SonarQube vs ESLint vs Ruff
Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.
Entry price
From $34 per month (SonarQube Cloud Team, up to 100k lines of code)
Free tierFree and open source
Open sourceFree and open source
Open sourceWhat drives the bill
The metric that actually scales your invoice.
SonarQube Cloud Team starts at $34/month for 100k lines of code and scales in LOC increments. Self-managed SonarQube Server (Developer, Enterprise, Data Center) is licensed per instance per year by lines of code, and SonarSource no longer publishes those figures — you have to ask sales. Branch and PR analysis requires a paid edition either way.
Free and open source. You pay in engineering time and CI minutes.
Free and open source. You pay in engineering time and CI minutes.
Free tier
Community Build is free and self-hosted; SonarQube Cloud is free for public projects and for private projects up to 50k lines of code.
Everything, self-hosted
Everything, self-hosted
Open source
LGPL-3.0 (Community Build)
MIT
MIT
Self-hostable
No-code authoring
Languages
Platforms
Fits teams
Adoption
Category standard
Sonar · since 2007
Category standard
OpenJS Foundation · since 2013
Category standard
Astral · since 2022
Strengths
- Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
- Very broad language coverage from one tool and one gate.
- Self-hosting satisfies organisations that cannot send source code externally.
- The plugin ecosystem lets you enforce almost any convention as a rule.
- Autofix handles a large share of findings without human effort.
- Universal — every JavaScript tool integrates with it.
- Replaces Flake8, isort, Black, pyupgrade and more with a single fast binary.
- Fast enough to run on every keystroke in the editor.
- Straightforward migration from existing Flake8 configurations.
Limitations
- Branch and pull-request analysis — the feature most teams actually need — is paid only.
- Default rule sets are noisy until tuned to the team.
- Self-hosted instances need real resources and maintenance.
- Configuration is a real project of its own, and the flat-config migration caused significant churn.
- Slow on large codebases without caching.
- Rule sprawl produces bikeshedding unless someone owns the config.
- Not every niche Flake8 plugin rule has been ported.
- Type checking is a separate concern — you still need mypy or ty.
- Rapid release cadence occasionally changes behaviour.
Best for
Polyglot organisations that need one quality gate across every repository.
Every JavaScript and TypeScript project.
Every Python project.
All of these integrate with: VS Code.
Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.