SonarQube
Code Quality · #1 of 3 in category · #11 of 27 overall
Deterministic static analysis platform (Server and Cloud) with PR decoration and LLM-generated AI CodeFix suggestions.
[ Where it fits ]
On the documented evidence, SonarQube suits teams that need the reviewer inside their own infrastructure, teams that want to read and fork the source.
[ Documented strengths ]
- Rule-Centric & Default Quiet. Deterministic rule engine with per-project quality profiles and gates; flags only configured rule violations.
- Dual-Workflow: Local vs. PR. Same rules locally via SonarQube for IDE (SonarLint) connected mode and in CI with PR decoration.
[ Documented gaps ]
- Business Logic Validation. No issue-tracker or requirements integration; validates code against static rules only.
- Continuous Learning. Issues can be accepted or marked false-positive individually; no generalized learning from team feedback.
- Sandbox Validation. Static analysis only; no sandbox execution or runtime validation of fixes.
[ Facts ]
- Category
- Code Quality
- Open source
- Yes — LGPL-3.0 (Community Build); commercial editions proprietary
- Pricing
- Cloud: free tier up to 50k LoC private, Team from $34/mo (100k LoC), Enterprise custom. Server: Community Build free; Developer/Enterprise/Data Center priced per instance/yr by LoC (quote-based) source ↗
- Self-hosted
- Yes — full stack — SonarQube Server is self-managed, incl. the free LGPL Community Build; AI CodeFix can use a fully self-hosted LLM gateway.
- Platforms
- GitHub GitLab Bitbucket AD Azure DevOps
- Model control
- AI CodeFix: Sonar-hosted GPT-5.1/GPT-4o, your Azure OpenAI/Bedrock, or a self-hosted OpenAI-compatible gateway; core analysis has no LLM
- Last verified
- 2026-08-11
[ Against the 9 standards ]
Based on public documentation as of 2026-08-11. ✓ documented · ~ partial · ✗ not offered · ? undocumented. Undocumented scores zero — see the methodology.
Whole-project analysis with cross-file taint in paid editions; no multi-repo or ticket context.
Deterministic rule engine with per-project quality profiles and gates; flags only configured rule violations.
Same rules locally via SonarQube for IDE (SonarLint) connected mode and in CI with PR decoration.
No issue-tracker or requirements integration; validates code against static rules only.
Issues can be accepted or marked false-positive individually; no generalized learning from team feedback.
AI CodeFix supports customer-managed or self-hosted LLMs; commercial pricing is LoC-based quotes.
AI CodeFix generates fix suggestions for supported rules and languages; many findings remain explain-only.
Tracks code quality metrics and quality-gate trends; no DORA or review-ROI attribution.
[ Closest alternatives ]
[ In our coverage ]
[ FAQ ]
Is SonarQube open source?
Yes. SonarQube publishes its source under LGPL-3.0 (Community Build); commercial editions proprietary, so you can read it, audit it and fork it.
Can SonarQube be self-hosted?
Yes — full stack. SonarQube Server is self-managed, incl. the free LGPL Community Build; AI CodeFix can use a fully self-hosted LLM gateway. Verified against the vendor's own documentation on 2026-08-11.
How much does SonarQube cost?
Cloud: free tier up to 50k LoC private, Team from $34/mo (100k LoC), Enterprise custom. Server: Community Build free; Developer/Enterprise/Data Center priced per instance/yr by LoC (quote-based). Seat price is only part of the bill: SonarQube handles models as ai codefix: sonar-hosted gpt-5.1/gpt-4o, your azure openai/bedrock, or a self-hosted openai-compatible gateway; core analysis has no llm, which is what usually decides the real monthly cost.
How does SonarQube score against the 9-pillar AI code review standard?
4 out of 9. It fully documents 2 standards, partially documents 4, does not offer 3, and leaves 0 undocumented. The score is coverage of documented capability, not a measure of review quality.
What are the alternatives to SonarQube?
The closest tools in this directory are Codacy, DeepSource, Greptile, Qodana. Each is scored against the same 9 standards, so the matrices are directly comparable.
Evaluating SonarQube?
Run it through the two-week trial protocol before you commit a team to it.