Zero trust, multilayered verification. At every point in the loop.
Verification runs at two checkpoints: inside the agent’s inner loop as code is written, and at sandbox exit before the PR opens. At both points, SonarQube’s deterministic analysis and Gitar’s AI-native review run together. Each layer catches what the other misses.
Verification at two levels
Traditional CI verification waits until a pull request is opened. By that point the agent has already generated thousands of lines, made dozens of decisions, and created dependencies that are expensive to unwind.
AC/DC's Verify stage runs at two points: inside the agent's reasoning cycle (inner loop), and at sandbox exit before the PR is opened (outer loop). Issues are caught and blocked before they compound.
Deterministic-first analysis
- reliability, security, maintainability
- 40+ languages, zero false negatives on BLOCKER/CRITICAL
Gitar AI code review
- functional bugs, logic errors, behavioral issues
- context-aware, catches what deterministic analysis can’t reach
Architecture conformance
- current vs intended structure
- boundary violations and cross-module drift
When verification runs
Per file, per reasoning step. Sonar Vortex runs deterministic checks covering pattern matching, control flow, data flow, taint analysis, and SCA as the agent generates. Gitar reviews for functional correctness and logic errors in parallel.
At sandbox exit, before the PR opens. SonarQube runs its full analysis suite including architecture conformance. Gitar runs a final context-aware review for functional and behavioral issues. If either layer fails, the Solve stage triggers.
Only a small fraction of AI-generated code carries a real defect — but at agent scale that adds up fast. Verifying every change inside the loop catches those issues before they ever reach a pull request.
Deterministic-first, AI-augmented
SonarQube
Deterministic-first analysis across 40+ languages. The quality gate for all code — human- or agent-written. Available as Server (self-managed) and Cloud.
SonarQube Advanced Security
Deep security analysis with taint tracking, secret detection, and advanced SAST. Catches vulnerabilities that surface-level static analysis misses.
Sonar Vortex
Runs Sonar’s full analysis engine inside the agent’s reasoning cycle — every file, every step. Same depth and precision as a full CI scan, delivered in seconds via a two-phase (CI capture, on-demand restore) approach.
SonarQube Architecture
Verifies that agent-generated code conforms to your intended module structure. Catches boundary violations and cross-module drift before they reach production.
Gitar
AI code review that lives in your pull requests. Reviews code, diagnoses CI failures, generates fixes, and commits only when the build passes. Operates as an agent, not just a scanner.
SonarQube MCP Server
Exposes all SonarQube capabilities as native MCP tools. Claude Code, Cursor, and any MCP-compatible agent can call architecture and quality tools natively.
SonarQube for IDE
Sonar analysis directly in VS Code, IntelliJ, and other IDEs. Developers and agents get real-time feedback on issues and coding standards as they write.
SonarQube CLI
Unified command-line interface for agentic workflows. Agents can run analysis, check quality gate status, and query findings directly from the terminal.