Sonar 介紹面向智能體開發的產品與工作流程

If you've worked on a team with a CI pipeline in the last 18 years, there's a good chance SonarQube has failed one of your builds. That part hasn't changed. What has changed is who writes the code. Here's what Sonar looks like when your teammate is an agent.

For those about to ship: Sonar's Agent Centric Development Cycle (AC/DC)

Sonar's Agent Centric Development Cycle (AC/DC) is the simplest way to understand what Sonar does in 2026 and what Sonar does in 2026 and where each of our products fits.

The problem

Code is becoming more and more abundant from AI-driven and AI-assisted development and now, software factories.

The former dev-written 300-line pull request is now an over 1,000-line AI-assisted one. When Sonar surveyed developers, they said 65% of the code they commit is AI-generated or assisted (source). And PRs written by agents wait 5.3× longer than unassisted ones before a reviewer even picks them up, per LinearB.

The bottleneck is now verification. It usually happens too late: failing tests, rework, and security findings show up after the agent has moved on, and the code that's left behind is the developer's problem. We call this verification debt.

The Agent Centric Development Cycle (AC/DC)

Every loop runs the same three stages:

• Guide: give the agent the right context before it writes.
• Verify: check the output with zero-trust, multilayered verification, never with the model that wrote it.
• Solve: fix what's left, then feed what you learned into the next round.

That loop runs in three places:

Loop 1: Inside your agent

Sonar Vortex 🌀

Agents don't know your architecture, standards or which packages are safe. Vortex gives context to the agents before they write and checks every file as they write. Customers report up to 92% fewer issues introduced by the agent, and Sonar's benchmarks show up to 36% fewer tokens on navigation-heavy refactoring tasks.

Also in this loop, and free: SonarQube for IDE flags issues as you (or your agent) type in VS Code, Cursor, JetBrains, and other IDEs. The SonarQube MCP Server and SonarQube CLI let agents like Claude Code, Cursor, and Codex call SonarQube analysis directly.

Loop 2: At the pull request

SonarQube - Deterministic quality gates ⛩️

What Sonar is known for. The deterministic quality gate for every change, across 45+ languages and frameworks. It runs as SonarQube Cloud or SonarQube Server.

SonarQube Advanced Security 🔐

Checks every installed open-source package for vulnerabilities, malware and license risk, and follows untrusted data into your dependencies. Reachability shows which vulnerabilities your code actually calls, so you can fix those first.

It's an add-on product that extends SonarQube's core security capabilities (SAST, taint analysis, secrets detection, IaC scanning) with Advanced SAST and Software Composition Analysis (SCA).

Gitar - The code verification agent 🔎

Gitar reviews every PR with the context of your codebase and your team's conventions, and it's tuned for signal: one consolidated comment, with inline notes only where they matter. Because it reads what a change is trying to do, it catches the logic and behavior bugs that deterministic rules aren't built for. SonarQube covers the known issues; Gitar covers intent. Together they form multilayered verification: deterministic analysis for known issues, agentic review for intent, and neither trusts the agent to check its own work.

When CI breaks, Gitar reads your pipeline, separates real breakage from flaky tests and infrastructure noise, and finds the root cause. Then it commits a fix to the branch, within the rules you define, and keeps going until CI is green. You write those rules in plain English, and they live in your repo next to your code. It works with GitHub, GitLab, Bitbucket, and Azure DevOps, and with the CI you already run: GitHub Actions, GitLab Pipelines, CircleCI, Buildkite, Jenkins, and more.

Loop 3: In the background

SonarQube Hunter Agent 🏹

Hunter Agent is an AI security agent built for this class of flaw: broken access control (like IDOR), business logic abuse (skipped workflow steps, missing rate limits), and authentication and session gaps. It works like a security researcher, running Sonar's security playbooks across your whole codebase and following data and identity flows between files. It confirms every lead before reporting it, which gets it to 90% precision. And it's repeatable: scan twice, get the same results.

Confirmed findings land in your SonarQube issues with a severity, a plain explanation, and the exact line, ready to assign and fix. So far it has uncovered 200+ zero-day vulnerabilities in open-source applications.

SonarQube Remediation Agent 🛠️

Every codebase has a backlog of known issues nobody gets to. The Remediation Agent works through it. Pick issues in SonarQube by severity, or project and send issues in batches, or put it on a daily or weekly schedule. It also picks up PRs that failed their quality gate.

For each fix, it applies the change in a sandbox and re-runs Sonar's analysis, the same engine that raised the issue. If the issue isn't gone, or a new one shows up, the fix is thrown away. Only fixes that pass your quality gate become pull requests, grouped by rule and file type so one review covers a batch. It never merges: your branch protection and reviewers apply as usual.

Tutorial: Get riffing with Gitar 🎸

If you want to see one of these loops running today, I'd start with Gitar. There's a free 14-day trial, and it doesn't require a credit card.

Step-by-step using GitHub

1. Sign in at app.gitar.ai using GitHub.
2. Connect your code. On GitHub you install the Gitar app, then choose all your repos or just a few. GitLab's a bit different. There, you make a personal access token for a dedicated user (a service account works too) and paste that into the Gitar dashboard.
3. Now open a PR. Already have a few open? Gitar can run on those, straight from the dashboard.
4. Wait a couple of minutes. gitar-bot 🤖 leaves a summary comment on the PR, plus inline comments where it found something.

See something in there you want fixed? Tell it. A plain reply on the comment is enough, and Gitar comes back with a new commit. Want it to apply fixes without asking? Post this as a comment on the PR:

gitar auto-apply:on

On Bitbucket or Azure DevOps? Setup for both is in the Gitar docs.

TL;DR

• AI agents write code fast, verifying and shipping that code is the bottleneck.
• Sonar runs one loop (Guide, Verify, Solve) in three places: in your agent, at the pull request, and in the background.
• Each product has a home in one of those places, and SonarQube's analysis runs under all three.

Want more? Check out our Developer Guides or our blueprints on github.com/sonar-samples and get started.