Overview

Use SonarQube CLI to catch issues before they reach a pull request: scan for secrets, verify local changes against SonarQube Cloud, and apply AI-suggested fixes.

Find problems in your code from your terminal, no CI run required.

Note: Some of these analysis features are in Beta. Check the individual feature page for its current status.

• Secrets scanning
• Analyzing local changes
• AI remediation
• Software composition analysis

Pick the right command

You want to…	Run	Where
Catch hardcoded credentials before they leave your machine	sonar analyze secrets	Anywhere: Cloud, Server, or offline.
See what new issues your in-progress changes introduce	sonar analyze / sonar analyze agentic	Sonar Vortex agentic analysis requires SonarQube Cloud. Secrets detection runs locally and needs no SonarQube connection.
Scan dependencies for vulnerabilities, malware, and prohibited licenses	sonar analyze dependency-risks	SonarQube Cloud. Requires Advanced Security with SCA enabled. This CLI command is in Beta; subject to change.
Have an AI agent propose a fix for an existing issue	sonar remediate	SonarQube Cloud only; requires an organization entitled to the Remediation Agent.

For the full set of options and exit codes, see Commands and Exit codes.

Related pages

• Integrations
• Output formats