Sonar
Also known as: SonarSource, SonarQube
Verification layer for AI and agentic coding, and a standard for automated code review.
Sonar is the established leader in code verification and automated code review, the company behind SonarQube, trusted by more than seven million developers, over twenty two thousand customers, and most of the Fortune 100. Its pitch for the AI era is a neutral trust and verification layer that holds all code to the same standard for quality and security, whether a human or an agent wrote it. Unlike the many new LLM based reviewers, SonarQube's core analysis is deterministic and rule based, producing transparent, auditable findings with a low false positive rate that enterprises can defend for compliance and governance. In May 2026 Sonar acquired Gitar, an AI native code review platform, to add narrative review on top of its verification engine.
What makes Sonar relevant to agentic coding is how it wraps the AI development loop. Its open source MCP server connects coding agents like Cursor, Claude Code, and GitHub Copilot to the SonarQube engine, so an agent checks its own output against your quality gate and fixes its mistakes before a developer ever sees the diff. Around that sit Agentic Analysis for real time inner loop verification, Context Augmentation to feed agents your standards before they write, a Remediation Agent that fixes issues and opens verified pull requests, and a CLI that intercepts secrets and API keys before they reach an LLM provider. It spans SAST, secrets detection, software composition analysis, and architecture enforcement across more than forty languages.
Sonar backs its claims with numbers: teams using it report being forty four percent less likely to suffer AI caused outages, and its remediation work can cut agent token usage meaningfully. It ships as a self managed SonarQube Server, a SaaS SonarQube Cloud, and a free IDE plugin, with a free tier and trial, and it is backed by a major 2022 growth investment from Advent International and General Catalyst. For an engineering organization that wants an independent, auditable control plane over both human and AI generated code, Sonar is the category standard; teams wanting a purely generative reviewer without a deterministic gate will find it deliberately built the other way around.
Vendor details
Canonical URL
https://www.sonarsource.com
Category
Coding agent
Subcategory
AI code review and assurance
Funding status
An established, independent company headquartered in Geneva with a large Austin presence, founded in 2008 as SonarSource. More than seven million developers and twenty two thousand customers use SonarQube, including over seventy five percent of the Fortune 100. It received a major growth investment led by Advent International and General Catalyst in 2022, and in May 2026 acquired the AI native code review startup Gitar.
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Integrates across IDEs, CI/CD pipelines including GitHub, GitLab, and Jenkins, and directly into agent workflows through an open source MCP server, CLI, plugins, and hooks. It connects coding agents such as Cursor, Claude Code, GitHub Copilot, and Windsurf so they self verify against an organization's quality gate in real time.
In practice
Your developers use different AI assistants that each write the same feature five different ways. Sonar's MCP server makes every agent check its output against one shared quality gate and fix itself before you see the diff.
AI generated code is reaching production faster than your team can review it. SonarQube verifies every line deterministically against your standards, flags real defects and vulnerabilities with a low false positive rate, and blocks merges that fail the gate.
You need AI code review you can defend to auditors. Sonar's findings are deterministic, explainable, and traceable, covering OWASP, PCI DSS, and CWE, so verification holds up for compliance rather than varying by prompt.
Sources & related URLs
Related / legacy domains
Research sources
Research notes
Added via Crunchbase discovery batch July6Agentic1to50. Formerly SonarSource. Core fields only; enrichment pending.
Capability coverage
12.0 / 14 capabilities · 86%
| Integrations & Tool CallingIntegrates across IDEs, CI/CD pipelines like GitHub, GitLab, and Jenkins, and directly into agent workflows via an open source MCP server connecting Cursor, Claude Code, Copilot, and Windsurf, Sonar docs 2026-07-06 | Full |
|---|---|
| Workflow OrchestrationRuns verification across the development lifecycle from the agent inner loop to pre PR to CI, with a remediation agent that detects, fixes, verifies, and opens a pull request, Sonar docs 2026-07-06 | Full |
| Knowledge Grounding & RAGGrounds analysis in full project context and an organization's own quality profiles and architecture standards, and augments agents with that context before they write code, Sonar docs 2026-07-06 | Full |
| Human Oversight & GuardrailsEnforces customizable quality gates that block merges until standards pass, keeping humans as the final authority on architecture while automating routine review, Sonar docs 2026-07-06 | Full |
| Security, Identity & GovernanceProvides SAST, secrets detection, and software composition analysis with compliance for OWASP, PCI DSS, CWE, STIG, and CASA, and intercepts secrets before they reach an LLM provider; Gitar carries SOC 2 Type II and ISO 27001, Sonar docs 2026-07-06 | Full |
| Observability & AuditabilityProduces definitive, transparent, and auditable verification with a low false positive rate where every finding is traceable and explainable, built for compliance and enterprise governance, Sonar docs 2026-07-06 | Full |
| Memory & State PersistenceUses the baseline from the last full project scan to carry context between runs; persistent agent memory is not the framing, Sonar docs 2026-07-06 | Partial |
| Deployment & Data ResidencyOffers SonarQube Server for self managed environments alongside SonarQube Cloud, and Gitar retains no code after processing with bring your own Anthropic key, Sonar docs 2026-07-06 | Full |
| Prebuilt Agents, Templates & PacksShips prebuilt rule sets, quality profiles, and gates across more than forty languages, plus prebuilt plugins and slash commands for Claude Code, Gemini, and other agents, Sonar docs 2026-07-06 | Full |
| Triggers & Channel CoverageTriggers automatically on new repositories, on every code generation inside the agent loop, and on each CI run, with automatic provisioning and analysis, Sonar docs 2026-07-06 | Full |
| Model Flexibility & RoutingIts core analysis is deterministic and model free, while its LLM powered fixes and review let enterprises bring their own Anthropic key; broad model choice is not the framing, Sonar docs 2026-07-06 | Partial |
| APIs, SDKs & MCP ExtensibilityExposes an open source MCP server, a unified CLI for agentic workflows, IDE plugins, and hooks so any MCP compatible agent can query its engine in real time, Sonar docs 2026-07-06 | Full |
| Testing, Debugging & OptimizationVerification is the core function: deterministic static analysis checks code against quality and security standards, tracks test coverage, and re verifies every fix before it merges, Sonar docs 2026-07-06 | Full |
| Browser & Computer UseNo browser or computer use; it operates on source code within developer and CI environments, Sonar docs 2026-07-06 | Unable to verify |
Pricing
Free tier and 14 day trial; paid SonarQube Cloud plans priced by lines of code, self serve Team scaling to Enterprise
lines of code
What is public
Free tier, a 14 day Pro trial, and a free open source MCP server and IDE plugin are public. Paid plans are priced by lines of code, with tier pricing published for SonarQube Cloud and enterprise terms quoted through sales.
Billing mechanics
SonarQube Cloud is a self serve SaaS with free and paid tiers priced by lines of code analyzed. SonarQube Server is licensed per instance per year, also by lines of code, for self managed deployments. Agent Essentials and Advanced Security are add ons on Team or Enterprise.
Cost watchouts
Advanced Security, software composition analysis, and Agent Essentials are add ons beyond the base tier. LOC based pricing means codebase growth, not team size, drives cost, so a growing repo can raise the bill even with a stable headcount.
Variable cost rationale
Priced by lines of code, so cost scales as the codebase grows rather than with usage; predictable per year once codebase size is known, but large or fast growing repos raise the tier.
Additional watchouts
Because pricing is per lines of code, a large or fast growing monorepo can jump tiers; confirm which edition, add ons, and LOC band you fall into, and whether Advanced Security and agent features are included.
Sales call required
Mixed (some tiers require a call)
Free / trial
Free tier for developers plus a 14 day Pro trial, no credit card; open source MCP server and IDE plugin are free
Key ambiguities
Free and lower tiers are public, but exact pricing at higher lines of code bands and for SonarQube Server and Enterprise is quoted through sales.
Related vendors
- Cognition — Maker of Devin, an autonomous AI software engineer
- Aider — Open-source, model-agnostic terminal coding agent that works…
- Anthropic Claude Code — Anthropic's terminal and IDE-native coding agent with sub-agent…
- Augment Code — AI coding assistant evolving into an AI-native engineering platform
- Baz — Agentic coding platform whose AI agents review, govern, and secure…
- Blackbox AI — AI coding assistant for code generation and developer workflows