SonarQube

SonarQube is the algorithmic verification platform for code quality and security. Its static analysis applies techniques such as symbolic execution and data and control flow analysis to inspect your code, find bugs, vulnerabilities, and structural problems, and tell you exactly what to fix and why, in your IDE, your pull requests, and your CI pipeline.

This repository holds the source of the SonarQube Community Build, the free, open-source edition of the SonarQube platform. It shares the same analysis used across the SonarQube product line.

Built for the AI era

AI writes code faster than teams can review it, creating verification debt: code reaching production before anyone has confirmed what it does. SonarQube applies the same consistent, explainable analysis to every line, whether a developer or an agent wrote it. Vibe, then verify: generate fast, then verify what reaches production. It is the verification stage of the Agent Centric Development Cycle, running in the outer CI verification loop to verify code before it merges.

What SonarQube finds

• Bugs and reliability issues that break behavior at runtime.
• Security vulnerabilities and security hotspots, with clear guidance on the risk and the fix.
• Maintainability and structural issues that make code harder to change over time.
• Coverage on new code, so quality improves with every commit instead of stalling behind a backlog.

The SonarQube platform analyzes more than 40 programming languages and frameworks; the Community Build supports a subset of them. Analysis is repeatable, auditable, and explainable: the same code always produces the same findings, every finding is traceable, and each one tells you what the problem is and why it matters.

Commercial editions

SonarQube Server and SonarQube Cloud include everything in the Community Build and add:

Detect more

• More bugs, vulnerabilities, code quality issues, and architecture issues, through broader coverage and deeper analysis.
• More languages and frameworks than the Community Build.
• Software composition analysis (SCA) for vulnerable and risky open-source dependencies.
• Advanced security with deep taint analysis (SAST) that traces vulnerabilities across data flows.
• Secrets detection for leaked credentials, tokens, and keys.
• Infrastructure as code (IaC) analysis for Terraform, Kubernetes, Docker, and CloudFormation.
• Architecture management to define architectural constraints and catch structural violations.

Analyze your whole workflow

• Branch analysis and pull request decoration, so every change is verified before it merges.

Govern, report, and see across teams

• Portfolios and applications that roll up quality and security across many projects.
• Executive dashboards and trend reporting.
• Security and compliance reports, including OWASP Top 10, CWE, and PCI DSS.
• Enterprise governance: enforce Quality Gates and permissions across teams, with full audit trails.

Fix

• SonarQube Remediation Agent to reduce technical debt by fixing SonarQube issues for you, opening verified fix pull requests you can review and merge.

Some capabilities are part of the SonarQube Advanced Security add-on. See the product line for details.

Quality gates

A Quality Gate is a pass-or-fail check on your new code. Set the standard once, and SonarQube enforces it automatically in every pull request and pipeline, so issues are caught before they merge rather than found in production.

The SonarQube product line

The Community Build is free and open source. The wider SonarQube line applies the same analysis across your workflow:

• SonarQube Server, self-managed, with more languages, deeper security analysis, and branch and pull request analysis.
• SonarQube Cloud, hosted, with the same capabilities as a managed service.
• SonarQube for IDE, real-time analysis as you write or generate code.
• SonarQube MCP Server, bringing SonarQube analysis into your AI agent's context.
• SonarQube CLI, running analysis from the command line.

Compare SonarQube plans and pricing to choose the appropriate product and deployment model.

Product links

• Website
• Download
• Documentation
• X
• SonarSource, author of SonarQube

FAQ

Is the Community Build free? Yes. It is free and open source, and this repository is its source.

What is the difference between the Community Build and SonarQube Server? The Community Build is the free, self-managed engine. SonarQube Server and SonarQube Cloud are the commercial editions. They cover more languages and add branch and pull request analysis, software composition analysis (SCA), architecture management, advanced security with taint analysis (SAST), secrets detection, infrastructure as code (IaC) analysis, the SonarQube Remediation Agent for verified fix pull requests, and enterprise reporting. Some capabilities are part of the SonarQube Advanced Security add-on. See the product line for details.

Does it work on AI-generated code? Yes. SonarQube applies the same analysis to all code, whether a developer or an agent wrote it.

Project links

• Webapp source code
• Issue tracking, read-only. Only SonarSourcers can create tickets.
• Responsible Disclosure

Have Questions or Feedback?