Hunter Agent

Enable the SonarQube Hunter Agent for your organization and projects so it can run AI-powered analyses that uncover complex, logic-level vulnerabilities.

The SonarQube Hunter Agent runs an AI-powered analysis that uncovers complex, logic-level security vulnerabilities that pattern-based analysis misses. To learn how the agent works, see Hunter Agent in the Agent Centric Development Cycle documentation.

The Hunter Agent is a product that requires a separate subscription to your SonarQube Cloud Enterprise plan. To trial or purchase Hunter Agent, contact our Sales team.

Prerequisites

• A SonarQube Cloud organization on the Enterprise plan
• Your organization bound to a supported DevOps platform (GitHub, GitLab, or Azure DevOps)
• The project you want to scan bound to its DevOps platform
• The Administer Organization permission, to enable the agent for your organization and to allow project admins to enable scheduled scans
• The Administer permission on the project, to turn the agent on for that project, run analyses, and — once the organization allows it — set up scheduled scans

Enable Hunter Agent for your organization

Make sure you have the Administer Organization permission.

1. In SonarQube Cloud, go to your organization > Administration > AI capabilities.
2. If your organization is not yet bound to a DevOps platform, follow the prompt to bind it. The agent cannot be enabled until the organization is bound.
3. Activate the Allow project admins to enable scheduled scans option.

Once enabled, the Hunter Agent section lists the projects that have the agent turned on, so you can see which projects are covered.

Running analyses with Hunter Agent

If you're running the first Hunter Agent analysis for your project, see First analysis recommendations to avoid failing your quality gate on the main branch.

Make sure you have the Administer permission on the project. You can then run Hunter Agent analyses manually or set up scheduled analyses.

1. Open the project you want to scan.
2. Go to Analysis > Hunter Agent on your project.
3. If you see a message that the agent isn't enabled, ask an administrator to enable it first, using the link in the message.
4. If the project isn't bound to its DevOps platform, bind it first, following the prompt.
5. Run a Hunter Agent analysis manually or schedule analyses:

   • Manually: Choose the branch to scan from the heading branch selector then click Scan Now.
   • On a schedule: Click Manage scheduling in the page header. Turn on scheduled scans, then choose the branch to scan, the frequency, and the time and timezone.

First analysis recommendations

SonarQube Hunter Agent raises its findings as regular issues. Running your first analysis directly on the main branch can cause a passing quality gate to fail and block your team before you've had a chance to work through the findings.

To roll out the agent without disrupting your main branch:

1. Start on a dedicated branch. For your first analysis, choose a dedicated branch instead of your main branch and then select Scan now. The findings surface as issues on that branch, so they don't affect your main branch's quality gate.
2. Work through the backlog. Triage, assign, and resolve the findings the agent raises, the same way you handle any other issue.
3. Schedule analyses on the main branch. After your fixes are merged into the main branch and the number of open findings is under control, set up scheduled analyses so the agent keeps covering it.

This approach keeps the first wave of findings off your main branch. It gives your team time to clear the backlog and brings the agent into your main-branch quality gate only once the results are manageable.

Viewing agent activity

Track SonarQube Hunter Agent runs on the Activity tab of the project's Hunter Agent page. The table lists each run with the time it started, the branch it ran on, and its outcome. It shows SonarQube Hunter Agent runs only.

Related pages

• AC/DC: Hunter Agent
• Hunter Agent findings