systems and agent runtimes, and the eleven named agent clients are the distinguishing detail: this vendor integrates with the coding agents rather than competing with them, which is what makes it a verification layer rather than a rival. Recorded honestly: these are inbound connections where agents call Sonar, plus outbound reads of repositories and CI, rather than Sonar acting across a broad tool surface of its own.

Upgraded from P. The June basis described parallel agents and multi-hop passes but predates v5, shipped 5 August 2026, which makes the architecture explicit: a swarm of narrowly scoped agents each exploring a single hypothesis, run in parallel and aggregated into one review. Graded F on the cosine precedent, where Swarm mode spawning specialised child agents earned F, and distinguished from blink-new, held at P because its parallel agents had no documented coordination. Here the coordination is evidenced by measured aggregate outcomes: median review time halved and comment-addressed rate rose from 52 to 66 percent, which only makes sense if the swarm's output is filtered and merged rather than concatenated.

DOWNGRADED from F. The July basis credited verification running from the agent inner loop to pre-PR to CI plus a remediation agent that detects, fixes, verifies and opens a pull request, which is real but is a fixed three-stage pipeline the vendor names Guide, Verify, Solve, not orchestration the customer composes. Nothing multi-agent, no branching, no customer-defined workflow, no agent coordination is documented. Compare qodo and cubic, both held at P for a fixed review-then-fix loop, and contrast zencoder and greptile at F for composable multi-agent pipelines. Held at P rather than N because the Remediation Agent genuinely chains detect, fix, re-verify and open a pull request without a human between steps.

Stands at P, re-based off the changelog. Surface coverage grew materially since the record was built, with a CLI in June and CLI onboarding in July adding a terminal path that did not previously exist, alongside PR events, mention and re-trigger invocation, MCP from four IDEs and Slack delivery. Held below F because every path still anchors to the pull request or the local development loop: Slack is a delivery destination rather than an invocation channel, and no scheduled or cron-driven review is documented anywhere. Same line that holds cubic and graphite at P while warp, goose and ellipsis reach F on chat, ticketing or event-driven invocation.

Stands at F with a citable basis. All three trigger classes are documented: event-driven on commits and pull requests through CI and Agent Apps for GitHub, continuous inside the agent inner loop where Agentic Analysis fires on each generation, and developer-invoked through IDE, CLI and MCP tool calls. The inner-loop trigger is the genuinely unusual one, since verification fires on the agent's activity rather than on a human action, which few vendors in this lane document.

Stands at F and is now among the best-evidenced grounding cells in the lane, alongside cubic and cosine. Two mechanisms are new to the record and both extend grounding past the repository boundary: Repo Clusters reading up to seven related repositories per review, and the Partner Program supplying maintained context for third-party APIs. The files.json mechanism is worth noting as a design choice, since it points the reviewer at existing schemas and architecture docs rather than requiring a separate knowledge base.

Stands at F with a citable basis. Context Augmentation is the Guide stage of the vendor's own framework and is genuinely distinct from how most of this lane grounds: rather than indexing a repository to answer questions, it pushes the organisation's standards, architecture and guidelines into the agent before it writes, so grounding is preventive rather than retrieval-time. Architecture search, call flows and dependency checks are named tools an agent calls through MCP.

Upgraded from N. The June basis reasoned that learning from comments and reactions was feedback-loop adaptation belonging under Know, sourced to a dev.to post; Memory and Learning is in fact a named system with its own documentation page, its own dashboard section, five documented learning signals and an inference step that proposes new rules from observed behaviour. Graded F on the cosine precedent, where a named Memory feature persisting conventions across sessions earned F. The distinction from graphite, held at N in this same batch, is exactly that the vendor documents persistence as a capability with a mechanism rather than as a training characteristic.

Stands at P and confidence normalised from a non-canonical 0.6. The July basis reasoned correctly, that the baseline from the last full scan carries context between runs while persistent agent memory is not the framing, and re-retrieval supports it. What persists is analysis state, the project baseline, new-code definition, issue history and accepted or won't-fix dispositions, which is durable and genuinely affects later runs, but it is project state rather than agent memory. Kept separable from Know so one fact does not do double duty: Know rests on Context Augmentation pushing standards to agents, this on the retained baseline.

Upgraded from P. The June basis described advisory comments plus configurable rules, which was accurate but predates auto-approve, shipped 26 June 2026. Graded F on the cubic precedent: a documented autonomy boundary with a customer-set risk ceiling and a published never-approve list is a shipped guardrail mechanism, which is what this axis grades. Beta is not a bar to F under the early access treatment, since it is open to all users rather than gated by application, unlike warp Factories. The hard exclusion list is the strongest part: auth, secrets, billing, database migrations, infrastructure, CI and public APIs are never auto-approved regardless of configuration, which is a guardrail the customer cannot switch off.

Stands at F with a citable basis. The quality gate is a genuine enforcement mechanism rather than advisory review: it blocks the merge, it is customer-configured, and the vendor positions the MCP server as standardising policy enforcement so gate conditions become CI checks applied consistently. That is control the agent cannot talk its way past, which is the strongest form on this axis. Seventh distinct oversight architecture in this lane and the only one that is deterministic, since a rule-based gate cannot be argued with by a more persuasive prompt.

Stands at F. The axis conjunction is met on both halves independently, and the self-hosted air-gapped path with customer-supplied models is the part that matters most for the regulated buyers this vendor targets, since it removes the trust question rather than attesting to it. Recorded honestly: the SOC 2 Type II claim and the defence, healthcare and financial services customer base come from vendor marketing pages rather than a trust portal, and no named audit firm or published report was retrieved.

Stands at F with a citable basis. The conjunction is met on the product side rather than the corporate side, which is worth being explicit about: Sonar's security posture here is what the product does for the customer's code, SAST, secrets, SCA and compliance frameworks, not an attestation about Sonar's own operations. No SOC 2 or ISO certification for Sonar itself was retrieved on either pass; the July basis attributed SOC 2 Type II and ISO 27001 to Gitar, the acquired company, which is a different legal entity's attestation and is recorded as such rather than transferred to the parent. Flagged for a trust-page fetch at lane close.

Stands at P, re-based off the changelog after the June basis cited greptile.com/what-is-ai-code-review, a marketing explainer. The analytics dashboard shipped 15 April 2026 and is a real reporting surface with export, and the review footer's counter and last-reviewed-commit link add per-PR traceability. Held below F on the lane-wide reading applied to graphite, cubic and sourcegraph: these measure review outcomes and team throughput, not a retained per-action record of what the agent did and why. Contrast ellipsis, which earned F because every step, tool call and message is retained and replayable. Confidence stays medium because the analytics docs page was not fetched directly.

Stands at F but confidence lowered from high to medium, because the July basis asserted auditability at high confidence in marketing language, definitive, transparent, auditable, traceable, without naming a mechanism or a page. The grade holds on a real property rather than a claim: deterministic rule-based analysis means every finding maps to a named rule and a code location and reproduces exactly, which is auditability of a stronger kind than a retained log, and it is why compliance buyers can defend the output. Recorded honestly: what is NOT documented on any page reached is an agent execution trace, a session record or an audit log of who ran what and when, so this F rests on finding-level explainability rather than on agent observability. Would benefit from a governance-page fetch at lane close.

Stands at F and is the strongest Dep cell reviewed in this lane so far. Unlike warp and cosine, where air-gapped deployment is described on a marketing page and quoted through sales, Greptile publishes the actual deployment mechanics: named services, sizing thresholds, a public repository, a Terraform path and a documented migration route between deployment methods. Both halves of the axis are met independently, deployment surface and data location control, with bring-your-own-LLM closing the inference path.

Stands at F with a citable basis. Both halves of the axis are met independently: a genuine self-managed deployment in SonarQube Server, which is the long-established enterprise product rather than a bolted-on option, and data control through Gitar retaining no code after processing plus bring-your-own-Anthropic-key. The MCP server self-hosting path via official container image, and its installation as a Server extension exposing tools at the customer's own /mcp endpoint, means the agentic surface deploys inside the customer boundary too rather than only the analysis engine.

Upgraded from N. The June basis said custom rules are user-defined configuration and no vendor-supplied library exists, which was true then; the Partner Program shipped 22 June 2026 and is exactly a vendor-curated pack, supplying partner-maintained review rules for eight named third-party APIs, enabled by default. Held at P rather than F because these are context packs applied automatically rather than a browsable catalogue of installable agents or templates, and there is still no marketplace or gallery. AI rules import is customer-owned configuration and is recorded rather than credited.

Stands at F with a citable basis. Vendor-supplied rule sets and quality profiles across forty-plus languages are the largest body of prebuilt, adoptable assets of any vendor in this lane, and they are exactly what the axis rewards: the customer adopts them ready-made rather than authoring them. The agent plugins and slash commands for named harnesses are a second, newer layer of the same thing. Recorded honestly: these are rules and profiles rather than agents, so this is a broad reading of the axis, but the assets are unambiguously prebuilt, vendor-maintained and installed rather than built.

Upgraded from P, and this is a retrieval failure rather than product movement: Configurable Models has been documented since 26 September 2025, nine months before the record was built, and the June basis cited sacra.com rather than the vendor. Three independent forms of the axis are present, which is as strong as this cell gets: explicit customer selection, documented routing, and bring your own model on self-host. Model Inversion is a genuinely unusual routing rule and worth a comparison-page note, since it routes away from the authoring model on the vendor's own research that models catch more bugs in code written by a different model.

Stands at P and confidence normalised from a non-canonical 0.6. The July basis reasoned correctly and is preserved: core analysis is deterministic and model-free, so most of the product has no model to choose, and the LLM-touching parts, AI CodeFix and Gitar, support bring your own Anthropic key. That is a real customer-facing model control, which clears the P floor, but it is a single named provider with no selection across providers and no routing, so F is not available. Worth noting this is the one vendor in the lane where a low Model grade is a design virtue rather than a limitation, since determinism is the selling point.

Upgraded from P, which said no public SDK is documented, sourced to sacra.com. The surface is broader than an SDK gap implies: four named REST endpoints, a hosted MCP server with a documented bearer-token setup across four IDEs, an npm CLI with machine-readable and agent-oriented output modes, a plugin in Anthropic's official marketplace, webhooks and Zapier. The MCP direction test is satisfied outward, since other assistants call Greptile to query rules and trigger reviews.

Stands at F, now with a citable basis and an evidenceUrl; the July row named no page and carried a null URL. This is among the strongest Ext cells in the lane and unusual in kind: the MCP server is the product's primary agentic surface rather than an add-on, exposing a documented tool bag other vendors' agents call, and the supported-client list includes eleven named agents. Worth pairing against zed, which authored a protocol, and greptile, which hosts one alongside a REST API.

Stands at F on the qodo and cubic precedent, where the axis and the product coincide, and the case is stronger than it was in June because TREX and the security agent both shipped after the record was built. TREX is the unusual part and worth pairing on comparison pages: writing and executing targeted tests against the repository's real stack rather than a mock environment, and attaching execution evidence to the comment, is closer to a customer-facing test harness than anything else reviewed in this lane. Recorded honestly: TREX is in public beta and the security agent's benchmark claims are vendor-reported.

Stands at F with a citable basis. This is the qodo, cubic and greptile precedent in its purest form, where the axis and the product coincide: verification is not a feature of Sonar, it is Sonar. The distinguishing property against every other reviewer in this lane is determinism, since rule-based static analysis returns the same finding for the same code rather than varying by prompt, which is what makes the output auditable. Recorded honestly: the 44 percent outage-reduction and 8 percent token-reduction figures are vendor-reported from a press release with no published methodology.

DOWNGRADED from P, the eighth correction of this identical axis error in the 30 June cohort. The June basis credited running TREX in a sandbox, navigating the repository graph and applying click-to-accept fixes as computer use; sandboxes, code graphs and the GitHub API are all programmatic interfaces, which is what the axis excludes. One genuine ambiguity is recorded rather than resolved: TREX attaches screenshots and videos as failure evidence, which implies browser-driven end-to-end tests, but running the customer's own test framework is executing their harness rather than operating software that lacks a programmatic interface, and no browser tool, computer-use capability or GUI automation is named on the TREX page or anywhere in the changelog. Would move on a documented browser tool.

Stands at N and confidence raised from a non-canonical 0.6 to 0.85, because this is graded from what the vendor says the product is rather than from absence. The July basis reasoned correctly, and it is one of the few in either cohort that did. Sonar analyses source code and exposes tools to agents; there is no browser, no GUI automation and no software operated without a programmatic interface anywhere in the product. Searched the AI capabilities documentation, the MCP server documentation and the product pages.