Skip to content
MLReps
Sign in
Sign in

Compared

MLReps and SonarQube

We run SonarQube in CI already. Is MLReps the same kind of thing? Both run in your pipeline, both read the whole repository rather than a diff, and both say something about architecture. This is the closest overlap of the five, and the difference is which way round the two are: a rule engine that also maps, or a map that findings are computed from.

All comparisons

What SonarQube is

SonarQube is a code-quality and security platform that runs in your pipeline and gates a change on the result. It comes as a managed cloud service and as a self-managed server that can run air-gapped.

“verifies code … before it ships”

Sonar’s own page: https://www.sonarsource.com/products/sonarqube/, read 2026-11-08

What SonarQube does that MLReps does not

  • Thousands of maintainability, bug and security rules across many languages, with taint analysis that follows data across files and functions.

    www.sonarsource.com, read 2026-11-08

  • A quality gate that fails a build, and — in its own words — a living map derived from the code, with an intended structure an architect defines and deviations flagged against it.

    www.sonarsource.com, read 2026-11-08

  • Software composition analysis of third-party components, with licence checks and an SBOM, as part of its Advanced Security offering.

    www.sonarsource.com, read 2026-11-08

What MLReps does that SonarQube does not present as its job

  • The map is the product rather than a rule about the map. MLReps starts from the graph it read and computes its answers from it; there is no intended architecture to declare first, because the answer to “what is the architecture” is the thing being asked for.

    The architecture it reads

  • What a change reaches before it is merged: the files, routes and screens that reach the changed code through the graph, as a floor with its limits attached rather than a total.

    How it works

  • Two performance rules written to be believed rather than to be many, with everything they deliberately refuse to call a problem written down on the page.

    What it finds about performance

When to use both

SonarQube's rule coverage per language is far beyond what MLReps has, and a quality gate that fails a build on a measured threshold is a thing MLReps does not do. If you want broad language rules enforced in CI, keep them there; read MLReps for the shape of the system and what a change reaches.

How to check this page

Every claim above about SonarQube links the page it came from and the date it was read. Products change; if one of these is out of date, the link is how you will see that before we do.

The claims about MLReps are checkable a different way: the reports on public repositories are the output itself, on projects nobody chose for us.

Reports on public repositories

Read next