Hunter Agent
Run Hunter Agent analyses and set up scheduled scans for a single project in SonarQube Server 2026.5.
SonarQube Hunter Agent runs a deep AI-powered analysis of your projects to find vulnerabilities that require human-like understanding of the code, such as broken access control and business-logic flaws, then raises them as issues you triage like any other.
An Instance Admin enables the agent for the instance and configures its LLM provider. See Hunter Agent for the full details.
As a project administrator, you run analyses manually or set up a scan schedule for your project.
Running analyses with Hunter Agent
If you're running the first Hunter Agent analysis for your project, see First analysis recommendations to avoid failing your quality gate on the main branch.
Make sure you have the Administer permission on the project. You can then run Hunter Agent analyses manually or set up scheduled analyses.
Open the project you want to scan.
Go to Analysis > Hunter Agent on your project.
If you see a message that the agent isn't enabled, ask an administrator to enable it first, using the link in the message.
If the project isn't bound to its DevOps platform, bind it first, following the prompt.
Run a Hunter Agent analysis manually or schedule analyses:
Manually: Choose the branch to scan from the heading branch selector then click Scan Now.
On a schedule: Click Manage scheduling in the page header. Turn on scheduled scans, then choose the branch to scan, the frequency, and the time and timezone.
First analysis recommendations
The Hunter Agent raises its findings as regular issues. Running your first analysis directly on the main branch can cause a passing quality gate to fail and block your team before you've had a chance to work through the findings.
To roll out the agent without disrupting your main branch:
Start on a dedicated branch. For your first analysis, run the agent on a dedicated branch instead of your main branch. The findings surface as issues on that branch, so they do not affect your main branch's quality gate.
Work through the backlog. Triage, assign, and resolve the findings the agent raises, the same way you handle any other issue.
Schedule analyses on the main branch. After your fixes are merged into the main branch and the number of open findings is under control, set up scheduled analyses so the agent keeps covering it.
This approach keeps the first wave of findings off your main branch. It gives your team time to clear the backlog and brings the agent into your main-branch quality gate only once the results are manageable.
Alternatively, you can run the first analysis directly on your main branch and Accept the findings you do not fix immediately. Accepted findings no longer affect the quality gate, so they do not block your team while you work through the backlog.
Viewing findings
The agent raises its findings as issues in your project. See Hunter Agent findings to review and triage them.
When the agent is not available for your project
The Hunter Agent is not enabled for this instance
An instance administrator has not turned on the Hunter Agent.
Contact your instance administrator.
This project is not bound to a repository
The agent has no repository to scan.
Project administrators can select Set up project binding. Otherwise, contact your administrator.
If you start an analysis while one is already running on the same branch, a dialog tells you a scan is already in progress and does not start a second one.
Related pages
Instance admin: Hunter Agent
AC/DC: Hunter Agent
Last updated
Was this helpful?