Home / Agents / SonarQube AI CodeFix

SonarQube AI CodeFix

Name: SonarQube AI CodeFix
Availability: OnlineOnly
Author: SonarSource

Vendor: SonarSource · HQ: Switzerland · Category: Code security · Security

Last verified 18 Oct 2026 · Added 18 Oct 2026 · 5 sources · How we verify

Visit official site (opens in new tab) Claim this listing

Vendor? Get your “Listed on Agent Index” badge

What it does

Sonar’s AI CodeFix uses a large language model to propose edits for a select set of rules in Java, JavaScript, TypeScript, Python, HTML, CSS, C# and C++. SonarQube Cloud docs state it is available on Team and Enterprise plans and can use Anthropic Claude Sonnet 4 (recommended) or OpenAI GPT-5.1; Server docs (2026.5) describe Enterprise and Data Center editions, with optional Sonar-hosted or customer-hosted LLMs. An instance/project admin must enable it. Suggestions are generated on request (Generate AI Fix) and can be applied in connected-mode IDEs. This is AI-assisted issue fixing inside SonarQube, not a standalone AppSec agent platform. SonarSource Sàrl’s official contact page lists headquarters in Geneva/Vernier, Switzerland.

Frameworks

No framework tags verified yet.

Pricing (as published)

AI CodeFix is a paid-edition feature (SonarQube Cloud Team/Enterprise; Server Enterprise/Data Center). Sonar’s plans page lists SonarQube Cloud Team from $32/month; Enterprise and Server commercial editions are quote or sales-led. Community Build does not include AI CodeFix.

India relevance

Fix suggestions for Sonar issues can support secure SDLC and CERT-In-oriented vulnerability handling. Sonar does not market a CERT-In module.

Tasks

appsecsastremediationcode-quality

Sources

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email sales@heritageservices.online. See our methodology.

Not legal or audit advice. Confirm current pricing, framework coverage and India-regulatory claims with the vendor before purchasing.

Use-case comparisons

AI code security agents — 12 verified listings (Application security scanning, suggested or automated code fixes, and pull-request security review)

Compare SonarQube AI CodeFix with

Alternatives

Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.
Claude Code security review — Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
Codacy AI Reviewer — Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.
Cursor Bugbot — Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.

See all SonarQube AI CodeFix alternatives →

Stay updated

We use your email only to send the newsletter. See our privacy policy.