Issues fixed, not just found.
Remediation Agent fixes issues in your pull requests and existing backlog, then re-scans each fix with Sonar's analysis engine to validate. Only verified fixes become PRs. You review and merge — nothing enters your codebase without your sign-off.
57 String q = "SELECT * FROM users 58 WHERE id = " + userId; 59 stmt.execute(q); // taint
57 String q = "SELECT * FROM users 58 WHERE id = ?"; 59 ps.setInt(1, userId);
Every team has a backlog it can't get to.
Known issues accumulate faster than any team can clear them, and AI-assisted development is accelerating the rate. The SonarQube Remediation Agent turns that backlog into a workstream you can actually run down — systematically, verifiably, and without pulling engineers off roadmap work.
Clear technical debt at scale
Assign hundreds of issues at once and let the agent work through them in parallel. What used to require a dedicated sprint now runs in the background against your real backlog.
Verified, not suggested
Every generated fix is re-analyzed with Sonar's own algorithmic verifier before it becomes a pull request. Fixes that don't resolve the issue or introduce new ones are discarded.
Leadership-driven, developer-approved
Engineering leaders assign work from the SonarQube dashboard. Developers review and merge. Priorities are set where they're visible; accountability stays where it belongs.
Audit trail by default
Every fix traces back to a verified Sonar finding, the rule it violated, and the analysis that confirmed the resolution. Compliance evidence as a byproduct, not an afterthought.
Closed-loop verification
Most AI tools guess. We verify. Our agent doesn't just predict the next token; it solves for specific, mathematically defined rule violations across the Guide, Verify, and Solve stages.
Detect
Generate
Verify
Remediate
1. Detection
A PR is opened. SonarQube analysis runs and detects a failed quality gate with new issues.
2. Generation
The Agent (Claude Opus 4.6) reads the project context and active ruleset to generate a fix.
3. Verification
The LoopThe fix is applied to a sandbox. The Sonar engine re-runs analysis. Fail? Discard & retry.
4. Remediation
Only verified fixes are posted to the PR. The developer reviews and commits with one click.
Value for every role on your team
Reclaim your focus
Don't let quality gate failures break your flow. The Remediation Agent runs asynchronously in your Pull Requests, finding and fixing code smells and bugs while you keep coding. No more context switching—just review the verified fix and merge.
Standardize quality at scale
Operationalize your code quality and security standards across thousands of repositories without the friction. The Agent ensures your organization's quality profile is applied consistently — developers can remediate legacy debt and new issues on demand, keeping your code health metrics green without waiting on manual triage.
Velocity without compromise
Eliminate the trade-off between speed and quality. By removing the manual effort from the 'fix' phase of the development loop, you reduce cycle time, lower change failure rates, and free up your senior engineers to focus on innovation rather than maintenance.
Self-healing application security
Shift from detection to remediation. When a vulnerability or hotspot is detected, developers can trigger the Agent to propose a verified, non-hallucinated patch — drastically reducing Mean Time to Remediate (MTTR) and helping secure your software supply chain.
Our differentiation
Closed-loop verification
We don’t just generate fixes; we validate them. Every proposed patch is run against the Sonar analysis engine in a sandbox environment. If it fails the quality gate or introduces new issues, it is rejected before it ever reaches your Pull Request.
Deep analysis context
Generic coding assistants only see the file active in your IDE. The Remediation Agent leverages over 16+ years of code analysis expertise, understanding the full cross-file context, taint analysis paths, and your organization’s specific quality profiles.
One-action workflow
No chatting, no prompting. When a PR fails its quality gate, a developer triggers the agent with a single action. From there it works autonomously — analysing the failing issues, generating a fix, verifying it against Sonar’s own engine, and opening a pull request.
SWE-Bench
The Remediation Agent is built on Sonar Foundation Agent — ranked #1 on SWE-Bench, the industry benchmark for AI agents solving real-world software engineering problems.
Frequently asked questions
No. Unlike a chatbot, you don't prompt it or have a conversation with it. When a PR fails its quality gate, a developer triggers the agent with a single action — from there, it autonomously analyses the issues, generates a fix, verifies it against Sonar's own engine, and opens a pull request. Same with backlog: select the issues, assign them to the agent, and it handles the rest. The interaction is one action, not a back-and-forth.
Currently, the agent supports Java, JavaScript, TypeScript, and Python. These cover the highest volume of modern web and backend development.
It's our secret sauce: 1) LLM proposes a patch. 2) We apply it to a sandbox. 3) We run the full SonarQube analysis. 4) If the issue is gone and no new bugs are introduced, we post it to the PR.
Yes. We have a Zero Data Retention policy. Code snippets sent to the LLM (Claude Opus 4.6) are processed for the fix and immediately discarded. Anthropic does not train on your code.