SonarQube vs ESLint vs Ruff

Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.

SonarQubeESLintRuff

SonarQubeCode Quality

ESLintCode Quality

RuffCode Quality

Entry price

From €32 per year per 100k lines of code (Developer Edition, indicative)

Free tier

Free and open source

Open source

Free and open source

Open source

What drives the bill

The metric that actually scales your invoice.

Licensed by lines of code, which makes cost predictable but expensive on large monorepos. Branch and PR analysis requires a paid edition.

Free and open source. You pay in engineering time and CI minutes.

Free tier

Community Build is free and self-hosted, covering the main languages without branch analysis.

Everything, self-hosted

Open source

LGPL-3.0 (Community Build)

MIT

Self-hostable

No-code authoring

Languages

JavaJavaScriptTypeScriptPythonC#GoPHPRubyKotlinSwift

JavaScriptTypeScript

Platforms

WebAPIDesktop

WebAPI

Fits teams

StartupScale-up / mid-marketEnterprise

Solo / side projectStartupScale-up / mid-marketEnterprise

Adoption

Category standard

Sonar · since 2007

Category standard

OpenJS Foundation · since 2013

Category standard

Astral · since 2022

Strengths

Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
Very broad language coverage from one tool and one gate.
Self-hosting satisfies organisations that cannot send source code externally.

The plugin ecosystem lets you enforce almost any convention as a rule.
Autofix handles a large share of findings without human effort.
Universal — every JavaScript tool integrates with it.

Replaces Flake8, isort, Black, pyupgrade and more with a single fast binary.
Fast enough to run on every keystroke in the editor.
Straightforward migration from existing Flake8 configurations.

Limitations

Branch and pull-request analysis — the feature most teams actually need — is paid only.
Default rule sets are noisy until tuned to the team.
Self-hosted instances need real resources and maintenance.

Configuration is a real project of its own, and the flat-config migration caused significant churn.
Slow on large codebases without caching.
Rule sprawl produces bikeshedding unless someone owns the config.

Not every niche Flake8 plugin rule has been ported.
Type checking is a separate concern — you still need mypy or ty.
Rapid release cadence occasionally changes behaviour.

Best for

Polyglot organisations that need one quality gate across every repository.

Every JavaScript and TypeScript project.

Every Python project.

Full review

All of these integrate with: VS Code.

Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.