> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/agent-centric-development-cycle/solve/remediation-agent.md).

# Remediation Agent

The Remediation Agent is part of Sonar Agent Essentials, a product that requires a separate subscription to your SonarQube Cloud Team (annual) or Enterprise plan.

## Overview

The SonarQube Remediation Agent runs an independent review and analysis to help you fix reliability and maintainability issues found in your latest code, and to remediate dependency vulnerabilities found by Software Composition Analysis (SCA). It focuses on issues in your SonarQube Cloud backlog (discovered in your main branch analysis) and on issues found in your latest pull request (PR).

The agent works with projects bound to GitHub or Azure DevOps. Automated and manual backlog remediation are available on both platforms; pull request remediation is available for GitHub-bound projects only.

The agent generates fix suggestions in the background and checks that the new code doesn't introduce new issues before offering the suggestion. Using the agent requires your own LLM provider API key. See [Configure your LLM provider key](/agent-centric-development-cycle/solve/solve-issues/administer-remediation-agent.md#configure-your-llm-provider-key) for more information.

After issues from your analysis are assigned, the agent proposes fixes and creates new PRs for your review. Enable it per project, then review and approve code suggestions for each issue.

The SonarQube Remediation Agent can suggest fixes in three ways:

* **Automated backlog remediation**: The agent runs on a schedule you set, automatically proposing fixes for eligible issues in your main branch without manual assignment. A SonarQube Cloud organization admin enables the scheduler and sets the frequency (daily or weekly), time, and timezone. The agent then opens pull requests in your repository on that schedule, grouped by rule key and file type, the same way it does for manual backlog remediation. Project admins can override or disable the schedule for individual projects.
* **Manual backlog remediation**: The agent fixes issues you select from your backlog and assign with the **Assign to Agent** button on the **Issues** page.
* **Pull request remediation** (GitHub only): The agent is triggered from a pull request analysis when your quality gate fails.

## Supported languages

The Remediation Agent works with your most common languages (C#, Java, JavaScript/TypeScript, and Python) by providing feedback on maintainability, reliability, and select security issues. In addition, it also offers fix suggestions for [Secrets](https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/languages/secrets). It can also remediate dependency vulnerabilities found by Software Composition Analysis (SCA); see [SCA basic remediation](#sca-basic-remediation) below. See the [Requirements and limitations](https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/ai-features/sonarqube-remediation-agent#requirements-and-limitations) article for complete details.

## Sharing your code with Sonar <a href="#sharing-your-code-with-sonar" id="sharing-your-code-with-sonar"></a>

If you use the SonarQube Remediation Agent, the affected code is processed by Sonar to generate and verify a fix suggestion. Sonar’s remediation service sends the affected code snippet to your provider’s LLM to generate the suggestion, then verifies the generated code.

Because you bring your own [provider key](/agent-centric-development-cycle/solve/solve-issues/administer-remediation-agent.md#configure-your-llm-provider-key), the request is made under your own provider account, so your provider’s usage agreement governs how your data is handled.

For Sonar terms and conditions, see [Early Access terms](https://www.sonarsource.com/legal/early-access/) in our [Legal documentation](https://www.sonarsource.com/legal/).

## Setup

To enable and install the agent, see [Administer the Remediation Agent](/agent-centric-development-cycle/solve/solve-issues/administer-remediation-agent.md).

To understand the agent's behavior and learn how to engage with the agent in your pull request, follow the [Pull request fix suggestions](/agent-centric-development-cycle/solve/solve-issues/pull-request-fix-suggestions.md) and [Backlog fix suggestions](/agent-centric-development-cycle/solve/solve-issues/backlog-fix-suggestions.md) guides.

## SCA basic remediation

The Remediation Agent can fix Software Composition Analysis (SCA) vulnerabilities by bumping the dependency version suggested by the SCA analysis. Triggered by a SonarQube Cloud [Dependency risks](https://docs.sonarsource.com/sonarqube-cloud/advanced-security/reviewing-and-fixing-dependency-risks) analysis, the agent generates a PR for your review.

The following package managers are supported:

* **NPM** — covers npm and yarn
* **PyPI** — covers pip
* **Maven** — covers Maven and Gradle

## Related products

For AI-powered pull request review automation, see [Gitar](https://docs.gitar.ai), a separate Sonar product.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.sonarsource.com/agent-centric-development-cycle/solve/remediation-agent.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.