Static analysis has become a baseline expectation in modern software delivery, but “static analysis tool” now covers everything from lightweight linters to deep semantic query engines backed by large research teams. SonarQube, Semgrep, and CodeQL are three of the most widely deployed options in 2026, and each takes a meaningfully different approach to finding bugs and vulnerabilities before they ship. This comparison looks at what each tool actually does, what it costs, and which teams it suits.
At a Glance
| Tool | Starting Price | Free / Open Tier | Best For |
|---|---|---|---|
| SonarQube | Cloud Team from $34/month; self-hosted Developer/Enterprise/Data Center priced per instance by lines of code (contact sales) | Community Build (self-hosted, free); Cloud free for public OSS repos and up to 50k private LOC | Teams wanting broad code-quality dashboards plus security, including legacy enterprise languages |
| Semgrep | Teams from $30/contributor/month per product (Code, Supply Chain); Secrets add-on $15/contributor/month | Free Edition: up to 10 contributors, Code + Supply Chain included | Engineering teams wanting fast, customizable, developer-friendly SAST/SCA/secrets with low false-positive noise |
| CodeQL (via GitHub) | GitHub Code Security $30/active committer/month (plus GitHub Team $4 or Enterprise $21 per user/month) | Free for public repositories on GitHub | Teams already on GitHub Enterprise wanting deep dataflow/semantic vulnerability analysis |
Short Verdict
There is no single winner here because the three tools solve overlapping but distinct problems. SonarQube is the strongest choice for organization-wide code quality governance across a huge range of languages, including mainframe-era ones. Semgrep is the fastest to adopt and customize, and it bundles SAST, software composition analysis (SCA), and secrets detection with a genuinely useful AI triage layer. CodeQL, delivered through GitHub’s Code Security product, does the deepest semantic dataflow analysis of the three but is tied tightly to the GitHub ecosystem and its per-committer billing. Many security-mature teams end up running more than one of these together rather than picking a single winner.
What They Are
SonarQube (SonarSource) is a code quality and security platform built around “Clean Code” principles and quality gates that can block a merge or release. It ships as a free, self-hosted Community Build, as paid self-hosted editions (Developer, Enterprise, Data Center) licensed per instance based on lines of code, and as SonarQube Cloud, a hosted SaaS product with its own free and paid tiers. Detection is primarily rule-based static analysis — pattern and structure matching across the codebase — supplemented by targeted dataflow checks for specific rule categories, plus an AI CodeFix capability on higher tiers that can use bring-your-own-key (BYOK) large language models to suggest fixes.
Semgrep is a static analysis engine built around a readable, pattern-matching rule syntax (its own open-source CLI/engine) plus a hosted AppSec Platform that adds organization-wide dashboards, CI gating, SCA, secrets detection, and an AI layer called Semgrep Assistant/Multimodal. Detection combines classic syntactic pattern matching with semantic, AST-aware analysis and cross-function taint tracking in its paid engine, and the AI layer is used specifically for triage (suggesting which findings are false positives, with an explanation), business-logic flaw detection such as broken authorization, and generating pull-request-ready autofixes.
CodeQL is GitHub’s semantic code analysis engine, originally built by Semmle. Rather than scanning text patterns, CodeQL compiles source code into a relational database and lets security researchers write dataflow queries against it in a dedicated query language (QL) — the approach that makes it strong at tracing how untrusted input moves through a program to a dangerous sink. CodeQL itself is free to run against public GitHub repositories; using it on private repositories requires GitHub’s Code Security add-on, which replaced the older bundled “GitHub Advanced Security” SKU.
How Each One Finds Issues
- SonarQube: rule-based static analysis across 35+ languages on SonarQube Cloud’s Team tier and 45+ on Enterprise (including ABAP, COBOL, PL/I, RPG, and Apex, alongside Java, JavaScript/TypeScript, Python, C#, C++, Go, Rust, Kotlin, and PHP); organizes findings around a “Clean Code” taxonomy and enforceable quality gates rather than a single vulnerability feed.
- Semgrep: pattern-based rules written in a simple, language-agnostic syntax, extended with semantic/AST awareness and taint-tracking dataflow in its commercial engine, plus an AI layer that reasons about business logic (e.g., IDORs, broken auth) that pure pattern rules tend to miss.
- CodeQL: true semantic dataflow analysis — code becomes a queryable database, and vulnerability classes are expressed as dataflow queries tracing sources to sinks, which is why it tends to surface deeper, multi-step vulnerabilities that pattern-matching tools miss, at the cost of more setup and longer scan times.
Pricing Breakdown
| Tool / Tier | Price | Notes |
|---|---|---|
| SonarQube Cloud Team (free) | $0 | Private projects up to 50k LOC, no card required; free for public OSS repos regardless of size |
| SonarQube Cloud Team (paid) | From $34/month | Up to 100k private LOC; aimed at teams under 50 developers |
| SonarQube Cloud Enterprise | Custom | SSO/SCIM, portfolios, OWASP/MISRA compliance reports, zero data retention, BYOK LLMs; commercial support starts at 5M LOC |
| SonarQube Server (self-hosted) Developer / Enterprise / Data Center | Per instance per year, by LOC (not publicly listed) | Self-hosted deployment; Community Build remains free and open-source |
| Semgrep Free Edition | $0 | Up to 10 contributors, Code + Supply Chain, up to 10 private repos, 60 AI credits |
| Semgrep Teams | From $30/contributor/month (Code or Supply Chain); Secrets $15/contributor/month | Up to 500 private repos, 20 AI credits/developer/month; products can be mixed and matched |
| Semgrep Enterprise | Custom | Unlimited seats/repos, on-prem SCM support, dedicated infrastructure, volume pricing, 50 AI credits/developer/month |
| GitHub Code Security (includes CodeQL) | $30 per active committer/month | Requires GitHub Team ($4/user/month) or Enterprise ($21/user/month) base plan |
| GitHub Secret Protection | $19 per active committer/month | Separate add-on; not required to use CodeQL |
| CodeQL on public repos | $0 | Free regardless of GitHub plan |
Pros and Cons
SonarQube
- Pros: broadest language coverage of the three (45+ on Enterprise), strong quality-gate workflow for enforcing standards, flexible self-hosted or SaaS deployment, free Community Build.
- Cons: self-hosted edition pricing is opaque (sales-only, LOC-based), rule-based engine can be noisier on complex vulnerability classes than CodeQL’s dataflow approach, Community Build lacks many security-specific checks found in paid tiers.
Semgrep
- Pros: fast scans, highly readable custom rules, bundled SAST+SCA+secrets, AI-assisted triage that specifically targets false-positive fatigue, generous free tier for small teams.
- Cons: per-contributor-per-product pricing can add up quickly once Secrets and SCA are both enabled; its dataflow analysis, while real, is not as exhaustive as CodeQL’s for deep cross-file vulnerability chains.
CodeQL
- Pros: the most rigorous semantic/dataflow analysis of the three, free for public/open-source repositories, deeply integrated into GitHub’s pull request and code scanning UI.
- Cons: private-repo use requires GitHub Code Security at $30 per active committer/month on top of a Team or Enterprise seat, writing custom QL queries has a steep learning curve, and it is effectively a GitHub-first tool.
Who It’s a Good Fit For / Who Should Look Elsewhere
SonarQube fits organizations that need a single pane of glass for code quality across a very wide range of languages — including regulated enterprises still running COBOL, ABAP, or PL/I — and that want enforceable quality gates tied into their build pipeline. It’s a weaker fit for small teams that just want fast, narrowly-scoped security scanning without a full quality-governance layer.
Semgrep fits product-engineering teams on modern stacks who want a developer-friendly tool that’s easy to write custom rules for, bundles SCA and secrets scanning, and uses AI specifically to cut down on triage time. It’s a weaker fit for teams needing certified compliance reporting for legacy enterprise languages, where SonarQube’s Enterprise tier is more mature.
CodeQL fits teams already standardized on GitHub Enterprise who want the deepest available dataflow analysis and are willing to pay the per-committer premium, plus open-source maintainers who get it for free on public repos. It’s a weaker fit for teams on GitLab, Bitbucket, or self-hosted git who don’t want to adopt GitHub purely for security tooling.
Bottom Line
Pick SonarQube for enterprise-wide code quality governance and language breadth, Semgrep for fast, customizable, AI-assisted SAST/SCA/secrets with a generous free tier, and CodeQL for the deepest semantic vulnerability research inside the GitHub ecosystem. Many mature AppSec programs run Semgrep or SonarQube for breadth and velocity, and layer CodeQL on top for deep dataflow checks on their highest-risk repositories.
FAQ
Is any of these three fully free for a private company codebase?
SonarQube’s Community Build and Semgrep’s Free Edition (up to 10 contributors) can both be used on private code at no cost, with feature limits. CodeQL is free only on public GitHub repositories; private use requires GitHub Code Security.
Which tool has the lowest false-positive rate?
There’s no independently audited, vendor-neutral benchmark we could verify for 2026, so treat any specific percentage claim with skepticism. Semgrep’s AI-assisted triage and CodeQL’s dataflow precision are both specifically designed to reduce noise versus simple pattern matching, but actual results depend heavily on rule tuning.
Can I run more than one of these together?
Yes — they’re not mutually exclusive, and many teams run SonarQube or Semgrep for broad, fast coverage in every pull request, and CodeQL for periodic deep scans on security-critical services.
Do these tools replace a human security review?
No. All three are designed to catch classes of known issues automatically; none of the vendors claims to replace manual code review or penetration testing for business-logic or novel vulnerability classes.
Sources
- SonarSource — Plans and Pricing
- Semgrep — Pricing
- GitHub — Pricing
- GitHub — Security Plans
- CodeQL Documentation — Supported Languages and Frameworks
Discover more from Software Online Review
Subscribe to get the latest posts sent to your email.
