SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar
Source
youtube.com
Author
AI Engineer
Date
Why it matters
Shows how to put static analysis inside a coding agent's loop with hooks and MCP, so vulnerabilities like SQL injection and leaked keys are caught during editing instead of at review.
Key takeaways · AI-distilled
In Sonar's demo, SonarQube traces user-controlled input into database execution in a sample Python app, and Codex fixes it by swapping string interpolation for a parameterized query that a verification agent hookA script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.Full definition → then re-checks.
The OpenAI introduction to the Sonar workshop splits AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → safety into two concerns, execution containment and artifact correctness, and treats a task as complete only when it yields a reviewable change backed by independent evidence.
Killian Carlsen-Phelan's setup combines SonarQube Cloud, its CLI, a Codex plugin and an MCP server, with an issue-listing agent skillA reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.Full definition → that hands the agent findings straight from the project dashboard.
Terms in this piece · Glossary
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent hook — A script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
videoTaming the AI Hardware Cambrian Explosion — Abdul Dakkak, Modular
videoThe Autonomous Computer: Infrastructure for Computer Use Agents — Ang Li, Simular
videoHow Secrets Leak Through AI Agents (and How to Stop It) — Venice AI
videoFrom Zero to Leaderboard: Agent Evaluation — Wolfram Ravenwolf, Weights & Biases
