Introducing Sonar

Steve — Wed, 28 Oct 2026 19:00:30 +0000

If you've worked on a team with a CI pipeline in the last 18 years, there's a good chance SonarQube has failed one of your builds. That part hasn't changed. What has changed is who writes the code. Here's what Sonar looks like when your teammate is an agent.

For those about to ship: Sonar's Agent Centric Development Cycle (AC/DC)

Sonar's Agent Centric Development Cycle (AC/DC) is the simplest way to understand what Sonar does in 2026 and where each of our products fits.

The problem

Code is becoming more and more abundant from AI-driven and AI-assisted development and now, software factories.

The former dev-written 300-line pull request is now an over 1,000-line AI-assisted one. When Sonar surveyed developers, they said 65% of the code they commit is AI-generated or assisted (source). And PRs written by agents wait 5.3× longer than unassisted ones before a reviewer even picks them up, per LinearB.

The bottleneck is now verification. It usually happens too late: failing tests, rework, and security findings show up after the agent has moved on, and the code that's left behind is the developer's problem. We call this verification debt.

The Agent Centric Development Cycle (AC/DC)

Every loop runs the same three stages:

Guide: give the agent the right context before it writes.
Verify: check the output with zero-trust, multilayered verification, never with the model that wrote it.
Solve: fix what's left, then feed what you learned into the next round.

That loop runs in three places:

Loop	Where it runs	When
1. Agentic loop	Inside your coding agent	While it writes
2. CI verification loop	At the pull request	Before merge
3. Code maintenance loop	In the background	On code you've already merged

Loop 1: Inside your agent

Sonar Vortex 🌀

Agents don't know your architecture, standards or which packages are safe. Vortex gives context to the agents before they write and checks every file as they write. Customers report up to 92% fewer issues introduced by the agent, and Sonar's benchmarks show up to 36% fewer tokens on navigation-heavy refactoring tasks.

Also in this loop, and free: SonarQube for IDE flags issues as you (or your agent) type in VS Code, Cursor, JetBrains, and other IDEs. The SonarQube MCP Server and SonarQube CLI let agents like Claude Code, Cursor, and Codex call SonarQube analysis directly.

Loop 2: At the pull request

SonarQube - Deterministic quality gates ⛩️

What Sonar is known for. The deterministic quality gate for every change, across 45+ languages and frameworks. It runs as SonarQube Cloud or SonarQube Server.

SonarQube Advanced Security 🔐

Checks every installed open-source package for vulnerabilities, malware and license risk, and follows untrusted data into your dependencies. Reachability shows which vulnerabilities your code actually calls, so you can fix those first.

It's an add-on product that extends SonarQube's core security capabilities (SAST, taint analysis, secrets detection, IaC scanning) with Advanced SAST and Software Composition Analysis (SCA).

Gitar - The code verification agent 🔎

Gitar reviews every PR with the context of your codebase and your team's conventions, and it's tuned for signal: one consolidated comment, with inline notes only where they matter. Because it reads what a change is trying to do, it catches the logic and behavior bugs that deterministic rules aren't built for. SonarQube covers the known issues; Gitar covers intent. Together they form multilayered verification: deterministic analysis for known issues, agentic review for intent, and neither trusts the agent to check its own work.

When CI breaks, Gitar reads your pipeline, separates real breakage from flaky tests and infrastructure noise, and finds the root cause. Then it commits a fix to the branch, within the rules you define, and keeps going until CI is green. You write those rules in plain English, and they live in your repo next to your code. It works with GitHub, GitLab, Bitbucket, and Azure DevOps, and with the CI you already run: GitHub Actions, GitLab Pipelines, CircleCI, Buildkite, Jenkins, and more.

Loop 3: In the background

SonarQube Hunter Agent 🏹

Hunter Agent is an AI security agent built for this class of flaw: broken access control (like IDOR), business logic abuse (skipped workflow steps, missing rate limits), and authentication and session gaps. It works like a security researcher, running Sonar's security playbooks across your whole codebase and following data and identity flows between files. It confirms every lead before reporting it, which gets it to 90% precision. And it's repeatable: scan twice, get the same results.

Confirmed findings land in your SonarQube issues with a severity, a plain explanation, and the exact line, ready to assign and fix. So far it has uncovered 200+ zero-day vulnerabilities in open-source applications.

SonarQube Remediation Agent 🛠️

Every codebase has a backlog of known issues nobody gets to. The Remediation Agent works through it. Pick issues in SonarQube by severity, or project and send issues in batches, or put it on a daily or weekly schedule. It also picks up PRs that failed their quality gate.

For each fix, it applies the change in a sandbox and re-runs Sonar's analysis, the same engine that raised the issue. If the issue isn't gone, or a new one shows up, the fix is thrown away. Only fixes that pass your quality gate become pull requests, grouped by rule and file type so one review covers a batch. It never merges: your branch protection and reviewers apply as usual.

Tutorial: Get riffing with Gitar 🎸

If you want to see one of these loops running today, I'd start with Gitar. There's a free 14-day trial, and it doesn't require a credit card.

Step-by-step using GitHub

Sign in at app.gitar.ai using GitHub.
Connect your code. On GitHub you install the Gitar app, then choose all your repos or just a few. GitLab's a bit different. There, you make a personal access token for a dedicated user (a service account works too) and paste that into the Gitar dashboard.
Now open a PR. Already have a few open? Gitar can run on those, straight from the dashboard.
Wait a couple of minutes. gitar-bot 🤖 leaves a summary comment on the PR, plus inline comments where it found something.

See something in there you want fixed? Tell it. A plain reply on the comment is enough, and Gitar comes back with a new commit. Want it to apply fixes without asking? Post this as a comment on the PR:

gitar auto-apply:on

On Bitbucket or Azure DevOps? Setup for both is in the Gitar docs.

TL;DR

AI agents write code fast, verifying and shipping that code is the bottleneck.
Sonar runs one loop (Guide, Verify, Solve) in three places: in your agent, at the pull request, and in the background.
Each product has a home in one of those places, and SonarQube's analysis runs under all three.

Want more? Check out our Developer Guides or our blueprints on github.com/sonar-samples and get started.

The Power of Clean Code, by Sonar CEO Olivier Gaudin

Sonar Blog — Fri, 07 Apr 2023 16:20:49 +0000

We relaunched our website earlier this year and started to talk about Clean Code—a term you may have casually used or heard before but may not have synthesized or internalized its true essence. In this post, I will discuss Clean Code and why it matters.

The world runs on code

Software is at the core of every organization and is used to operate its business. Companies realize that the DNA of their software—the source code—is what really matters. It is the most valuable asset of software. Source code not only directs how the application will behave but also how it will perform. Keeping this asset clean will prevent it from becoming a liability.

What is Clean Code?

At a very high level, there are two “qualities” of software that you directly control with source code:

How the software will evolve, i.e., what is its intrinsic level of changeability. This is such an important criteria that it’s even embedded in the name: ‘soft-ware’. If you cannot change the software anymore, you should probably call it something else!
How the software will perform when being executed, i.e. will it be robust, reliable, secure, safe? In other words, will it perform correctly?

What is also interesting with Clean Code, is that Clean can mean two things, depending on how it’s used:

as an attribute, it refers to the state of the code, i.e., code that does not contain problems and is flawless.
as a verb, it refers to the practice of improving existing code.
We love and embrace this multiplicity!

At Sonar, this is how we look at code, all code.

Imagine a world of Clean Code

Would things be any different if your application’s source code consistently followed high standards?

Maintenance time and costs would be drastically reduced

Not only that, but technical debt would be non-existent and the need to remediate would be absent. Making any change to the application would be so much faster. Instead of constant re-work, developers could be spending more time on innovation and solving interesting and important problems.

*Developers’ work environment would be better
*

As code follows best practices, imagine how easy and pleasant it would be to own this source. Collective code ownership would become the norm–generating emulation and collaboration between developers.

Developers spend most of their time reading and writing code, and having this code clean would mean a significant upgrade to their work environment.

Software longevity would noticeably increase

A clean codebase would make it easier to introduce changes. No more tangled or rigid code and no more fear or frustration around it. The ‘soft’ attribute of code can continue to support changes in business without the need for it to be replaced (which can be costly and disruptive for organizations).

*Risks at runtime would be reduced
*
Operational bugs as well as late security vulnerabilities would not crop up when software is ready for production. This would significantly reduce the risk surface for organizations.

Clean Code provides benefits for every stakeholder.

Concluding thoughts

Software is eating the world. Keeping your code clean creates a better development and operational environment for everyone. Source code is your key asset – build it clean, clean it as you code – avoid it from becoming a liability. The Clean Code movement has begun and Sonar is leading the way.

Discover more on our unique approach here:
https://www.sonarsource.com/solutions/our-unique-approach/?utm_medium=social&utm_source=devto&utm_campaign=blog&utm_content=230405

DEV Community: Sonar