how we fit together

Wystan + SonarQube

SonarQube has been the standard for static analysis and security scanning for over a decade — code smells, bug patterns, SAST. Wystan maps which features carry those issues and what their runtime impact is. Different layers, same goal. Use both, or Wystan alone for the behavioural side.

What SonarQube does best

Mature static analysis across 30+ languages with thousands of rules. SOC 2-ready reporting, deep Java / .NET coverage, and a CI quality-gate model trusted by enterprise. The static-analysis category is largely theirs.

Static analysis across 30+ languages
Security vulnerability detection (SAST)
Code-smell taxonomy with thousands of rules
CI quality gates with strict pass/fail
SOC 2 / compliance-ready reporting

What Wystan adds

We don’t do static analysis. We tell you which feature each issue lives in, group them by business surface, and connect to runtime data. SonarQube finds the problem at the line; Wystan tells you which feature carries the cost.

Feature-level grouping of issues + ownership
Behavioural analysis (git-history hotspots, churn)
Sentry + PostHog attribution per feature
MCP server for Cursor, Claude Code, Cline, Aider
Flat per-org pricing from $99/mo, unlimited developers

using both

How they actually combine

SonarQube finds 200 issues across the repo — security vulnerabilities, code smells, bug patterns.

Wystan groups them by feature: “Billing: 47 issues. Auth: 12. Reports: 8.”

You prioritise knowing that Billing also had 47 Sentry errors last week and 38% coverage. The fix order is now obvious instead of a 200-item triage backlog.

or alone

Just Wystan, on its own

Wystan doesn’t replace static analysis. We do behavioural analysis (git-history-based) and runtime correlation. For static rules and security scans, you still want SonarQube (or Semgrep, or CodeQL). Wystan focuses on the questions SonarQube doesn’t answer: which feature is decaying? Who owns this hotspot? What broke in production this week? If you want both lenses without two procurement cycles, Wystan alone gets you the behavioural and runtime side; pair with any static analyser when you’re ready.

side by side

Where each one focuses

Focus area	SonarQube	Wystan
Primary unit	File / line static analysis	Feature + flow map
Static analysis	✓ deep	—
Security scanning (SAST)	✓	—
Behavioural analysis (git-history)	—	✓
Runtime signal	—	Sentry + PostHog
Pricing	From $34 / mo per 100K LOC (SonarQube Cloud)	$99–299 / org / mo, unlimited developers
Best fit	Code-quality gate in CI	System-level codebase intelligence

honest take

No vendor pressure

SonarQube and Wystan answer different questions — they’re complementary, not competitive. Sonar tells you “this line has a security vulnerability.” Wystan tells you “your Billing feature has been quietly accumulating these issues and now also has 47 errors in production.” Use Sonar in CI as a quality gate; use Wystan in dashboards and PR comments for system-level insight. Many enterprise teams already run both.

also comparing

Other tools we work alongside