Introduction to DevDox AI Sonar

DevDox AI Sonar is an LLM-based CLI tool whose core function is to read SonarCloud analysis reports, generate structured fix suggestions using large language models, support multiple LLM providers, and offer a complete workflow for fix review and application. It addresses the pain point where SonarCloud can only identify issues but cannot provide fix solutions, helping teams reduce manual fix costs, alleviate technical debt accumulation, and form a code quality closed loop of "issue discovery → fix generation → application of improvements".

Problem Background

SonarCloud is a standard code quality tool in modern CI/CD workflows. It can scan and identify runtime errors, security vulnerabilities, code smells, and other issues, but only tells "where the error is" without providing specific fix guidance. For projects with hundreds of pending issues, manual fixes require reading rules, understanding context, writing code, and testing—tasks most teams struggle to complete, leading to issue accumulation and continuous increase in technical debt. DevDox AI Sonar was created precisely to address this pain point.

Project Overview and Tech Stack

Project Overview: DevDox AI Sonar is a CLI tool + Python library. After reading SonarCloud reports, it sends issues and code context to LLMs, generating fix solutions that include code blocks, line numbers, and confidence levels. Users can apply the fixes after review, and a Markdown change log is generated simultaneously. Its core value lies in combining SonarCloud's issue discovery capability with LLMs' problem-solving ability to form a quality improvement closed loop. Tech Stack:

• CLI Frameworks: Click (command handling), Questionary (interactive prompts), Rich (terminal formatting)
• Data Processing: Pydantic (data validation), Jinja2 (prompt templates), aiofiles (asynchronous I/O)
• Installation & Distribution: Direct installation via PyPI, automated build and release using GitHub Actions.

Detailed Workflow Explanation

The tool's fix workflow consists of six stages:

1. Issue Acquisition: Read reports via the SonarCloud Issues API, filter by type/severity level; group regular issues by rule, and security issues by file.
2. Repository Cloning & Code Extraction: Clone the repository to a temporary directory, locate the issue lines, and extract code with context (10 lines by default). Use fuzzy matching to locate lines when code changes.
3. Prompt Construction: Assemble prompts including code, rule descriptions, metadata, etc., using Jinja2 templates.
4. LLM Invocation: Send the prompt to the user-configured LLM, which returns structured JSON (code blocks, import changes, fix explanations, confidence levels, etc.).
5. Validation: In non-preview mode, initiate a second LLM call to review and correct logical/security/syntax issues in the fixes.
6. Preview & Application: Display fix information in the terminal; write to disk when apply=1, generate a backup directory when create_backup=1, and generate a change log at the same time.

LLM Support and Configuration Usage

LLM Providers: Supports OpenAI (GPT series), Google Gemini, TogetherAI (open-source models), and OpenRouter (unified access to multiple models), allowing users to choose as needed. Usage Modes:

• Interactive Mode: Guided prompts for configuration and fixes, suitable for first-time use or fine-grained control.
• Direct Mode: Specify options via command-line parameters, suitable for CI/CD integration. Configuration System:
• Supports YAML/JSON configuration files (preset project information, LLM selection, filtering rules, etc.).
• Environment variables can override all configuration items, facilitating CI/CD usage.
• Supports excluding specific issue types by rule ID.

Security, Privacy, and Practical Value

Security & Privacy:

• Local Processing: Code is cloned to a temporary directory without modifying the working directory; supports Dry Run mode for safe testing.
• Data Protection: API keys are managed via environment variables/config files; code snippets are only sent to the specified LLM.
• Review Mechanism: Fixes display confidence scores, validation agents perform secondary reviews, and change logs provide audit trails. Practical Value:
• Lower Threshold: Reduces developers' cognitive burden regarding SonarCloud rules.
• Accelerate Improvements: Quickly handle backlogged issues and improve codebase health.
• Knowledge Transfer: Learn best practices through fix suggestions.
• Balance Efficiency and Quality: Multi-layer review mechanisms ensure a balance between automation and manual control.

Summary and Outlook

DevDox AI Sonar does not replace SonarCloud; instead, it complements it: SonarCloud is responsible for issue discovery, while DevDox AI Sonar generates fix solutions. It provides a practical code quality solution for teams with limited resources and demonstrates new application scenarios for LLMs in improving existing code. As LLM capabilities advance, such tools will help teams manage technical debt more efficiently and drive further development of AI-assisted development.