Agentic capabilities

SonarQube Server 2026.5 offers a series of agentic capabilities to help you produce secure and maintainable code.

SonarQube Server comes with a set of agentic capabilities that fit in the Agent Centric Development Cycle (AC/DC), a framework that defines a continuous 3-stage loop for every agent-assisted change.

To learn more about AC/DC and how SonarQube Server features fit in the cycle, see Agent Centric Development Cycle.

SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that connects your AI coding agent to SonarQube Server, giving it access to project context, issue data, and quality status across the Guide, Verify, and Solve stages of the AC/DC cycle.

Host the MCP server centrally on SonarQube Server itself, which requires SonarQube Server 2026.3 or later in the Developer, Enterprise, or Data Center edition. See SonarQube Server-hosted.

Alternatively, run the MCP server yourself: self-hosted, it works with SonarQube Server 2025.1 and later regardless of edition, as well as SonarQube Community Build and SonarQube Cloud, and it's the recommended default for most IDE and CLI integrations. It's also required for Sonar Vortex's analysis and context features. See Self-hosted.

For step-by-step agent setup, see the IDE/CLI quickstart guides for the MCP server.

Sonar Vortex

Sonar Vortex equips your developers' coding agents to write code that fits your project and to check that code as it is produced. It works with coding agents such as Claude Code, Codex, or Cursor, reached through the SonarQube CLI, a SonarQube agent plugin, or a locally running SonarQube MCP Server. To learn more about the concept, see What is Sonar Vortex?.

To use Vortex with SonarQube Server and your own coding agent, you need the Enterprise or Data Center edition and a separate subscription. An Instance admin activates it on the license, deploys the Vortex analysis component, and enables it for the instance.

The Remediation agent uses Vortex analysis to verify the fixes it generates.

Because setup spans several roles, start with the Sonar Vortex page. Once it's enabled, see the Giving developers what they need section to give each developer what they need to connect their own coding agent.

Hunter Agent

The SonarQube Hunter Agent runs a deep analysis of your projects to find vulnerabilities that require human-like understanding of the code, the Verify stage of the AC/DC cycle. It finds flaws such as broken access control and business-logic errors, which static analysis alone cannot see, then raises them as issues you triage like any other.

Available in the Enterprise and Data Center editions, the agent requires a separate subscription. An Instance Admin enables it for the instance and configures its LLM provider with Anthropic Claude Opus 4.8 and Claude Sonnet 4.6, the models the agent requires. Project administrators run analyses and set up scheduled scans for their own project.

Because setup spans several roles, start with the Hunter Agent page. To learn how to view and work through its findings, see the Hunter Agent findings page in the User guide.

Remediation Agent

The SonarQube Remediation Agent proposes fixes for the issues found by analysis, the Solve stage of the AC/DC cycle. Instead of suggesting a change inline, the agent works through your backlog in the background, or fixes the issues in a pull request when its quality gate fails, and opens a pull request in your repository for you to review and approve.

Available in the Enterprise and Data Center editions, the agent requires a separate subscription. An Instance Admin enables it and chooses whether users assign issues to it manually, whether it runs on a schedule, or both. Because setup spans several roles, start with the Remediation Agent page. To learn how to assign issues and track the agent's jobs, see the Backlog fix suggestions and Pull request fix suggestions pages in the User guide.

The Remediation Agent uses Vortex analysis to verify the fixes it generates.

Deploying the agents

The Remediation Agent and the Hunter Agent don't run inside SonarQube Server. They run as separate containers that a system administrator deploys on your own infrastructure, alongside the Agent Orchestrator, shared storage, and Vortex analysis. Until those components are deployed, the agents cannot run even once they're licensed and enabled.

AI CodeFix and the SonarQube MCP Server have no such requirement.

See Deploying AI agents in the Server installation and setup documentation.

AI CodeFix

SonarQube's AI CodeFix uses a large language model (LLM) to suggest fixes for issues found during analysis, the Solve stage of the AC/DC cycle. An Instance Admin enables the feature and chooses the LLM provider: Sonar's hosted models, your own Azure OpenAI or AWS Bedrock model, or a self-hosted gateway.

To turn on the feature and choose a provider, see the Enable AI CodeFix page. To learn how to get fix suggestions for your issues, see the Getting AI-generated fix suggestions article.

For AI-powered pull request review and CI failure analysis, see Gitar, a separate Sonar product.

Registering LLM providers

As an Instance Admin, you register LLM providers once, then you select a provider and a model from that list for each agent that uses one, like the Hunter Agent and the Remediation Agent. You do not need to register an LLM provider for AI CodeFix. Choose its provider directly.

See LLM providers and Enable AI CodeFix.