• Compare

Iris Code vs SonarQube

One is a platform you run. The other is an extension you install.

The short answer

Iris Code gives you secrets scanning, duplicate detection, dependency CVEs and a push that fails on your own machine, from an extension you install in under a minute with no server behind it. SonarQube is the heavier tool and earns it in places: thirty-plus languages, taint analysis, and the compliance reporting an auditor expects. If you need those, buy SonarQube. If you want the discipline without the platform, that is the whole reason Iris Code exists.

What SonarQube is

SonarQube is a code quality platform sold in three shapes: SonarQube Server, self-hosted and licensed per instance per year by lines of code; SonarQube Cloud, hosted, from $34/month for teams under fifty developers; and SonarQube for IDE, a free editor extension formerly called SonarLint. The IDE extension analyses code locally on its own. Its full rule set, the quality gate, and the taint engine that finds injection paths across files require Connected Mode, which binds the editor to a Server instance or a Cloud subscription.

Side by side

What each one does.

6 of these rows go to Iris Code and 3 to SonarQube. Both are in the table.

CapabilityIris CodeSonarQube

Where your code goes

Analysis runs on your machine

The editor and CLI always do. Cloud scans are opt-in per repository and run on ours.

The IDE extension does. Server and Cloud run it on their own infrastructure.

Works with no network

The editor and CLI do, completely. A cloud scan is a hosted feature and needs the network.

Standalone mode only. Connected Mode needs the server.

Nothing to operate or provision

Install the extension and it works.

Cloud removes the server, not the subscription.

Enforcement

Blocks a push from the developer's machine

Pre-push and pre-build hooks, installed for you.

The quality gate runs in CI or on the server.

One committed file drives editor, hook and CI

.irisconfig.json, and that is the whole setup.

Connected Mode syncs profiles down from the server.

Fails a CI job

Exit code, with per-rule thresholds.

What it finds

Hardcoded secrets

Suspicious names and known token formats.

Secrets is a supported analyser.

Secrets committed and later deleted

Reads back through git history.

Current code only.

Copy-pasted blocks

Renaming the variables does not hide it.

Dependency vulnerabilities

Against OSV.dev, in the same panel.

Advanced Security add-on, priced on request.

Language coverage

Ten, including Go, Ruby, C#, Java and Rust.

Thirty-plus, forty-plus on Enterprise.

Traces user input across files to a sink

Pattern and token analysis, not a dataflow graph.

Taint analysis, through Connected Mode.

Cost

Free on private code

No account needed.

The IDE extension is free.

Paid tier under $10 per developer

$6 a month, adjusted by country.

Cloud from $34 a month; Server per instance, per year, by lines of code.

Scale and reporting

Dashboards across every repository

Trend history stays on the machine.

Reports an auditor will accept

Much of what the licence buys.

Supported Partly, see the note Not supported

Pro is $6 a month where you are. Pricing is adjusted for purchasing power, so $6 is the ceiling and many countries pay less. See your rate.

Claims about SonarQube were checked against its own published material on 18 August 2026. Pricing and features change. If anything here is out of date or wrong, tell us and it will be corrected.

The honest split

Which one you should actually pick.

Choose Iris Code when

You want enforcement without operating a server or adding a per-developer subscription.
Local-first is a hard requirement, not a preference: client code, regulated work, or an air-gapped machine.
You want the check to fail at the push, on the developer's machine, before CI is involved at all.
You want one health score per file rather than an issue backlog nobody triages.
Most of the code being reviewed was written by an AI agent, and you want a deterministic check on it that costs nothing per run.

Choose SonarQube when

Your codebase includes languages Iris Code does not analyse: PHP, Kotlin, Swift, C, C++, COBOL, ABAP, and more.
You need taint analysis that traces untrusted input across files to a sink.
An auditor, a customer security review, or a compliance regime expects reports from a recognised platform.
You want one dashboard showing every repository in the organisation, with historical trends per team.
Procurement requires an established vendor with enterprise support.

Running both

They coexist without conflict. Both publish to the editor's Problems panel, and their rule sets barely overlap: SonarQube goes deep on correctness within a language, Iris Code covers secrets, duplication, dependency advisories, and a per-file score across the ten languages it supports. Teams already paying for SonarQube Server most often add Iris Code for the local pre-push gate.

FAQ

Questions people ask.

Is Iris Code a SonarQube replacement?

For a team that wants local analysis and push-time enforcement without running a server, yes, and for a fraction of the cost. For an enterprise deployment bought for taint analysis, forty language analysers, and compliance reporting, no. Those are different purchases.

SonarQube for IDE is free and runs locally. What does Iris Code add?

Secrets scanning that also reads git history, dependency vulnerability checks against OSV.dev, duplicate detection across files, and hooks that block a push locally with no CI and no server involved. SonarQube for IDE also reaches its full rule set only in Connected Mode, which needs a paid Server or Cloud instance behind it.

Does Iris Code send my code anywhere?

Local editor, CLI, hook, and CI analysis does not upload source to Iris Code. Cloud scans are separate and opt-in: they temporarily fetch the connected repository, scan it on Iris Code infrastructure, delete the working copy, and retain the report. Dependency lookups send package coordinates, not source code.

Can I use both?

Yes, and it is a common setup. Both surface findings through the editor's Problems panel and the rule sets overlap very little.

Try it against your own code.

The free tier needs no account and no repository access. Install it, open a file, and see what it says.

Install for VS Code See pricing Other comparisons

The short answer

What SonarQube is

Running both