Configuration reference
Properties and environment variables for the SonarQube Server AI agents, on both the server side and the Agent Orchestrator. This page is for SonarQube Server 2026.5.
Configuration is split between two places. SonarQube Server needs to know where the components are, and the Agent Orchestrator needs its own database, storage, and connection settings.
To learn how to set SonarQube Server properties in general, see Configuration methods.
SonarQube Server properties
These tell SonarQube Server how to reach the components you deployed. Set each one to the address of the component in your deployment.
An environment variable overrides one of these properties only when the property is already present in conf/sonar.properties. None of the agentic properties are built-in system properties, which means setting only the environment variable has no effect: SonarQube Server starts as though the components were never deployed.
The configuration directory in a container image is read-only at container start. Mount a complete conf/sonar.properties that declares each property you need. Declaring a property with an empty value is enough to make it overridable from the environment.
sonar.hunteragent.orchestrator.url
SONAR_HUNTERAGENT_ORCHESTRATOR_URL
The Agent Orchestrator address used for Hunter Agent jobs
sonar.remediationagent.orchestrator.url
SONAR_REMEDIATIONAGENT_ORCHESTRATOR_URL
The Agent Orchestrator address used for Remediation Agent jobs
sonar.vortex.analysis.url
SONAR_VORTEX_ANALYSIS_URL
The Vortex analysis address
sonar.vortex.enabled
SONAR_VORTEX_ENABLED
Enables Vortex analysis, where your license includes it.
Default value: true
sonar.agents.health.checkIntervalSeconds
SONAR_AGENTS_HEALTH_CHECKINTERVALSECONDS
How often SonarQube Server polls component health for the System page, in seconds
Hunter Agent scheduling
sonar.hunteragent.scheduler.enabled
SONAR_HUNTERAGENT_SCHEDULER_ENABLED
Dispatches scheduled Hunter Agent runs.
Default value: true
sonar.hunteragent.scheduler.threads
SONAR_HUNTERAGENT_SCHEDULER_THREADS
Threads used to dispatch scheduled runs.
Default value: 2
sonar.hunteragent.scheduler.pollingIntervalSeconds
SONAR_HUNTERAGENT_SCHEDULER_POLLINGINTERVALSECONDS
How often the scheduler looks for runs that are due, in seconds.
Default value: 10
Keep the defaults unless scheduled runs start too slowly. Raising the thread count increases the load the scheduler puts on your instance.
Request signing
The components authenticate to each other by signing each request with a key derived from one shared secret, rather than with tokens. SonarQube Server needs the secret itself, to derive the keys it accepts, and the agentic-shared key, to sign its own calls to the Orchestrator.
sonar.agentic.signing.secretFile
SONAR_AGENTIC_SIGNING_SECRETFILE
Path to the file holding the shared secret. A file with the same name and a .previous suffix is also accepted, so you can rotate the secret without downtime.
sonar.agentic.orchestrator.signingKeyPath
SONAR_AGENTIC_ORCHESTRATOR_SIGNINGKEYPATH
Path to the derived agentic-shared key SonarQube Server uses to sign its own calls to the Orchestrator.
The secret must be at least 32 characters. SonarQube Server disables signature verification on a secret shorter than 32 characters without reporting an error, which leaves the agentic endpoints unauthenticated.
On Kubernetes, the Helm chart derives the keys with a pre-install hook. With Docker Compose you derive them yourself, see Deploying with Docker Compose.
Vortex analysis context storage
SonarQube Server writes analysis context to the same location Vortex analysis reads it from, under its own property namespace. Point both at one location, see Setting up shared storage.
sonar.agentic.storage.type
The storage backend to use, either S3 or FILESYSTEM.
sonar.agentic.storage.bucket
Bucket holding analysis context.
sonar.agentic.storage.region
Storage region.
sonar.agentic.storage.endpoint
The storage endpoint. Leave empty to target Amazon S3.
sonar.agentic.storage.access-key
Access key. Leave empty to use the credentials already available to the host or pod.
sonar.agentic.storage.secret-key
Secret key.
sonar.agentic.storage.path-style-access
Uses path-style addressing. Most S3-compatible endpoints require it, and Amazon S3 does not.
Default value: true
sonar.agentic.storage.filesystem.base-dir
Root directory to use when the backend is a shared filesystem rather than object storage.
sonar.agentic.storage.presign-ttl-seconds
How long presigned URLs for analysis context stay valid, in seconds.
Agent Orchestrator properties
Set these on the Agent Orchestrator container. On Kubernetes, the Helm chart maps its own values onto them, so set the chart values instead where one exists, see Deploying with the Helm chart.
Storage
sonar.agentic.orchestrator.storage.type
The storage backend to use.
Default value: S3
sonar.agentic.orchestrator.storage.bucket
Bucket holding job artifacts.
Default value: agentic-jobs
sonar.agentic.orchestrator.storage.endpoint
The storage endpoint. Leave empty to target Amazon S3.
sonar.agentic.orchestrator.storage.region
Storage region.
Default value: us-east-1
sonar.agentic.orchestrator.storage.access-key
Access key. Leave empty to use the credentials already available to the host or pod.
sonar.agentic.orchestrator.storage.secret-key
Secret key.
sonar.agentic.orchestrator.storage.path-style-access
Uses path-style addressing. Most S3-compatible endpoints require it, and Amazon S3 does not.
Default value: true
sonar.agentic.orchestrator.storage.key-prefix
Prefix applied to all keys, so several instances can share one bucket.
sonar.agentic.orchestrator.storage.filesystem.base-dir
Root directory to use when the backend is a shared filesystem rather than object storage.
sonar.agentic.orchestrator.storage.presign-ttl-seconds
How long a presigned URL stays valid once handed to a runtime, in seconds. Keep it above the longest job timeout in Job dispatch: the URL is issued when a job is dispatched and isn't refreshed mid-run.
Job dispatch
sonar.agentic.orchestrator.runtime.hunter-push-url
The Hunter Agent runtime address. Set it for the Hunter Agent to receive jobs.
sonar.agentic.orchestrator.runtime.remediation-push-url
The Remediation Agent runtime address. Set it for the Remediation Agent to receive jobs.
sonar.agentic.orchestrator.watcher.hunter-timeout-seconds
How long a Hunter Agent job may run before the Orchestrator stops it and marks it failed, in seconds.
Default value: 44400
sonar.agentic.orchestrator.watcher.remediation-timeout-seconds
How long a Remediation Agent job may run before the Orchestrator stops it and marks it failed, in seconds.
Default value: 3600
sonar.agentic.orchestrator.watcher.timeout-seconds
Fallback timeout used when the per-type value above isn't set. No standalone default.
sonar.agentic.orchestrator.tasks.worker-threads
How many jobs can run at once.
Default value: 10
sonar.agentic.orchestrator.runtime.hunter-signing-key-path
Path to the key the Orchestrator uses to sign job pushes to the Hunter Agent runtime.
sonar.agentic.orchestrator.runtime.remediation-signing-key-path
Path to the key the Orchestrator uses to sign job pushes to the Remediation Agent runtime.
Raising the job concurrency also raises the peak load on your storage, your LLM provider, and the hosts running the sandboxes. Size those first, see Setting up shared storage.
Access to SonarQube Server
sonar.agentic.orchestrator.sonarqube.url
SonarQube Server address. Required: the Orchestrator reads project data and publishes results through it
sonar.agentic.orchestrator.sonarqube.signing-key-path
Path to the signing key the Orchestrator uses to sign requests to SonarQube Server
Request signing and inbound verification
The Orchestrator verifies each inbound call with the key derived for that caller. See Request signing for how the keys are derived.
sonar.agentic.orchestrator.inbound.verification-key-path
Path to the agentic-shared key used to verify inbound calls from SonarQube Server
sonar.agentic.orchestrator.inbound.hunter-verification-key-path
Path to the key used to verify inbound calls from the Hunter Agent runtime
sonar.agentic.orchestrator.inbound.remediation-verification-key-path
Path to the key used to verify inbound calls from the Remediation Agent runtime
sonar.agentic.orchestrator.job-capability.signing-key-path
Path to the key the Orchestrator uses to sign job capability tokens
Retention
sonar.hunteragent.deleteOlderThan
Days to keep Hunter Agent job artifacts. Set to 0 or less to disable.
Default value: 30
sonar.remediationagent.deleteOlderThan
Days to keep Remediation Agent job artifacts. Set to 0 or less to disable.
Default value: 30
sonar.agentic.orchestrator.purge.interval
How often the Orchestrator sweeps shared storage for expired artifacts.
Default value: 24h
Set the first two in General Settings > Housekeeping > Agentic, not as server properties.
DevOps platform
Set these only if your DevOps platform is self-managed and its API isn't at the public address.
sonar.agentic.orchestrator.remediation.github.api-base-url
GitHub API base address.
Default value: https://api.github.com
sonar.agentic.orchestrator.remediation.gitlab.api-base-url
GitLab API base address.
Default value: https://gitlab.com/api/v4
For a self-managed GitLab instance, the address on the project binding takes precedence over this value.
Outbound proxy
sonar.agentic.orchestrator.http.proxy-user
Proxy user. Leave empty when the proxy needs no authentication
sonar.agentic.orchestrator.http.proxy-password
Proxy password
Set the proxy host and port through the JVM system properties, the same way you do for SonarQube Server. Set the credentials here.
LLM provider configuration
Register your LLM providers once in SonarQube Server, under Administration > Configuration > AI Capabilities > LLM Providers. The Orchestrator passes the right credentials to each job when it starts, so you configure the provider in one place rather than on each deployed component.
Next step
This page is a reference, not a step in the deployment itself. For the full sequence, see the Deployment roadmap.
Related pages
Last updated
Was this helpful?