Hunter Agent

Set up the SonarQube Hunter Agent on SonarQube Server 2026.5, from deploying the agent to enabling it for your projects.

SonarQube Hunter Agent runs a deep AI-powered analysis of your projects to find vulnerabilities that require human-like understanding of the code, such as broken access control and business-logic flaws, then raises them as issues you triage like any other.

To learn how the agent works, see Hunter Agent in the Agent Centric Development Cycle documentation. For subscription and consumption details, see Subscription and consumption.

Subscription and consumption

Subscription requirements

The Hunter Agent is sold as a separate product alongside your SonarQube Server Enterprise or Data Center edition. Once purchased, it's added to your license as an additional feature. See the Sonar product subscriptions page for details about adding a subscription. Your SonarQube Server license must be activated through LicenseSpring, either online or offline; the Hunter Agent is not available with a server ID-based license.

Your Hunter Agent subscription supports overage, letting you keep running scans past your base allowance for an extra cap you set yourself, which resets at the end of your contract term. See the Overage activation page to activate it. Overage requires online license connectivity and is not available on a server ID-based license. Your base allowance and overage cap are both measured in scan units.

What counts as a scan unit

A scan unit is the unit the Hunter Agent consumes to analyze a codebase. Scan units are drawn from your base allowance first and, if overage is active, from your overage cap. Each time the agent analyzes a project, it consumes scan units based on the project's size in LOC definition. Sonar groups codebases into size ranges rather than calculating scan units per line: scanning a larger codebase generally consumes more scan units.

Codebase size	Lines of code (LOC)
XS	Up to 1,000
S	1,001–10,000
M	10,001–100,000
L	100,001–500,000
XL	500,001–1.5 million
XXL	More than 1.5 million

The exact number of scan units each tier consumes depends on your subscription and whether you bring your own LLM provider key.

See the Sonar product subscriptions page to manage your scan unit usage.

Setup overview

Setup spans several roles. Complete the steps in order.

Step	Task	Who does it	Where
1	Add the Hunter Agent to your license	Instance administrator	License management
2	Deploy the agent	System administrator	Deploying AI agents
3	Add an LLM provider, then choose Opus 4.8 as the agent's primary model. The agent also uses Sonnet 4.6 as a secondary model, so make sure both models are available to your provider and key. Check your provider's documentation for the exact identifier or deployment name of each model, and enter that value in the model field on the Hunter Agent page.	Instance administrator	AI Capabilities > LLM Providers (see LLM providers), then Enabling the agent
4	Enable the agent	Instance administrator	Enabling the agent
5	Set up scheduled scans for a project	Project administrator	Hunter Agent

Steps 1 to 4 are all required. Step 5 is optional.

Before you start, check what the agent needs from your projects in Prerequisites.

Prerequisites

• The agent is deployed, and an LLM provider is configured with both models it requires: Opus 4.8 as the primary model and Sonnet 4.6 as the secondary model. Check your provider's documentation for the exact identifier or deployment name of each model. Each project you want to scan is bound to GitHub, GitLab, or Azure DevOps, and has already been analyzed.

Enabling the agent

The Hunter Agent is enabled once for the whole instance. There's no per-project enable setting: once you turn it on, every bound project can use it, and project administrators set up scheduled scans for their own project.

With a provider and a model configured, enable the agent:

1. Go to Administration > Configuration > AI capabilities > Hunter Agent.
2. Turn on the Hunter Agent.

Once enabled, project administrators can run analyses and set up scheduled scans from their project's Hunter Agent page. See Hunter Agent.

The agent raises its findings as issues in each scanned project. See Hunter Agent findings.

To understand what counts as one scan unit, see What counts as a scan unit.

Related pages

• AC/DC: Hunter Agent
• Project admin: Hunter Agent
• Hunter Agent findings