Repotoire vs SonarQube
SonarQube is the industry standard for rule-based code quality scanning with unmatched language breadth. Repotoire takes a different approach: a local Machine runtime for explicit agent workflows, evidence, verification gates, and precise traps.
Feature Comparison
| Feature | Repotoire | SonarQube |
|---|---|---|
| Primary model | agent-processor runtime for development work | Rule-based AST scanning |
| Workflow state | .machine state, events, evidence, and traps | Server-side project history |
| Agent coordination | Worker packets, write claims, scoreboard hazards | Not an agent runtime |
| Verification | Evidence packets and gate verdicts | Server policy checks and issue rules |
| Provider adapters | Codex, Claude, MCP, local runners | Scanner and IDE integrations |
| Writeback | Explicit COMMIT gate | No repo writeback model |
| Precise traps | Stops stale or unsafe writeback | Rule failure / quality gate failure |
| CI/CD integration | Explicit CLI reports and team-approved gates | SonarScanner + server, deep CI integration |
| Deployment | Commercial private beta, local-first runtime | Self-hosted or SonarCloud |
| Pricing | Commercial private beta | Community (free), Developer ($150/yr), Enterprise ($65K+/yr) |
Architecture
Repotoire
Runs local Machine programs against your repo. The ISA defines explicit development-work opcodes, while the microarchitecture tracks evidence, hazards, gates, traps, and git-backed durable memory before any writeback step.
SonarQube
Client-server architecture. SonarScanner runs locally and sends results to a SonarQube server backed by a database (PostgreSQL, Oracle, or SQL Server). The server stores historical data, manages evidence review workflows, and provides a web dashboard. Rules operate on ASTs per-file with some cross-file dataflow analysis in paid editions.
Detection Capabilities
SonarQube excels at breadth. With 5,000+ rules across 30+ languages, it catches a wide range of bugs, vulnerabilities, code smells, and security hotspots. Its SAST capabilities are mature and well-tested across millions of projects.
Repotoire excels at depth.Its v2 evidence model includes graph-based architectural analysis that SonarQube cannot perform: circular dependency detection via Tarjan's SCC, god class identification through fan-in/fan-out metrics, architectural bottleneck detection via PageRank and betweenness centrality, hidden coupling through git co-change analysis, and community misplacement via Louvain clustering.
If your primary concern is per-file bug and vulnerability detection across many languages, SonarQube has the edge. If you need to understand and improve your codebase's architecture, Repotoire finds issues that rule-based tools structurally cannot detect.
Setup & Deployment
Repotoire
Access is provided through private beta onboarding.
# Inspect local Machine state repotoire machine report . # Review evidence for policy gates repotoire machine report . --format json
Local-first runtime, explicit commands, and adapter policies are configured during onboarding.
SonarQube
Requires Java 17+, a database, and server configuration.
# Start server (Docker) docker run -d sonarqube:community # Install scanner brew install sonar-scanner # Configure & scan sonar-scanner \ -Dsonar.projectKey=my-project \ -Dsonar.host.url=http://localhost:9000
Or use SonarCloud for a managed experience without self-hosting.
Pricing
Repotoire
- ✓Commercial private beta access
- ✓machine programs, source-pipeline evidence, precise traps, and MCP adapters
- ✓Team runtime onboarding and adapter support
SonarQube
- •Community Edition: Free (open source, limited features)
- •Developer Edition: ~$150/year (branch analysis, PR decoration)
- •Enterprise Edition: $20K–$65K+/year (portfolio management, SAST)
- •SonarCloud: Free for open source, paid for private repos
Who Each Tool Is For
Choose Repotoire if you...
- Need explicit agent workflow state, evidence, gates, and traps
- Want local-first execution instead of hosted scheduling
- Need Codex, Claude, MCP, or local runners behind one Machine contract
- Care about write claims, hazards, and verified writeback
- Want beta onboarding for a team operating model
Choose SonarQube if you...
- Need coverage across 30+ languages
- Want mature evidence review workflows and CI/CD integration
- Need a centralized dashboard for multiple projects
- Require compliance reporting and enterprise governance
- Already have Java infrastructure and database resources
Verdict
SonarQube and Repotoire solve different problems. SonarQube is the right choice when you need broad language coverage, enterprise governance, and a centralized quality platform. Its ecosystem is mature, well-documented, and battle-tested.
Repotoire is the right choice when agent-driven repo changes need an explicit runtime contract. It gives workers state, evidence, gates, hazards, traps, and verified writeback instead of relying on prose completion alone. Many teams can use both: SonarQube for broad code quality coverage, and Repotoire for local agent workflow execution.
Evaluate the Repotoire Machine
Request private beta access for machine programs, source-pipeline evidence, precise traps, and MCP adapters.
repotoire machine report .