SonarQube or Semgrep?

SonarQube if you want the dashboard and history (the SonarCloud shape). Semgrep if you want a CLI of rules in CI. Pick one as the daily driver.

Community or commercial?

This page is Community Build (LGPL-3.0). Commercial editions are a different license. Skip them on the OSS path.

No. Snyk is dependency/image vulns — /replace/snyk.

Stacks / Backend

Medium

SonarQube / Semgrep

Code inspection you host. SonarQube Community is LGPL-3.0; Semgrep OSS is LGPL-2.1 — SonarCloud without the analysis seat.

The problem

SonarCloud is hosted static analysis from Sonar. You wanted that scan on a box you run. SonarQube is LGPL-3.0 (SonarSource/sonarqube) — Community Build is the OSI path; commercial editions are separate. Semgrep is LGPL-2.1 (semgrep/semgrep) if you want pattern-based SAST. This is not every SonarQube commercial rule pack or SonarCloud organization SKU. Dependency CVEs stay on /replace/snyk.

Replaces

SonarCloud

Replace SonarCloud See all best open-source scanners

Estimated SaaS saved

$1,200

per year, small team, before lock-in

Start on Railway

Trivy / Grype if this is dependency and image CVEs, not code quality

Sponsor this stack Tip jar

Placeholder: SonarQube + a database and a volume. Bind HTTP to 0.0.0.0:$PORT. Semgrep is a CLI you run in CI. No one-click template in this repo yet — Start on Railway. Image CVEs stay on /stacks/trivy-scan.

The stack

SonarQube
LGPL-3.0 continuous inspection (Community Build; skip commercial editions)
Catalog entry →
Semgrep
LGPL-2.1 pattern-based static analysis if you want that CLI
Catalog entry →

Cost table

You stop paying	Typical / year	Self-host instead
SonarCloud (small team)	$1,200	SonarQube Community or Semgrep OSS

Agent setup prompt

Replace SonarCloud with SonarQube Community (preferred server) or Semgrep OSS (CLI).

- SonarQube: official image, persist Elasticsearch/data, create one project, run the scanner on the repo you still pay SonarCloud for.
- Do not enable commercial editions and call it Community. Semgrep if you only need pattern rules in CI.
- Write AGENT_PROMPT.md. Image CVEs stay on /stacks/trivy-scan.

Also as markdown: /stacks/sonarqube-lint.md

FAQ

SonarQube or Semgrep?: SonarQube if you want the dashboard and history (the SonarCloud shape). Semgrep if you want a CLI of rules in CI. Pick one as the daily driver.
Community or commercial?: This page is Community Build (LGPL-3.0). Commercial editions are a different license. Skip them on the OSS path.
Is this Snyk?: No. Snyk is dependency/image vulns — /replace/snyk.