Overview
SonarQube analyzes source code and pull requests for bugs, vulnerabilities, security hotspots, code smells, and maintainability issues. Teams use quality gates and reports to place automated checks in CI/CD pipelines and review changes before release. It supports many common programming languages and can report issues at project and branch level. SonarQube Server is self-managed, while SonarQube Cloud provides a hosted option. The main SonarQube repository is open source under LGPL-3.0. SonarSource also documents AI-oriented integrations, including an MCP server and remediation features for agent workflows.