Sonar makes SonarQube, a code verification and automated code review platform used by development and security teams to check the quality and security of source code before it ships.
The problem it addresses is trust in code that nobody fully reviewed. Teams now merge code from developers and from AI assistants, and both can introduce bugs, insecure patterns and exposed credentials. Sonar gives them one set of standards to hold all of that code to.
At A Glance
| Vendor | Sonar (SonarSource Sàrl) |
|---|---|
| Category | Code quality and code security, DevSecOps |
| Deployment | SonarQube Server (self-managed, Docker or Kubernetes) and SonarQube Cloud |
| Agentic AI | MCP Server, Hunter Agent, Remediation Agent, Sonar Vortex, Gitar |
| Customers | Mercedes-Benz, Nvidia, Goldman Sachs, Santander, Barclays |
| Market classification | DevSecOps |
What Sonar Does
SonarQube acts as a verification layer between writing code and shipping it. The approach is to check every change as early as possible, first in the editor and then in the pull request and the pipeline, and to stop code that fails agreed quality gates from merging. Findings are reported against recognised standards such as NIST SSDF, OWASP and CWE, so the same results serve developers and auditors. Sonar now applies the same checks to coding agents while they work, rather than only after they hand code back.
Products
SonarQube Server
SonarQube Server is the self-hosted edition for organisations that want code analysis on infrastructure they control. It inspects every change in CI/CD workflows, runs static application security testing, finds secrets such as tokens and keys, blocks merges that fail quality gates and produces the compliance reports auditors ask for.
SonarQube Cloud, IDE And CLI
SonarQube Cloud is the hosted service for teams that prefer not to run the server themselves. SonarQube for IDE is an editor extension that flags problems as developers type and suggests fixes, so most issues never reach a pull request. The SonarQube CLI brings the same checks to the terminal.
SonarQube Advanced Security
Advanced Security covers the software supply chain. It detects vulnerable and malicious open source packages, manages licences, works out whether a vulnerable function is actually reachable, and exports SBOMs in CycloneDX and SPDX formats. Its advanced SAST follows tainted data into dependencies to uncover vulnerabilities that span first-party and third-party code.
AI Agents And AI Code Review
Remediation Agent works through technical debt in the background. Gitar AI Code Review reviews pull requests and proposes fixes. Sonar Vortex supports agentic coding loops by giving coding agents context and checking their output, a design Sonar sums up as an “AC/DC system for agentic loops”. Hunter Agent runs a deep analysis of a project to find logic flaws in access control, business logic and authentication, following data and identity flows across files and validating each suspected vulnerability before adding it to the SonarQube issue list.
SonarQube MCP Server
The MCP Server lets coding agents query SonarQube while they write or review code. It works with the AI coding agents and IDEs listed under Integrations. Tools include analyze_code_snippet, list_quality_gates, get_project_quality_gate_status and search_sonar_issues_in_projects.
How It Works
SonarQube reports issues, quality gates and security findings into the tools developers already use.
| Component | What it does |
|---|---|
| SonarQube Server | Runs on-premises or in the organisation’s own cloud, deployed with Docker or Kubernetes. |
| SonarQube Cloud | Hosted analysis with an embedded MCP endpoint that offers a fixed subset of tools. |
| CI/CD | Analysis runs as a step in the organisation’s existing pipelines, and results flow back to the pull request. |
| MCP Server | Runs locally as a Docker container that bridges the IDE and SonarQube, through SonarQube Cloud, or on SonarQube Server as an extension that exposes tools at a /mcp path. |
Integrations
| Area | Integrations |
|---|---|
| CI/CD and DevOps platforms | GitHub Actions, GitLab CI/CD, Azure DevOps, Bitbucket Pipelines |
| AI coding agents | Claude Code, Cursor, Devin, GitHub Copilot, Antigravity, Codex |
| MCP clients and IDEs | Windsurf, VS Code, Gemini CLI, Zed, Visual Studio, IntelliJ IDEA, PyCharm, CLion, Amazon Q, Kiro |
Company Background
| Legal entity | SonarSource Sàrl |
|---|---|
| Founder | Olivier Gaudin, Founder and Chairman |
| Leadership | Tariq Shaukat (Chief Executive Officer), Andrea Malagodi (Chief Technology Officer), Jean Compeau (Chief Financial Officer), Ori Yitzhaki (Chief Product Officer) |
| Reach | A reported more than 7M developers and 75% of the Fortune 100, with more than 40 languages and frameworks covered |
Note: This overview is compiled from Sonar’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.