SonarQube

A static analysis platform that scans source code for bugs, vulnerabilities, code smells and duplicated logic, then tracks the results over time. It analyses many languages, enforces quality gates that can fail a build when a project drifts below set thresholds, and can annotate pull requests so issues appear where the code is written.

Teams use it to watch legacy codebases, to hold new work to a standard, and to see which hotspots deserve refactoring first.

The service can it in the catalog, so findings and source code stay on your servers, there is no per-branch cloud pricing, and the metric database is yours to snapshot and restore.