{
  "id": "tool:sonarqube",
  "_kind": "Tool",
  "_file": "domain/tools/tools-saas-missing.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "SonarQube",
    "homepageUrl": "https://www.sonarsource.com/products/sonarqube/",
    "kind": "other",
    "description": "Static code analysis platform for continuous code quality inspection.\nDetects bugs, code smells, security vulnerabilities, and technical debt\nacross 30+ programming languages in developer workflows and CI pipelines.\n"
  },
  "outgoingEdges": [
    {
      "from": "tool:sonarqube",
      "to": "skill-area:code-quality",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:sonarqube",
      "to": "skill-area:code-quality",
      "kind": "used_for"
    },
    {
      "from": "tool:sonarqube",
      "to": "tool:snyk",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Code security — SonarQube scans source code quality; Snyk focuses on dependencies and containers"
      }
    },
    {
      "from": "tool:sonarqube",
      "to": "tool:trivy",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Code security — SonarQube scans source code; Trivy scans dependencies and containers"
      }
    },
    {
      "from": "tool:sonarqube",
      "to": "tool:owasp-zap",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security testing — SonarQube is SAST (static); OWASP ZAP is DAST (runtime)"
      }
    }
  ],
  "incomingEdges": [
    {
      "from": "specialization:security-compliance",
      "to": "tool:sonarqube",
      "kind": "uses_tool"
    },
    {
      "from": "tool:snyk",
      "to": "tool:sonarqube",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Code security — Snyk focuses on dependencies and containers; SonarQube on source code quality"
      }
    },
    {
      "from": "tool:trivy",
      "to": "tool:sonarqube",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Code security — Trivy scans dependencies and containers; SonarQube scans source code"
      }
    },
    {
      "from": "tool:owasp-zap",
      "to": "tool:sonarqube",
      "kind": "alternative_to",
      "attributes": {
        "comparison": "Security testing — OWASP ZAP is DAST (runtime); SonarQube is SAST (static)"
      }
    },
    {
      "from": "tool-server:mcp-sonarqube",
      "to": "tool:sonarqube",
      "kind": "integrates_with",
      "attributes": {}
    }
  ]
}