SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar
A hands-on look at pairing Codex with SonarQube to verify agent-generated code inside the coding loop. The walkthrough covers secrets blocking, SQL injection remediation with a parameterized query, real-time agentic analysis, and the argument that completion requires evidence, containment is not correctness, and feedback belongs inside the agent loop.
Completion requires evidence, not assertion
A task is only done when the agent can point to a reviewable diff and tool output that supports the claim. Saying “fixed” is not a definition of done. Cheaper code generation shifts the bottleneck to specification and verification, and that is where effort now belongs.
The agent loop follows a predictable pattern: the model acts, execution is governed by the model, observations such as logs, results, and output come back, and the plan is updated. Each individual task carries an outcome, invariants, a defined scope, and acceptance criteria, and evidence is what closes it.
Self-critique is not an independent oracle. Coding agents tend to fail in correlated ways. They fall back to incomplete context, producing a local fix that violates a global invariant, or they generate tests that propagate the same mistake. Because the compiler, tests, and static analysis can disagree with each other, the useful move is to actively seek disconfirming evidence from several sources. Human review cannot be removed from the cycle.
Containment is not correctness
The execution layer defines what an agent can do: which tools it can reach, what scope it has, and which approvals it needs. The artifact layer decides whether the result is acceptable, using tests, analyses, policy, and intent. A sandbox can contain execution but cannot prove that a query is safe. No single oracle is proof, so the recommended approach is defense in depth, with controls placed at different boundaries. Humans own the intent, the exceptions, and the decision to ship.
Evaluating an agentic process comes down to concrete questions. Can secrets be intercepted before they reach model input? Is the project grounded in explicit rules, locations, and known vulnerability paths? Are parameters bound while behavior is preserved? Checks have to be rerun constantly, and agent output should never be treated as a terminal state.
The feedback contract belongs inside the loop
Skills encode procedures for particular tasks, MCP servers expose structured tools and context, and lifecycle hooks enforce checks at defined points. Hooks are especially well suited to catching hard-coded secrets. Combined, these form a continuous CI and human review process inside the agent workflow, rather than a gate that only fires after a failed build or review.
Verification is now the bottleneck
A Sonar survey of over a thousand developers found that 42% of committed code is AI generated or AI assisted, yet 96% of developers do not fully trust it, and fewer than half fully verify it before merging. Code generation has largely been solved. The constraint now is confirming that a large volume of generated code is safe to merge.
Sonar’s agent-centric development cycle has four stages. Generation belongs to whatever coding tool is in use. Sonar owns the remaining three. Guide injects project guidelines, rules, and architecture before the agent starts building, which reduces token cost, a meaningful saving at enterprise scale. Verify checks each change for security, quality, and maintainability issues as soon as it is written. Solve remediates detected issues quickly enough to keep an iterative coding loop moving.
The argument extends to where checks run. The outer loop is traditional CI: push, pipeline, failure, return to the IDE, fix, push again. The inner loop moves that verification into the IDE, so problems are caught before anything leaves the developer’s machine.
The demo: a deliberately vulnerable Python project
The sample project is a tiny Python application of under 200 lines across four files, with four planted issues: three security vulnerabilities and one code smell. SonarQube Cloud rates its security at E, the lowest grade.
Two findings stand out. The first is a hard-coded OpenAI API key in plain text in the source. Exposed secrets are a serious risk, and the average remediation time for a secret in a public repository is around 90 days, during which automated bots can scrape it. The second is a SQL injection. A query argument taken from sys.argv is interpolated directly into an f-string passed to cursor execution, so anyone who controls that input controls the database. SonarQube traces this data flow across files and functions using symbolic execution and taint analysis.
Guide, verify, and solve in Codex
A setup script provisions a SonarQube Cloud project, runs the first scan, and installs the CLI and the Codex plugin. The plugin was added from a marketplace, the CLI was authenticated, and an integration step wired up the secrets hook, agent directives, skills, and MCP configuration. Context augmentation and agentic analysis are the two capabilities that require organizational entitlements, and they are not on the free tier. Everything else works across cloud, server, enterprise, and free editions.
Three capabilities were shown. A secrets detection hook blocked an attempt to push a commit using a fake token, and it also stopped a file containing a secret from being read into context. The hook fires on user prompt submission and tool use, so a bypass is possible, for example by using a script to read the file, but ordinary usage is covered. A list-issues skill pulled dashboard findings into the terminal through the MCP server, which runs in Docker, while the CLI handles provisioning and configuration.
The SQL injection was fixed by asking the agent to address rule S8702. That rule was written specifically for agentic workflows, to keep AI coding agents from producing code that other agents can exploit. The fix replaced string interpolation with a parameterized query. The agentic analysis hook then re-analyzed the edited code, confirmed that no new issues had been introduced, and left the pre-existing issue elsewhere in the file alone. Verification is scoped to changed code, so it does not attempt to solve everything in the file.
Finally, a new delete-task-by-ID function was added to the database module. Context augmentation supplied the project rules and architecture before generation, and agentic analysis verified the output. Had any issues appeared, Codex would have kept iterating until they were remediated. The same loop therefore handles both fixing existing findings and gating new work.