SonarQube
Swiss code-quality platform used by 7M+ developers, now with AI code review and auto-fix
Quick Overview
| Company | SonarSource Sàrl |
|---|---|
| Category | AI Coding Assistants |
| Headquarters | Geneva, Switzerland |
| Founded | 2008 |
| EU Presence | Switzerland |
| Open Source | LGPLv3 (Community Edition) |
| Pricing | Free tier up to 50,000 lines of code / SonarQube Team plan from about $34 per month (100k LOC) / Gitar AI Code Review from $20 per user/month annual / Enterprise on request; free forever for public OSI-licensed repos |
| Free Option | 14-day free trial, no credit card |
| Replaces | Codacy, GitHub Advanced Security, Veracode |
Detailed Review
SonarQube is the code-quality platform many of the tools elsewhere in this category get compared against, and it has added AI on top of the analysis it has run since 2008: SAST, SCA and secrets detection across 30-plus languages, plus Gitar, an AI-powered pull-request review add-on, and AI CodeFix suggestions for issues it finds.
Sonar states it is trusted by more than 7 million developers, which for a Swiss company predating most of this category by over a decade is a believable claim rather than a marketing number.
SonarSource Sàrl is based in Geneva, and the SonarQube Community Edition — the actual scanning engine — is genuinely open source under LGPLv3, published on GitHub, so a team can self-host the core analysis without paying anything or sending code to Sonar's cloud. SonarQube Server (on-premise) and SonarQube Cloud cover the commercial tiers on top of that.
Pricing is unusually concrete for this category: a free tier for private projects up to 50,000 lines of code, SonarQube Team plans from around $34 per month for up to 100,000 LOC, and Gitar AI Code Review from $20 per user per month billed annually, with a 14-day free trial and no credit card required. Public, OSI-licensed repositories get both SonarQube and Gitar free forever.
What SonarQube does well
- Community Edition open source under LGPLv3, self-hostable
- AI-powered pull-request review (Gitar) and AI CodeFix suggestions
- SAST, SCA and secrets detection across 30+ languages
- Concrete, published pricing with a free 14-day trial
- Swiss vendor with an 18-year track record
Where SonarQube falls short
- Free tier capped at 50,000 lines of private code
- AI review and auto-fix features route through third-party LLMs
- Analysis and review, not code generation
- Full enterprise feature set requires a paid plan
Standout feature. The scanning engine itself is open source under LGPLv3 — the AI layer on top is new, but the free, self-hostable core has eighteen years behind it.
Pros and Cons
Pros
- Community Edition open source under LGPLv3, self-hostable
- AI-powered pull-request review (Gitar) and AI CodeFix suggestions
- SAST, SCA and secrets detection across 30+ languages
- Concrete, published pricing with a free 14-day trial
- Swiss vendor with an 18-year track record
Cons
- Free tier capped at 50,000 lines of private code
- AI review and auto-fix features route through third-party LLMs
- Analysis and review, not code generation
- Full enterprise feature set requires a paid plan
Alternatives to SonarQube
Frequently Asked Questions
What is SonarQube?
SonarQube is the code-quality platform many of the tools elsewhere in this category get compared against, and it has added AI on top of the analysis it has run since 2008: SAST, SCA and secrets detection across 30-plus languages, plus Gitar, an AI-powered pull-request review add-on, and AI CodeFix suggestions for issues it finds.
Sonar states it is trusted by more than 7 million developers, which for a Swiss company predating most of this category by over a decade is a believable claim rather than a marketing number.
Where is SonarQube based?
SonarQube operates from Geneva, Switzerland, which places it under Switzerland.
What does SonarQube cost?
Free tier up to 50,000 lines of code / SonarQube Team plan from about $34 per month (100k LOC) / Gitar AI Code Review from $20 per user/month annual / Enterprise on request; free forever for public OSI-licensed repos. 14-day free trial, no credit card.
Who is SonarQube best for?
Teams that want code-quality scanning and AI-assisted fixes from a long-established European vendor. The scanning engine itself is open source under LGPLv3 — the AI layer on top is new, but the free, self-hostable core has eighteen years behind it.
What are the drawbacks of SonarQube?
Free tier capped at 50,000 lines of private code. AI review and auto-fix features route through third-party LLMs. Analysis and review, not code generation. Full enterprise feature set requires a paid plan.