Using AI-generated fix suggestions in your SonarQube instance

AI CodeFix is available in Early Access for all commercial editions of SonarQube Server.

Sonar AI CodeFix uses a large language model (LLM) to automatically generate AI-driven code fixes for the issues discovered by SonarQube Server. The process is simple. When you request a fix, the affected code and issue description are sent to an LLM. AI CodeFix then proposes an edit that resolves the problem without changing the code’s functionality.

AI CodeFix currently uses Open AI’s GPT-4o or your own Azure OpenAI LLM, to suggest fixes for a select set of rules in Java, JavaScript, TypeScript, Python, C#, and C++. It’s also possible to use your own self-hosted Azure OpenAI Service model; see below for instructions.

Sharing your code with Sonar

When you select a self-hosted LLM, your code stays within your network. However, Sonar’s AI CodeFix service needs to send the latest prompts and supported rule descriptions therefore, your instance of SonarQube server will still need internet connectivity.

If you use Sonar's AI CodeFix LLM, the affected code snippet will be sent by the AI CodeFix service to the selected LLM. Service agreements with Sonar’s LLMs prevent your code from being used to train those models. 

For details about terms and conditions, please refer to the AI CodeFix terms in our Legal Documentation.

Enabling AI-generated fix suggestions

As an Instance Admin, you can enable or disable AI-generated fix suggestions on your projects. To enable AI CodeFix:

1. Go to Administration > Configuration > General Settings > Early Access features > AI CodeFix and select Enable AI CodeFix. 
2. Select your Provider:
   • The default option is Sonar’s OpenAI which uses GPT-4o.
   • To choose your own Azure OpenAI LLM:
     1. Select Self-hosted Bring Your Own Model.
     2. Provide your Azure OpenAI Endpoint. The endpoint URL should include the deployment-id and api-version parameters.
        Here is an example:  https://<YOUR-ENDPOINT>/openai/deployments/<YOUR-DEPLOYMENT-ID>/completions?api-version=<YOUR-API-VERSION> 
     3. Provide your Azure OpenAI API Key. For information about using Azure AI models, see the Azure OpenAI Service documentation.
3. Once AI CodeFix is enabled, choose either All projects or Only selected projects:

When choosing Only selected projects, add projects individually from the list to activate the feature. New projects will not be added automatically.

Once enabled, developers can get AI-generated fix suggestions from the Issues page in their projects. See Fixing issues for more details.

Disabling AI CodeFix

To disable AI CodeFix completely in SonarQube Server and hide the feature from all users, including Instance Admins, set sonar.ai.codefix.hidden=true in your sonar.properties file.

Alternatively, you can send an email to moc.ecruosranostcatnoc with the subject “Disabling AI CodeFix” or contact Sonar Support via your usual communication channel. SonarSource will block your Server ID from having access to the AI CodeFix feature.

Getting AI-generated fix suggestions

AI-generated fix suggestions are available for a select set of rules in Java, JavaScript, TypeScript, Python, C#, and C++.

When an Instance Admin enables AI CodeFix for your project, you can get an AI-generated fix suggestion for eligible issues. The suggestions are generated using the LLM defined by the Instance Admin.

To generate a fix suggestion: 

• Retrieve the issue and open its detail view. If an AI CodeFix is an option for that particular issue, you will see the Generate AI Fix button.
• From either the Where is the Issue? or the AI CodeFix tabs, select Generate Fix.

An AI CodeFix will be generated, and you’ll see a diff view in the AI CodeFix tab. If you're using SonarQube for IDE and have Connected mode set up, select View fix in IDE to streamline the process and see the diff view in your IDE. Then, simply copy and paste the generated fix into your IDE. 

• If you are running SonarQube for Visual Studio, selecting View fix in IDE will directly paste the fix suggestion into your IDE.

An AI Code Assurance badge is available to mark your AI projects as reviewed by SonarQube Server. Any user with project access can use the badge. For more detailed instructions, see the Marking a project as containing AI-generated code article on the Project settings page.

AI Code Assurance

SonarQube Server recognizes that AI-generated code should be monitored with additional quality standards and offers administrators a series of tools described on the Standards for AI-generated code page.

It's possible to view ratings for projects with AI Code Assurance in your portfolios beginning in the Enterprise edition. There, you will see a breakdown of projects, applications, and nested portfolios that include the standards you've set for AI-generated code. See the Portfolio breakdown article for more information.

Related pages

• Overview of AI capabilities
• Autodetecting AI-generated code
• see Getting AI-generated fix suggestions
• see Marking a project as containing AI-generated code