SAST and AI code review. One server. Your model.

Qualor runs the analyzers you trust and gates the code you change. Its AI reviewer reads your merge requests like a careful colleague and comments on the lines, on a model you choose. Free, with no lines‑of‑code licence.

Get startedTry the live demo

#2 Add CSV export to invoices

Merged

Qualor commented

Quality gate failed· 1 new issue

HighData from the HTTP request reaches the text of an SQL query.export.ts:9Fixed

AI review· 1 finding

The final page of invoices is never exportedResolved

for (let page = 1; page < pages; page++) {for (let page = 1; page <= pages; page++) {
  • MIT licensed
  • Self-hosted
  • Your model

One line in your pipeline.

The scanner runs in your CI, collects what every analyzer finds, works out which lines the merge request changed, and sends one report to your server. It waits for the verdict and fails the job when the gate fails.

On GitLab, findings also show in the merge request widget and the security tab through the Code Quality and SAST reports. The CI/CD component is in the GitLab CI/CD catalog.

include:
  - component: gitlab.com/qualor/qualor/qualor@0.14
    inputs: { image-tag: "0.14" }

What Qualor does

Analysis

Your analyzers in one list, and a gate on the code you change, reported in your merge requests.

It judges only the code you changed

Old issues stay visible, but they never block a merge. The gate looks at new code: new issues, coverage of new lines, duplication in new lines. Small changes don't fail on coverage percentages.

Your analyzers, one list

Qualor runs proven open-source tools, adds its own security rules, and merges what they find. The same finding from two tools shows once.

Security
  • Qualor security rulesJS, TS, Python, Java, Go, C#
  • FindSecBugsJava
  • OpenGrep30+ languages
  • GitleaksSecrets
  • TrivyDependencies
Code quality
  • ESLintTS, JS
  • RuffPython
  • PMDJava
  • SpotBugsJava bytecode
  • detektKotlin
  • SwiftLintSwift
  • PHPStanPHP
  • RuboCopRuby
  • staticcheck + gosecGo
  • cppcheckC, C++
  • Roslyn + RoslynatorC#
  • stylelint + HTMLHintCSS, HTML
  • Your SARIFany tool

Security that follows the request

Qualor's own rules follow request data into SQL, commands, file paths, URLs and templates in JavaScript, TypeScript, Python, Java, Go and C#. For ASP.NET Core, a deep analysis after your build follows it across files, projects and Razor views.

  1. routes/invoices.tsreads the request
  2. services/invoices.tspasses it on
  3. invoices/export.tsbuilds SQL with it

HighSQL built from request data

Coverage, duplication, complexity

Imports coverage from LCOV, Cobertura and JaCoCo, measures cognitive complexity and finds copy-pasted code. Keeps the history of every branch and merge request.

  • Coverage86.2%Better than 64.0%64%66.1%65.2%70.4%72.8%76%79.3%82.5%86.2%
  • Duplication1.8%Better than 4.1%4.1%3.9%4%3.2%2.9%2.6%2.3%2%1.8%
  • Complexity6.3Better than 9.89.89.59.68.78.17.676.66.3

Triage unblocks the merge

Mark a finding as a false positive or won't fix, and the gate is judged again at once, with no new pipeline. Qualor knows an issue by its code, not its line number, so the decision survives a refactor.

Medium src/invoices/csv.ts:41 Cognitive complexity 21 is over 15
Quality gateFailed: 1 new issuePassed, judged again, no pipeline

Better together.

The reviewer is shown what your analyzers found, so it doesn't repeat it.

Both kinds of finding land in one issue list, so your agent fixes both through MCP.

AI findings never fail the gate.

Review

A reviewer on your model, in the merge request's threads.

Reads the code behind the change

It reads the change and opens any file of the repository it needs, not only the diff.

  • src/invoices/csv.tschanged
  • src/db.tsopened
  • src/invoices/list.tsopened

Suggested changes in one click

It starts threads on the changed lines. Where a fix fits, the thread carries it as a suggested change that a person applies in one click.

The final page of invoices is never exported

for (let page = 1; page < pages; page++) {for (let page = 1; page <= pages; page++) {
Apply suggestion

It answers replies

Reply in its thread and it answers. A member's reply can mark the finding won't fix or false positive.

Team member replied

Accounting exports a few dozen invoices a month. Can this wait for the next release?

AI review · reply

I’d recommend fixing it before the next release: an export with 1–50 matching invoices contains no invoice rows, so accounting’s usual exports are likely affected. Changing the loop condition to page <= pages includes the final page; tests around the 50-invoice boundary would help prevent a recurrence.

Only what changed since the last review

After a push, only new changes raise new findings. Fixed findings close and their threads resolve.

  1. First push · 7 findings
  2. Next push · the fix

ResolvedThe final page of invoices is never exported

Your model, three sizes

A strong, a standard and a fast model: any OpenAI-compatible or Anthropic model with your key, or a local one through Ollama or vLLM.

  • Strongjudges the findings
  • Standardreviews and replies
  • Fastsmall changes

What a review looks like.

Screens from a real pull request on GitHub: a thread with its suggested change, the summary comment, and an answer to a reply.

A pull request conversation on a changed line: the AI review's finding, why it matters, and its suggested change
A finding on the changed line, with a fix that a person applies in one click.
Qualor's summary comment: the AI review's verdict, its findings by severity and a walkthrough of the change
The summary comment: the quality gate, then the AI review's findings by severity.
A team member asks in an AI review thread whether the fix can wait, and the reviewer answers that it should be fixed before the release
A reply in the thread gets an answer that reads the code. A member's decision can also mark the finding won't fix.

Your agent fixes both kinds of findings.

Connect Claude Code, Cursor or any MCP client with one URL. Your agent reads your analyzers' issues and the AI review's findings, each with its code, fixes them, and checks the gate again after CI. It signs in as you and can do only what you can.

In Qualor itself, the assistant explains an issue, suggests whether a finding is a false positive, and suggests a fix that a person can post to the merge request. On Enterprise, fix suggestions for new findings are posted without a click.

How to connect

Every gate, issue and trend in one place.

A web UI your whole team can read at a glance: which gate failed and why, what to fix first, and where the code is heading. Light or dark, on a laptop or a phone.

Click through the live demo: Qualor checking its own code. No sign-up.

A project's overview: the quality gate that failed and the condition that failed it, then the measures on new code and their trends
The gate that failed and why, the figures that matter, and where the code is heading.
A project's issues, filtered by severity and status, with the severity of each and the rule, file and line that found it
Filter by severity, status and rule, then triage in bulk.
An issue with the code around it and an explanation of the finding and how to fix it, written by the team's own model
The code around an issue, with an explanation and a fix from the model you choose.
A quality gate's conditions, each changed right in its row
Quality gates you change right in place.
A finding of the AI review in Qualor, with the code it points at, the review's text and its suggested change
An AI finding in Qualor, with the review's text and its suggested change.

Gate failures reach your team — in Slack and Teams.

Add a Slack or Microsoft Teams channel in a minute. When the main branch's quality gate fails, the channel hears about it with what failed and a button back to Qualor. When it passes again, it hears that too. Every Monday morning, a security digest shows what is new across your projects.

Connect a channel

Scattered dots gathered by fine lines into one clean circle

Leave SonarQube in one command.

Point Qualor at your SonarQube server. It brings over your quality profiles, your quality gates and the status of every issue, so the false positives and won't-fix decisions your team already made stay made.

qualor import sonarqube \
  --url https://sonar.example.com \
  --token $SONAR_TOKEN

How Qualor compares with SonarQube

Analyse ten million lines. Pay nothing for them.

The community edition is MIT licensed and free for commercial use, with no limit on lines of code, users or projects, and includes roles and project-level access. An enterprise licence adds single sign-on, automatic provisioning and an audit trail, with compliance exports and portfolio reports on Enterprise.

1.2 millionLicence cost for those lines: 0
A tape measure unrolling across the page without end

Community

Free for any use, commercial included

Everything on this page except the Enterprise features, AI code review included, with all four roles and project-level access. Use it at your company, for client work and in closed-source projects. Unlimited lines of code, users, projects and organisations.

Get started

Business and Enterprise

Priced per server, never by lines of code or by seat

Business adds single sign-on, a tamper-evident audit log and a dependency licence policy, with one licence key. Enterprise adds automatic provisioning, SIEM streaming, several identity providers and priority support. Compliance exports and portfolio reports are included with Enterprise.

Request a quoteSee plans and prices

Running in minutes

The server is one container with its own PostgreSQL, or your PostgreSQL 16+. Use Docker Compose on a single machine, or the Helm chart on Kubernetes.

  1. Start the server

    # compose.yml: copy it from qualor.dev/docs/install-server
echo "QUALOR_VERSION=0.14" > .env      # plus two generated secrets
docker compose up -d

    The images are on Docker Hub. The install guide has the compose file, TLS, backups and upgrades.

  2. Create a project and a token

    Sign in as admin, create a project, then an access token with the Upload analyses scope.

  3. Add the scanner to CI

    Set QUALOR_URL and QUALOR_TOKEN as CI variables and add the snippet above. For review comments, connect GitLab, or create a GitHub App, add it in Settings and install it on the repository.

A single server drawn in outline, with lines passing through it

Questions

Is Qualor free?

Yes, for commercial use too. The community edition is MIT licensed: use it at your company and for client work, with no limit on lines of code, users, projects or organisations, and with roles and project-level access. Organisations that need single sign-on, SCIM provisioning, a tamper-evident audit log or a dependency licence policy can buy a Business or Enterprise licence, priced per server, never by lines of code or by seat. Plans and prices are on the Enterprise page.

Can Qualor replace SonarQube?

For what most teams use SonarQube for, yes: issues, coverage, duplication, complexity, quality gates on new code, and review comments on merge requests. Qualor runs proven open-source analyzers plus its own security rules, so it does not aim for rule-by-rule parity.

Which languages does it support?

TypeScript and JavaScript with ESLint, Python with Ruff, Java with PMD and SpotBugs, Kotlin with detekt, Swift with SwiftLint, PHP with PHPStan, Ruby with RuboCop, Go with staticcheck, go vet and gosec, C and C++ with cppcheck, C# with Roslyn analyzers and Roslynator in your own .NET build, CSS and HTML with stylelint and HTMLHint, Qualor's own security rules that follow request data into SQL, commands, file paths, URLs and templates in JavaScript, TypeScript, Python, Java, Go and C# (for ASP.NET Core, a deep analysis after your build follows it across files, projects and Razor views), security rules for more than 30 languages with OpenGrep, committed secrets with Gitleaks, and vulnerable dependencies and their licences with Trivy. Any other tool that writes SARIF plugs in too.

Which models does AI review work with?

Any OpenAI-compatible or Anthropic model, hosted with your own key, or a local model through Ollama or vLLM. You can give the review a strong, a standard and a fast model.

Models that work with AI review

Does my code leave my network?

Qualor stores everything on your server. AI review sends the merge request, the files the model reads and the findings on them to the model you chose, with secrets masked; the assistant sends the lines of the issue you ask about. With a local model, your code never leaves your network.

What does AI review cost?

Nothing from us: it is in the free community edition. You pay your model provider, or nothing with a local model, and daily budgets keep spend in check.

Set up AI review

How do I move from SonarQube?

Run one command with your SonarQube address and a token. It brings over your quality profiles, quality gates and issue statuses, so the false positives and won't-fix decisions your team made stay made.

Does it work with GitHub?

Yes, GitHub.com and GitHub Enterprise Server. Each pull request gets a check run, review comments on the changed lines and one summary comment that stays up to date. On GitLab, merge requests get the same, plus findings in GitLab's own Code Quality and security reports.

How do I run it?

The server is one container with its database included, or pointed at your own PostgreSQL. Use Docker Compose on a single machine or the Helm chart on Kubernetes. The scanner runs in your CI as a container image or a single binary.