Listed whether or not they pay us. Prices from each tool's own pricing page, checked Oct 16, 2026.

Sonar (SonarQube / SonarQube Cloud)

Static analysis for code quality and security, as SonarQube Cloud SaaS or self managed SonarQube Server.

Best for Code quality gates across many languages

Used Sonar and liked it? Upvote it. One upvote per person. Upvotes come from visitors, not from us, and never change "Our ranking".

What it does

Sonar is a code verification platform available as managed SonarQube Cloud or self hosted SonarQube Server. You connect your repositories and CI pipelines to analyze human written and AI generated code, receiving automated quality reports, security findings, and fixes. It is built for developers, small teams, and enterprise engineering organizations.

Read more: 5 features and how people use themShow less

  1. Static application security testing

    Detects security vulnerabilities directly in source code and guides developers through remediation before applications are built or tested.

    Use caseA software developer scans application source code to resolve newly discovered security vulnerabilities before merging changes into production.

    From sonarsource.com/products/sonarqube/server

  2. Quality gates

    Blocks pull requests and fails deployment pipelines whenever incoming code fails to meet predefined standards for quality and security.

    Use caseA DevOps engineer stops pull requests from merging into the main branch when new code does not meet the required test coverage or security thresholds.

    From sonarsource.com/products/sonarqube/cloud
  3. Sonar: Software supply chain assessment

    Software supply chain assessment

    Evaluates project dependencies to uncover third party vulnerabilities, malicious packages, license violations, and generate SBOM visibility.

    Use caseA security engineer inspects external project libraries during an enterprise build to identify vulnerable dependencies and verify license policy compliance.

    From sonarsource.com · image from Sonar
  4. Sonar: Gitar AI code review

    Gitar AI code review

    Inspects pull requests, diagnoses CI test failures, enforces natural language policies, and applies code fixes directly to the branch until pipeline checks pass.

    Use caseA pull request author receives automated diagnostic comments on CI test breakages and lets an agent generate commits until the pipeline turns green.

    From sonarsource.com · image from Sonar

  5. Self managed SonarQube Server

    Runs static code analysis entirely on customer managed infrastructure to ensure data sovereignty across cloud or on premises setups.

    Use caseAn enterprise systems administrator deploys static code analysis across self hosted Kubernetes clusters to keep proprietary source code strictly on premises.

    From sonarsource.com/plans-and-pricing

Written from Sonar's own website, checked . Each feature links to the page it comes from; images are Sonar's own.

Every plan

PlanMonthlyBilled yearlyPerWhat it includes
Free (Cloud)FreeNot listedprivate LOCup to 50k private LOC
Cloud Team$34Not listedprivate LOC (paid upfront)up to 100k LOC at entry price, under 50 developers, Advanced Security (SCA/advanced SAST) included
Cloud EnterpriseContact salesNot listedcustom, annualcontact sales; 50+ developers
OSS (Cloud)FreeNot listedpublic repospublic OSI licensed repos
Server Community BuildFreeNot listedper instanceself hosted, open source
Server DeveloperNot listed$208per instance per year, by LOC~$2,500/yr at 100k LOC (third party)
Server EnterpriseNot listed$1,333per instance per year, by LOC~$16,000/yr at 1M LOC (third party)
Server Data CenterContact salesNot listedcustomcontact sales

From Sonar (SonarQube / SonarQube Cloud)'s own pricing page, checked . Prices are in US dollars per month; "billed yearly" is the monthly price when you pay for a year up front. A few figures (often the yearly price) are derived rather than printed on the page.

Before you pay

Card needed for the trial
No
What Sonar saysStart in minutes with a 14 day trial, no credit card. Free tier never expires. Source page
Data retention
The Enterprise plan offers zero data retention and BYOK with LLMs.
What Sonar says45+ languages, SSO and SCIM, portfolios, OWASP, MISRA reporting, zero data retention and BYOK with LLMs Source page
Support
Community, help center/support portal, LMS, phone, and screen share depending on the plan
What Sonar saysAccess to Sonar Community Access to onboarding portal Access to onboarding webinars Access to support portal Access to LMS Agent availability Business hours 24x5 24x7 Response time: blocker issues Source page

Only what Sonar's own pages state, with the quote behind each answer. Anything they don't publish is left out rather than guessed.

Getting started with Sonar

  1. Choose which DevOps platform you want to connect to when you first sign up for SonarQube Cloud.
  2. Sign in to SonarQube Cloud with your existing credentials on that DevOps platform service.
  3. Import organizations from your DevOps platform to SonarQube Cloud.
  4. Import repositories from those organizations to create SonarQube Cloud projects.
  5. View your imported project on your My Projects page.

Tips

  • If you want to use the US region, sign up for SonarQube Cloud’s US instance.
  • There is no SonarQube Cloud only account; your account is created and bound directly to your DevOps platform account.
  • Some programming languages for static analysis are available only with the Enterprise plan.

Written from Sonar's own help pages: docs.sonarsource.com/sonarqube-cloud/getting-... · docs.sonarsource.com/sonarqube-cloud/discover...

What the free plan includes

Cloud: private projects up to 50k LOC, free for public OSS; Server: free Community Build (self hosted)

Questions people ask about Sonar

How much does Sonar cost?

Paid plans start at $34 a month (Cloud Team). 8 plans are listed above, from Sonar's own pricing page.

Is Sonar free?

Yes, there is a free plan: Cloud: private projects up to 50k LOC, free for public OSS; Server: free Community Build (self hosted).

Do I need a credit card to try Sonar?

No, you can start without a credit card. Source

Does Sonar have an API?

Yes.

How does pricing work for private projects?

There are two paid plans (Team and Enterprise) where you pay upfront for a maximum number of private lines of code analyzed, starting at $34 monthly for up to 100k LOC, alongside a free tier for up to 50k LOC. Source

What payment options are available?

Payment for the Team plan is completed online via credit card and recurs automatically every month. Source

When will I be invoiced?

Team plan subscribers are invoiced monthly on the day of the month after their 14 day trial ends. Source

Can I cancel my subscription?

Yes, there is no commitment; you can delete your paid organization at any time or downgrade to the free tier. Source

Works with

Integrations
Claude Code, Cursor, Devin, GitHub Copilot, Antigravity, Codex, Windsurf, Gemini CLI, Docker, GitLab
Languages
30+ languages on Team plan, 45+ languages on Enterprise plan

Where this came from

Plans, prices and limits were copied from Sonar (SonarQube / SonarQube Cloud)'s own pages and the other sources listed, then checked .

How we collect prices and rank tools · Is something wrong? Correct this listing

Others that do the same job

Visit Sonar Sonar (SonarQube / SonarQube Cloud) (opens the tool's site)