Overview

Use SonarQube CLI to catch issues before they reach a pull request: detect secrets, verify local changes against SonarQube (Server, Cloud), and apply AI-suggested fixes.

Find problems in your code from your terminal, no CI run required.

• Secrets scanning
• Analyzing local changes
• AI remediation
• Software composition analysis

Pick the right command

You want to…	Run	Where
Catch hardcoded credentials before they leave your machine	sonar analyze secrets	Anywhere: Cloud, Server, or offline.
See what new issues your in-progress changes introduce	sonar analyze / sonar analyze agentic	Vortex analysis requires a SonarQube Cloud Team or Enterprise plan, or a SonarQube Server 2026.5 Enterprise or Data Center edition. Secrets detection runs locally and needs no SonarQube connection.
Scan dependencies for vulnerabilities, malware, and prohibited licenses	sonar analyze dependency-risks	SonarQube Cloud, or SonarQube Server 2026.4 or later. Requires Advanced Security with SCA enabled.
Have an AI agent propose a fix for an existing issue	sonar remediate	SonarQube Cloud Team or Enterprise plan, or a SonarQube Server 2026.5 Enterprise or Data Center edition; requires a subscription to the Remediation Agent.

For the full set of options and exit codes, see Commands and Exit codes.

Related pages

• Integrations
• Output formats