|
Getting your Trinity Audio player ready...
|
Recently, there have been many changes at Sonar (the vendor behind SonarQube).
New versions have been released and new tools have been added – so I decided to take a moment to organize things,
and explain what SonarQube’s current product portfolio offers,
as well as our added value as their representative (and of additional developer assistance tools).
I am writing a brief overview here for every product / solution available, along with links for deeper reading
(and we’ll be happy to answer any questions as needed – contact details below).
This article is updated for version 2026.5 released in October 2026, and includes it.
1) SonarQube Server
SonarQube Server – the long-standing and well-known product:
Static application security testing (SAST) and static code analysis to improve code quality and code security,
measure code complexity, and reduce technical debt.
The product supports over 40 programming languages and frameworks.
It also supports AI-generated code and can fix code bugs using AI – even in air-gapped / closed networks.
The product includes a wide range of rules tailored to every programming language or framework.
It also offers a variety of security compliance reports and popular standards for Code Security,
such as MISRA, OWASP, CWE, PCI, and more.
Available in several editions and options.
Our detailed explanation can be found here and you can also request a detailed comparison table of all editions from us
(contact details below).
2) Advanced Security
SonarQube Server can be expanded with “Advanced Security”
which includes detecting vulnerabilities in libraries and third-party code (SCA), license identification,
compliance risks and deviations from organizational licensing policy,
unauthorized license usage detection in open source (License Compliance),
obtaining SBOM (Software Bill of Materials) reports,
reachability information, and more.
This product also includes “Advanced SAST“, which expands data flow analysis to third-party dependencies, as well as detecting malicious packages.
This product is available as self-hosted and in the cloud.
Our detailed article regarding these capabilities can be read here.
3) SonarQube Cloud / SonarCloud
These capabilities are also available as a SaaS / SonarCloud solution (public cloud),
and there is an additional option often considered best-of-breed – a combination of managed self-hosted (in a private cloud),
allowing us to provide you with a fully managed solution that we maintain for you.
For further details, feel free to contact us (our details below).
4) SonarQube for IDE / SonarLint
SonarQube for IDE (also formerly known as SonarLint) is a free extension that brings static analysis and security checks directly into the developers’ IDE through notifications – working with popular IDEs such as:
VS Code, JetBrains, Visual Studio, Cursor, Windsurf, Eclipse, and more.
The tool is essentially a Linter that continuously identifies bugs, code smells, and security vulnerabilities
(insecure code) while typing,
both in human-written code and AI-generated code.
SonarQube for IDE provides contextual explanations and Quick Fixes to resolve issues prior to committing, significantly shortening feedback loops and reducing Code Review overhead.
SonarQube for IDE also features a “Connected Mode” – which synchronizes with the organization’s SonarQube server, ensuring quality rules (Quality Profiles) and standards are consistent between local machines and CI/CD, guaranteeing consistency throughout the development process. Maximizing IDE capabilities in this mode requires server-side licensing.
Here you can watch a short demo of SonarQube for IDE.
5) Gitar AI
About a year ago, Sonar acquired Gitar AI – a tool that performs smart Code Reviews using AI
effectively solving the code review bottleneck created today by AI-assisted code writing.
Watch/listen to a short recorded overview:
For further reading: Explanatory article and recorded overview: What is Sonar Gitar and how it helps Code Review
For further details regarding licensing and pricing, feel free to contact us (details below).
6) Sonar Vortex
A new tool named Sonar Vortex enables extending AI Context for code quality improvement and cost savings.
Vortex is a relatively new Sonar product, designed to make AI-based code agents efficient, controlled, and secure through deep integration with SonarQube and an agent-guided development loop.
Vortex unifies Context Augmentation and Agentic Analysis capabilities into a single product running inside the agent’s inner loop – at an early stage and in real time – complementing later checks in Pull Requests (Merge Requests) or classic CI.
It complements CI checks by executing additional checks earlier in the cycle.
For further reading: Explanatory article and recorded overview: What is Sonar Vortex
7) Sonar CLI / MCP Server
There is a tool named Sonar CLI , which also acts as an MCP Server. It is a free, open-source tool that connects to your SonarQube environment and helps you implement development workflows and automation including AI integration and agents.
Note that to get the most out of it, it is recommended to use commercial editions, which include more analyzers and scanners, and more capabilities available via the CLI. Further details here.
8) Hunter Agent
A few months ago, Sonar unveiled a new tool called SonarQube Hunter Agent:
an AI-based security agent extending SonarQube capabilities through deep source code analysis.
It is designed to identify logical vulnerabilities that traditional SAST tools struggle to spot, such as authorization bypasses, IDOR, business logic flaws, authentication issues, and session management flaws.
The agent scans the codebase, tracks data and control flow, formulates hypotheses on attack vectors, and verifies their severity.
This is a complementary add-on to SonarQube (paid separately), available for self-hosted SonarQube Server as well as SonarCloud.
Short 4-minute explanation:
9) Remediation Agent
Another tool available for a few months is SonarQube Remediation Agent:
an agent handling existing findings, generating fixes, re-verifying them using the Sonar engine, and opening Pull Requests for review.
It’s important to distinguish it from AI CodeFix (included in SonarQube Enterprise):
CodeFix suggests a fix for a selected finding, whereas Remediation Agent enables a broader workflow of resolving findings and creating PRs.
Fix verification via Remediation Agent does not execute your test suite (SCA), and is currently available in the cloud only.
Short 4-minute explanation:
10) Consulting, Implementation, Support & More
We also offer extensive expertise in Sonar through our professional team, assisting with consulting, onboarding/implementation, practical application of secure code standards, installations, integrating into development workflows,
building HA solutions, connecting to complementary tools such as
Git, GitLab, GitHub, Azure DevOps, Jenkins, artifact repositories, Docker, Kubernetes, Jira, LiteLLM,
connecting to dashboard/metrics tools, and additional security tools.
For further details, please contact us.
11) SonarSweep
In the near future, a new product called SonarSweep is expected, tasked with improving existing models,
and aimed at organizations and AI labs training or fine-tuning code-generation models.
This solution enhances the quality of code repositories used for training.
It is not a standard plugin for project scanning in SonarQube.
Additionally, more tools from the vendor will be coming soon – stay tuned for our updates, or subscribe to our newsletter to stay informed.
We officially represent Sonar solutions and offer licenses, consulting, support and training.
For more details, contact us: sonar@almtoolbox.com or call us: 866-503-1471 (USA / Canada) or +31 85 064 4633
Relevant Links:
- Webinar recording reviewing Sonar (2026)
- Our Sonar webpage
- New: Sonar Vortex – Expanding AI Context to improve code quality and save costs
- Overview of Sonar MCP Server
