Sonar Vortex: agentic analysis

Sonar Vortex's agentic analysis features enable AI agents to verify code changes with the same precision as a full CI scan, but in seconds instead of minutes thanks to a context collection mechanism.

Sonar Vortex's agentic analysis features let your AI agent catch quality and security issues in the code it writes or edits, before that code reaches pull request review or CI. Using these features requires a SonarQube Cloud Team (annual) or Enterprise plan, plus a separate subscription to the Sonar Agent Essentials product.

Overview

Agentic analysis is part of the Verify phase of the Agent Centric Development Cycle. It reuses the context from a previous SonarQube Cloud CI analysis and restores it on-demand for single- or multi-file analysis. This lets AI agents verify code changes with minimal latency while maintaining full CI analysis precision.

Supported languages

Agentic analysis is available for the following languages:

• Java
• Python
• JavaScript/TypeScript
• CSS
• HTML
• XML
• C#
• VB.NET
• C++

Secrets detection and the IaC domains Docker, Kubernetes, and Terraform, are also supported.

Note: If your Java project was analyzed using Automatic analysis, only basic analysis results are returned.

Supported IDEs and CLIs

Agentic analysis is compatible with most AI-enabled IDEs and CLIs including Claude Code, Cursor, Codex, Antigravity, and VS Code with Copilot. See our IDE/CLI quickstart guides for the full list of supported IDEs and CLIs.

Guide-and-verify loop

Using agentic analysis together with context augmentation allows you to build a guide-and-verify loop to ensure pull requests pass quality gates the first time, leading to faster code reviews with no back-and-forth. The loop has three steps:

1. Guide: context augmentation injects architectural awareness and coding guidelines into the LLM context before it writes or edits code.
2. Verify: agentic analysis verifies the resulting code with full CI-level precision.
3. Loop: The LLM refines the code based on analysis results and repeats until quality gates pass.

Setup

To learn how to set up a code verification loop with agentic analysis, see Make your agent verify its code.

About the context mechanism

Agentic analysis achieves high-precision analysis through a two-phase approach: it first collects context during CI analysis, then restores that context on demand.

Phase 1: context collection

During a regular CI analysis, SonarQube may collect and store:

• Dependencies: JAR files, npm packages, or Python libraries the project uses.
• Compiled artifacts: .class files.
• Type information: Symbol tables, type hierarchies, import graphs.
• Build configuration: Project structure, source paths, compiler settings.

This context is stored in the SonarQube Cloud backend (AWS), tagged by project key and branch.

Diagram of how context is stored in the context storage during a CI scan

Phase 2: context restoration

When analyzing files using agentic analysis, the context collected for this project during a CI analysis is restored, based on the specified project and branch name. This lets the analysis run with full access to dependencies and compiled artifacts. Analysis results have a level of precision that matches a full CI scan analysis.

Diagram showing the context restoration process.

Related pages

• Context augmentation
• MCP Server
• Tools