Sonar

Integration spans IDEs through SonarQube for IDE plugins, CI and source platforms including GitHub, GitLab and Jenkins, and agent runtimes through the MCP server, which connects Claude Code, Codex CLI, Cursor, Gemini CLI, GitHub Copilot CLI, GitHub Copilot Cloud Agent, Kiro, VS Code, Windsurf and Zed, with Devin also reported; Agent Apps for GitHub run the SonarQube agent directly on the platform, dedicated agent plugins ship for Claude Code, Cursor and Codex CLI, and a CLI plus hooks cover scripted and agentic environments. Gitar posts review comments directly into pull requests.

Sourcesonarsource.com/products/sonarqube/mcp-server and docs.sonarsource.com/agent-centric-development-cycle/developer-tools/agent-pluginsread 2026-08-30

The Agent Centric Development Cycle defines a fixed continuous three-stage loop applied to every AI-assisted change, Guide providing project context to agents before they write, Verify analyzing the resulting code, and Solve fixing what verification found; the Remediation Agent chains detection, fix, re-verification and opening a pull request, and Agentic Analysis runs verification inside the agent's inner loop. This is a defined pipeline the vendor ships rather than a workflow the customer composes: no multi-agent coordination, branching logic, customer-defined stages or agent handoff is documented.

Sourcedocs.sonarsource.com/agent-centric-development-cycle and docs.sonarsource.com/sonarqube-cloud/ai-capabilitiesread 2026-08-30

Context Augmentation forms the Guide stage of the Agent Centric Development Cycle, providing project context to agents before they write or edit code, exposed through the MCP server as code architecture search, call flows, coding guidelines and SCA dependency checks; analysis is grounded in full project context together with the organization's own quality profiles, rule sets and architecture standards, and SonarQube Architecture enforces architectural standards as a distinct product. Context Augmentation and Agentic Analysis are SonarQube Cloud add-ons.

Sourcedocs.sonarsource.com/agent-centric-development-cycle and docs.sonarsource.com/sonarqube-mcp-serverread 2026-08-30

Oversight is by gate and review, not by an approval step inside Sonar: organization-defined quality gates block merges that fail deterministic checks, AI CodeFix is switched on by an admin for all or selected projects, and the Remediation Agent proposes its fixes as a new pull request for the customer to review on its own code host. A quality gate is a constraint and review of the agent's pull request is the customer's own merge gate, and no step where a person approves an agent action before Sonar executes it is documented.

Sourcedocs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-features and /administering-your-projects/ai-features/enable-ai-codefixread 2026-09-29

The trust center states that at the company level Sonar maintains ISO 27001:2022 certification and a SOC 2 Type II attestation for all products and services, with both available from its security profile and the SOC 2 report under NDA. The access surface is documented for SonarQube Cloud Enterprise: SSO with SCIM provisioning, organization, portfolio, project and enterprise permissions with permission templates, IP allow lists, customer-managed encryption keys with rotation, and audit logs of sign-ins and permission changes.

Sourcesonarsource.com/trust-center and docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/enterprise-securityread 2026-09-29

Every Remediation Agent run is recorded on an Agent activity page with its status and duration, what started it (the backlog schedule, Fix with Agent or Fix automatically on a failed gate), where it worked and a link to its pull request; Enterprise audit logs, readable through an API, record sign-ins, user, group and permission changes and key rotation events; and deterministic findings trace to a named rule and code location. That is a per run record of the agent and an administrative log, not a per step or per tool call record of what the agent did.

Sourcedocs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-features and /administering-sonarcloud/enterprise-security/audit-logsread 2026-09-29

Analysis state persists between runs: the baseline from the last full project scan carries forward so subsequent analyses evaluate new code against it, issue history and dispositions such as accepted or won't-fix persist per project, and quality profiles and gates are stored organization-wide and applied consistently across runs. This is project and analysis state rather than agent memory; no memory carrying learned context, corrections or preferences across agent sessions is documented.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities and docs.sonarsource.com/agent-centric-development-cycleread 2026-08-30

SonarQube Server is a self-managed deployment priced per instance and installable in the customer's own environment, alongside SonarQube Cloud as SaaS and a free IDE plugin; the MCP Server installs as an extension on SonarQube Server 2026.3 and later so the customer's own server proxies agent tools at its own /mcp endpoint, or self-hosts standalone via the official container image, keeping the agentic surface inside the boundary. Gitar retains no code after processing and supports bring your own Anthropic key. MCP telemetry excludes source code and IP address and is disableable.

Sourcedocs.sonarsource.com/sonarqube-mcp-server and sonarsource.com/products/sonarqube/mcp-serverread 2026-08-30

Sonar ships prebuilt rule sets and quality profiles covering more than forty languages, maintained by Sonar and adopted by the customer as defaults or customized, together with prebuilt quality gates and architecture standards, and compliance rule mappings for OWASP, CWE and STIG, PCI DSS and CASA; dedicated agent plugins and slash commands ship for named harnesses including Claude Code, Cursor, Codex CLI and Gemini, and Agent Apps for GitHub package the SonarQube agent for direct installation on the platform.

Sourcedocs.sonarsource.com/agent-centric-development-cycle/developer-tools/agent-plugins and docs.sonarsource.comread 2026-08-30

Analysis runs automatically on CI builds and pull requests through GitHub, GitLab and Jenkins, and the Remediation Agent starts on an Automated backlog remediation schedule, from Fix with Agent on the Issues page, or from Fix automatically in a failed quality gate comment on a pull request; Agentic Analysis runs inside a coding agent's loop, and developers and agents invoke analysis through IDE plugins, the CLI and MCP tool calls.

Sourcedocs.sonarsource.com/sonarqube-cloud/managing-your-projects/issues/with-ai-features and /agent-centric-development-cycleread 2026-09-29

Core static analysis is deterministic and rule-based with no model involved, so model choice does not arise for the majority of the product; the LLM-powered surfaces, AI CodeFix for fix suggestions and Gitar for pull request review, support bring your own Anthropic key so enterprises run those calls on their own provider agreement, and AI CodeFix is enabled per organization by an admin rather than per developer. No selection across multiple model providers, no per-task routing and no local model option is documented.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities and sonarsource.com/company/press-releases/sonar-acquires-gitarread 2026-08-30

The SonarQube MCP Server connects an AI coding agent to SonarQube's code quality and security data as a documented tool bag, with tools to analyze code, retrieve issues, check quality gates, inspect security hotspots and measure coverage; it works with Claude Code, Codex CLI, Cursor, Gemini CLI, GitHub Copilot CLI, GitHub Copilot Cloud Agent, Kiro, VS Code, Windsurf and Zed, and powers the SonarQube agent through Agent Apps for GitHub.

SonarQube Cloud includes a hosted MCP server needing no local setup; on SonarQube Server 2026.3 and later it installs as an extension so the server proxies tools at a single /mcp endpoint. A SonarQube CLI supports real-time scanning in agentic environments, alongside IDE plugins, hooks and agent plugins for Claude Code, Cursor and Codex CLI. Source-available under the SONAR Source-Available License v1.0.

Sourcedocs.sonarsource.com/sonarqube-mcp-server and sonarsource.com/products/sonarqube/mcp-serverread 2026-08-30

Deterministic rule-based static analysis checks code against quality and security standards across more than forty languages, spanning SAST, secrets detection, software composition analysis and architecture enforcement, tracking test coverage and re-verifying every fix before merge; Agentic Analysis brings verification into the agent's inner loop so agents check their own work as they write, AI CodeFix suggests LLM-generated fixes for found issues under organization admin control, and the Remediation Agent fixes issues and opens verified pull requests.

Gitar, acquired May 2026, adds narrative pull request review posting comments directly on pull requests. Vendor-reported outcomes of 44 percent fewer AI-caused outages and up to 8 percent lower agent token usage carry no published methodology.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities and sonarsource.com/company/press-releases/sonar-acquires-gitarread 2026-08-30

The product operates on source code within developer, CI and agent environments through programmatic interfaces throughout: static analysis of repositories, MCP tool calls, IDE plugins, a CLI, CI integrations and source platform APIs. No browser control, screenshot capture, visual verification or operation of software lacking a programmatic interface is documented on the AI capabilities documentation, the MCP server documentation or the product pages.

Sourcedocs.sonarsource.com/sonarqube-cloud/ai-capabilities and docs.sonarsource.com/sonarqube-mcp-serverread 2026-08-30