Repotoire vs SonarQube
SonarQube is the industry standard for rule-based code quality scanning with unmatched language breadth. Repotoire takes a different approach: a local Machine runtime for explicit agent workflows, evidence, verification gates, and precise traps.
Feature Comparison
| Feature | Repotoire | SonarQube |
|---|---|---|
| Primary model | agent-processor runtime for development work | Rule-based AST scanning |
| Workflow state | .machine state, events, evidence, and traps | Server-side project history |
| Agent coordination | Worker packets, write claims, scoreboard hazards | Not an agent runtime |
| Verification | Evidence packets and gate verdicts | Server policy checks and issue rules |
| Provider adapters | Codex, Claude, MCP, local runners | Scanner and IDE integrations |
| Retirement | Verified retirement gate | No repo writeback model |
| Precise traps | Stops stale or unsafe writeback | Rule failure / quality gate failure |
| CI/CD integration | Explicit CLI reports and team-approved gates | SonarScanner + server, deep CI integration |
| Deployment | Commercial private beta, local-first runtime | Self-hosted or SonarCloud |
| Pricing | Commercial private beta | Community (free), Developer ($150/yr), Enterprise ($65K+/yr) |
Architecture
Repotoire
Runs local Machine programs against your repo. The ISA defines explicit development-work opcodes, while the microarchitecture tracks evidence, hazards, gates, traps, and git-backed durable memory before any writeback step.
SonarQube
Client-server architecture. SonarScanner runs locally and sends results to a SonarQube server backed by a database (PostgreSQL, Oracle, or SQL Server). The server stores historical data, manages evidence review workflows, and provides a web dashboard. Rules operate on ASTs per-file with some cross-file dataflow analysis in paid editions.
Detection Capabilities
SonarQube excels at breadth. With 5,000+ rules across 30+ languages, it catches a wide range of bugs, vulnerabilities, code smells, and security hotspots. Its SAST capabilities are mature and well-tested across millions of projects.
Repotoire supplies evidence for agent work.Context queries expose parsed symbols and relationships; impact queries help inspect a named symbol's dependents. Machine reports expose recorded execution state and evidence. These surfaces support investigation and review, with explicit uncertainty when evidence is incomplete.
Use the findings from your chosen scanners alongside Repotoire's structural evidence. Context and impact queries do not establish that a defect exists or that a deletion is safe. A Machine report does not run an architecture scan or enforce a quality threshold.
Setup & Deployment
Repotoire
Access is provided through private beta onboarding.
# Inspect a repository with an existing Machine run repotoire machine report . # Read recorded evidence as JSON repotoire machine report . --format json
Local-first runtime, explicit commands, and adapter policies are configured during onboarding.
SonarQube
Requires Java 17+, a database, and server configuration.
# Start server (Docker) docker run -d sonarqube:community # Install scanner brew install sonar-scanner # Configure & scan sonar-scanner \ -Dsonar.projectKey=my-project \ -Dsonar.host.url=http://localhost:9000
Or use SonarCloud for a managed experience without self-hosting.
Pricing
Repotoire
- ✓Commercial private beta access
- ✓machine programs, source-pipeline evidence, precise traps, and MCP adapters
- ✓Team runtime onboarding and adapter support
SonarQube
- •Community Edition: Free (open source, limited features)
- •Developer Edition: ~$150/year (branch analysis, PR decoration)
- •Enterprise Edition: $20K–$65K+/year (portfolio management, SAST)
- •SonarCloud: Free for open source, paid for private repos
Who Each Tool Is For
Choose Repotoire if you...
- Need explicit agent workflow state, evidence, gates, and traps
- Want local-first execution instead of hosted scheduling
- Need Codex, Claude, MCP, or local runners behind one Machine contract
- Care about write claims, hazards, and verified writeback
- Want beta onboarding for a team operating model
Choose SonarQube if you...
- Need coverage across 30+ languages
- Want mature evidence review workflows and CI/CD integration
- Need a centralized dashboard for multiple projects
- Require compliance reporting and enterprise governance
- Already have Java infrastructure and database resources
Verdict
SonarQube and Repotoire solve different problems. SonarQube is the right choice when you need broad language coverage, enterprise governance, and a centralized quality platform. Its ecosystem is mature, well-documented, and battle-tested.
Repotoire is the right choice when agent-driven repo changes need an explicit runtime contract. It gives workers state, evidence, gates, hazards, traps, and verified writeback instead of relying on prose completion alone. Many teams can use both: SonarQube for broad code quality coverage, and Repotoire for local agent workflow execution.
Evaluate the Repotoire Machine
Request private beta access for machine programs, source-pipeline evidence, precise traps, and MCP adapters.
repotoire machine report .