Stop letting AI Agents write bad code

Since the beginning of this year, I have Since the beginning of this year, I have fully immersed myself into an fully immersed myself into an fully immersed myself into an agent-driven software development agent-driven software development agent-driven software development approach. One thing I love about approach. One thing I love about approach. One thing I love about software engineering is optimizing software engineering is optimizing software engineering is optimizing things, making them more efficient. So, things, making them more efficient. So, things, making them more efficient. So, I've been trying to figure out ways how I've been trying to figure out ways how I've been trying to figure out ways how to make my agent-driven work better. And to make my agent-driven work better. And to make my agent-driven work better. And in this video, I want to present an in this video, I want to present an in this video, I want to present an interesting idea of how we can introduce interesting idea of how we can introduce interesting idea of how we can introduce context and verification inside of the context and verification inside of the context and verification inside of the agentic loop that should give us better agentic loop that should give us better agentic loop that should give us better results. So, let me show you what I results. So, let me show you what I results. So, let me show you what I mean. Here's what a typical agent loop mean. Here's what a typical agent loop mean. Here's what a typical agent loop looks like. So, your agents generate looks like. So, your agents generate looks like. So, your agents generate some code, and then you, as the some code, and then you, as the some code, and then you, as the developer, have to review the code. So, developer, have to review the code. So, developer, have to review the code. So, this is the first step. After reviewing this is the first step. After reviewing this is the first step. After reviewing this code, you're either going to figure this code, you're either going to figure this code, you're either going to figure out that it's correct, or you're going out that it's correct, or you're going out that it's correct, or you're going to find some issues that you then want to find some issues that you then want to find some issues that you then want to proceed and fix. So, let's say this to proceed and fix. So, let's say this to proceed and fix. So, let's say this is the second step. And then, we've got is the second step. And then, we've got is the second step. And then, we've got our last step, which is just fixing our last step, which is just fixing our last step, which is just fixing this. To fix it, you could either write this. To fix it, you could either write this. To fix it, you could either write the code yourself, the code yourself, the code yourself, or you can ask the agent to fix the or you can ask the agent to fix the or you can ask the agent to fix the problem. I think the majority of problem. I think the majority of problem. I think the majority of developers are going to be in the second developers are going to be in the second developers are going to be in the second camp. Now, there's one problem if you camp. Now, there's one problem if you camp. Now, there's one problem if you want to fully maximize the efficiency of want to fully maximize the efficiency of want to fully maximize the efficiency of this agent-driven loop, and that is this agent-driven loop, and that is this agent-driven loop, and that is reviewing the code. Now, I'm not going reviewing the code. Now, I'm not going reviewing the code. Now, I'm not going to tell you to not read the code. You to tell you to not read the code. You to tell you to not read the code. You should be reading your code, and this is should be reading your code, and this is should be reading your code, and this is important for comprehension. If you want important for comprehension. If you want important for comprehension. If you want to truly understand what's happening to truly understand what's happening to truly understand what's happening inside of your code base, you have to inside of your code base, you have to inside of your code base, you have to read the code. What extent you do so, I read the code. What extent you do so, I read the code. What extent you do so, I leave up to you, but I think reading and leave up to you, but I think reading and leave up to you, but I think reading and reviewing the code is still an essential reviewing the code is still an essential reviewing the code is still an essential part of software development. Now, the

part of software development. Now, the part of software development. Now, the idea I'm trying to float here is what if idea I'm trying to float here is what if idea I'm trying to float here is what if we could make our agents more efficient we could make our agents more efficient we could make our agents more efficient and give them a way to also review their and give them a way to also review their and give them a way to also review their work within the context of our existing work within the context of our existing work within the context of our existing code base, so that the end result is code base, so that the end result is code base, so that the end result is reducing the number of issues inside of reducing the number of issues inside of reducing the number of issues inside of our code base. And this is where the our code base. And this is where the our code base. And this is where the sponsor of today's video comes in. The sponsor of today's video comes in. The sponsor of today's video comes in. The team over at SonarQube has released team over at SonarQube has released team over at SonarQube has released Sonar Vortex, which integrates into your Sonar Vortex, which integrates into your Sonar Vortex, which integrates into your agent's loop and improves it by giving agent's loop and improves it by giving agent's loop and improves it by giving the agent context about your code base the agent context about your code base the agent context about your code base and also performing analysis with and also performing analysis with and also performing analysis with SonarQube on the newly generated code. SonarQube on the newly generated code. SonarQube on the newly generated code. And this gives your agent instant And this gives your agent instant And this gives your agent instant feedback about the work they are doing, feedback about the work they are doing, feedback about the work they are doing, leading them to produce better code and leading them to produce better code and leading them to produce better code and in turn making you more efficient by in turn making you more efficient by in turn making you more efficient by having to do less rework with the having to do less rework with the having to do less rework with the agents. And of course, the end result is agents. And of course, the end result is agents. And of course, the end result is spending fewer tokens. And who doesn't spending fewer tokens. And who doesn't spending fewer tokens. And who doesn't want that? I want to show you how all of want that? I want to show you how all of want that? I want to show you how all of this fits together with a practical this fits together with a practical this fits together with a practical example. For this, I made a billing and example. For this, I made a billing and example. For this, I made a billing and invoicing API and I introduced a subtle invoicing API and I introduced a subtle invoicing API and I introduced a subtle but very serious security vulnerability but very serious security vulnerability but very serious security vulnerability inside of this API endpoint. I'm going inside of this API endpoint. I'm going inside of this API endpoint. I'm going to show you how SonarQube can find and to show you how SonarQube can find and to show you how SonarQube can find and flag this and also how we're going to flag this and also how we're going to flag this and also how we're going to fix it using Sonar Vortex and Cloud fix it using Sonar Vortex and Cloud fix it using Sonar Vortex and Cloud Code. So, let's open up the terminal as Code. So, let's open up the terminal as Code. So, let's open up the terminal as I want to first install the SonarQube I want to first install the SonarQube I want to first install the SonarQube CLI, which is going to be our entry CLI, which is going to be our entry CLI, which is going to be our entry point into integrating Vortex and all of point into integrating Vortex and all of point into integrating Vortex and all of the Agendy capabilities that SonarQube the Agendy capabilities that SonarQube the Agendy capabilities that SonarQube has to offer. I'm going to drop in this has to offer. I'm going to drop in this has to offer. I'm going to drop in this command. I'll also leave it inside command. I'll also leave it inside command. I'll also leave it inside description of this video if you want to description of this video if you want to description of this video if you want to follow along. I'm going to hit enter and follow along. I'm going to hit enter and follow along. I'm going to hit enter and this will install. Now, I've already

this will install. Now, I've already this will install. Now, I've already done this while testing this out. I've done this while testing this out. I've done this while testing this out. I've got the SonarQube CLI available and if I got the SonarQube CLI available and if I got the SonarQube CLI available and if I run sonar version, I'll get 1.6.0. run sonar version, I'll get 1.6.0. run sonar version, I'll get 1.6.0. Behind the scenes, I already integrated Behind the scenes, I already integrated Behind the scenes, I already integrated this project with SonarQube Cloud and this project with SonarQube Cloud and this project with SonarQube Cloud and now I need to authenticate the SonarQube now I need to authenticate the SonarQube now I need to authenticate the SonarQube CLI with my cloud instance. So, the CLI with my cloud instance. So, the CLI with my cloud instance. So, the command for this is sonar off login. I'm command for this is sonar off login. I'm command for this is sonar off login. I'm going to specify which region you want going to specify which region you want going to specify which region you want to use. I'm in the EU region, so I'll to use. I'm in the EU region, so I'll to use. I'm in the EU region, so I'll use the sonarcloud.io endpoint. And then use the sonarcloud.io endpoint. And then use the sonarcloud.io endpoint. And then my org name is emilyovanovic, which is my org name is emilyovanovic, which is my org name is emilyovanovic, which is the same as my GitHub handle. So, if I the same as my GitHub handle. So, if I the same as my GitHub handle. So, if I run this, it's going to open up a run this, it's going to open up a run this, it's going to open up a browser window where I can authenticate browser window where I can authenticate browser window where I can authenticate using my SonarCloud instance. However, using my SonarCloud instance. However, using my SonarCloud instance. However, since I've already logged in, this is since I've already logged in, this is since I've already logged in, this is just going to find my existing token and just going to find my existing token and just going to find my existing token and you can see that the authentication is you can see that the authentication is you can see that the authentication is successful. From here, I can use the CLI successful. From here, I can use the CLI successful. From here, I can use the CLI to interact with my SonarQube Cloud to interact with my SonarQube Cloud to interact with my SonarQube Cloud instance. And let's say I want to list instance. And let's say I want to list instance. And let's say I want to list out any issues that SonarQube detected out any issues that SonarQube detected out any issues that SonarQube detected inside of my code base. Here's the inside of my code base. Here's the inside of my code base. Here's the command for this, and there are two command for this, and there are two command for this, and there are two issues found that we're going to fix issues found that we're going to fix issues found that we're going to fix along the way. There's a minor security along the way. There's a minor security along the way. There's a minor security issue inside of my PDF renderer class issue inside of my PDF renderer class issue inside of my PDF renderer class where I'm passing in some user control where I'm passing in some user control where I'm passing in some user control data to construct an operating system data to construct an operating system data to construct an operating system command. This is a potential security command. This is a potential security command. This is a potential security exploit. And then I've got a more exploit. And then I've got a more exploit. And then I've got a more serious issue inside of the documents serious issue inside of the documents serious issue inside of the documents controller where I'm constructing a file controller where I'm constructing a file controller where I'm constructing a file path based on user control data. And path based on user control data. And path based on user control data. And this is the actual exploit I mentioned this is the actual exploit I mentioned this is the actual exploit I mentioned earlier. And you can see SonarQube is earlier. And you can see SonarQube is earlier. And you can see SonarQube is able to find it and flag it for me to able to find it and flag it for me to able to find it and flag it for me to solve. Now, the Sonar CLI is pretty solve. Now, the Sonar CLI is pretty solve. Now, the Sonar CLI is pretty powerful even without Vortex, and you

powerful even without Vortex, and you powerful even without Vortex, and you can easily integrate something like can easily integrate something like can easily integrate something like secret scanning. So, what I've got here secret scanning. So, what I've got here secret scanning. So, what I've got here is a simple PowerShell script that's is a simple PowerShell script that's is a simple PowerShell script that's going to plant some secrets into my going to plant some secrets into my going to plant some secrets into my appsettings.local.json. appsettings.local.json. appsettings.local.json. Application secrets is something you Application secrets is something you Application secrets is something you want to keep outside of source control. want to keep outside of source control. want to keep outside of source control. So, if I ask the Sonar CLI to analyze So, if I ask the Sonar CLI to analyze So, if I ask the Sonar CLI to analyze this file for any secrets, you'll see this file for any secrets, you'll see this file for any secrets, you'll see it's going to flag three of them. And it's going to flag three of them. And it's going to flag three of them. And these are the secrets that I planted. these are the secrets that I planted. these are the secrets that I planted. So, the CLI itself is able to detect So, the CLI itself is able to detect So, the CLI itself is able to detect that this is a problem, but it's still that this is a problem, but it's still that this is a problem, but it's still not enforcing anything. However, I can not enforcing anything. However, I can not enforcing anything. However, I can use the CLI to integrate a pre-commit use the CLI to integrate a pre-commit use the CLI to integrate a pre-commit hook with Git that's going to run a hook with Git that's going to run a hook with Git that's going to run a secret scan against my potential commit, secret scan against my potential commit, secret scan against my potential commit, and it's going to prevent me from and it's going to prevent me from and it's going to prevent me from committing any secrets. So, let's committing any secrets. So, let's committing any secrets. So, let's integrate this, and you'll get an integrate this, and you'll get an integrate this, and you'll get an overview of what's going to be added overview of what's going to be added overview of what's going to be added here. I just want to enable it for this here. I just want to enable it for this here. I just want to enable it for this project, and this is going to add a project, and this is going to add a project, and this is going to add a pre-commit hook. And I'm going to say pre-commit hook. And I'm going to say pre-commit hook. And I'm going to say install, and it's going to include a new install, and it's going to include a new install, and it's going to include a new file at this file path. So, it's under file at this file path. So, it's under file at this file path. So, it's under .git/hooks .git/hooks .git/hooks and a file called pre-commit. And this and a file called pre-commit. And this and a file called pre-commit. And this is going to run the secret scan inside is going to run the secret scan inside is going to run the secret scan inside of the pre-commit hook. So, how does of the pre-commit hook. So, how does of the pre-commit hook. So, how does this work? Well, let me clear the CLI.

this work? Well, let me clear the CLI. this work? Well, let me clear the CLI. And let's say I want to stage my And let's say I want to stage my And let's say I want to stage my appsettings.local.json, appsettings.local.json, appsettings.local.json, I can do so with a simple Git command. I can do so with a simple Git command. I can do so with a simple Git command. And remember that this contains our And remember that this contains our And remember that this contains our application secrets. Now, if I want to application secrets. Now, if I want to application secrets. Now, if I want to commit this with some commit message, commit this with some commit message, commit this with some commit message, we're going to see that the commit fails we're going to see that the commit fails we're going to see that the commit fails because we have staged a document that because we have staged a document that because we have staged a document that contains application secrets. And this contains application secrets. And this contains application secrets. And this is our pre-commit hook running this on is our pre-commit hook running this on is our pre-commit hook running this on our CLI and analyzing it for any our CLI and analyzing it for any our CLI and analyzing it for any potential secrets leaking into our potential secrets leaking into our potential secrets leaking into our source control. So, let me undo this. source control. So, let me undo this. source control. So, let me undo this. And this is going to clear up the And this is going to clear up the And this is going to clear up the secrets that I added earlier, and we're secrets that I added earlier, and we're secrets that I added earlier, and we're going to leave the pre-commit hook in going to leave the pre-commit hook in going to leave the pre-commit hook in place because it's a valuable part of place because it's a valuable part of place because it's a valuable part of our analysis. Now, what about the our analysis. Now, what about the our analysis. Now, what about the exploit that I mentioned earlier? So, exploit that I mentioned earlier? So, exploit that I mentioned earlier? So, inside of the documents controller, inside of the documents controller, inside of the documents controller, we've got this download endpoint that we've got this download endpoint that we've got this download endpoint that should allow us to download an invoice should allow us to download an invoice should allow us to download an invoice based on the invoice number and the based on the invoice number and the based on the invoice number and the specific file that we want to fetch. We specific file that we want to fetch. We specific file that we want to fetch. We accept the invoice number as a route accept the invoice number as a route accept the invoice number as a route parameter, while the file is a wildcard. parameter, while the file is a wildcard. parameter, while the file is a wildcard. And this is the problematic part. Now, And this is the problematic part. Now, And this is the problematic part. Now, we pass this down to the document we pass this down to the document we pass this down to the document resolver, and this is where the actual resolver, and this is where the actual resolver, and this is where the actual problem is. What we do is we try to problem is. What we do is we try to problem is. What we do is we try to replace a potential path traversal replace a potential path traversal replace a potential path traversal sequence inside of the file name with an sequence inside of the file name with an sequence inside of the file name with an empty string in an attempt to clean it empty string in an attempt to clean it empty string in an attempt to clean it up. And then we do a path combine to up. And then we do a path combine to up. And then we do a path combine to find the actual path where the file is find the actual path where the file is find the actual path where the file is stored. However, this contains a very stored. However, this contains a very stored. However, this contains a very subtle bug that a potential malicious subtle bug that a potential malicious subtle bug that a potential malicious user can exploit to, for example, fetch user can exploit to, for example, fetch user can exploit to, for example, fetch files that they should not be able to. I files that they should not be able to. I files that they should not be able to. I want to show you how this works, and want to show you how this works, and want to show you how this works, and I'll run the actual billing API project.

I'll run the actual billing API project. I'll run the actual billing API project. Now, it uses an in-memory SQLite piece Now, it uses an in-memory SQLite piece Now, it uses an in-memory SQLite piece and fills in an example invoice. And we and fills in an example invoice. And we and fills in an example invoice. And we can now send a request to fetch the can now send a request to fetch the can now send a request to fetch the contents of this invoice. So, if I send contents of this invoice. So, if I send contents of this invoice. So, if I send a request to our API to fetch this a request to our API to fetch this a request to our API to fetch this invoice number and then this specific invoice number and then this specific invoice number and then this specific document, you'll see we get back our document, you'll see we get back our document, you'll see we get back our response. Now, remember that this part response. Now, remember that this part response. Now, remember that this part here is a wildcard. So, a potential here is a wildcard. So, a potential here is a wildcard. So, a potential threat actor could try to exploit it threat actor could try to exploit it threat actor could try to exploit it with a path traversal request like this with a path traversal request like this with a path traversal request like this one here. And in this case, our bug is one here. And in this case, our bug is one here. And in this case, our bug is going to creep in and we're going to going to creep in and we're going to going to creep in and we're going to happily return the contents of the happily return the contents of the happily return the contents of the appsettings.json potentially with any appsettings.json potentially with any appsettings.json potentially with any connection strings or other secrets connection strings or other secrets connection strings or other secrets inside. And this is something that inside. And this is something that inside. And this is something that SonarQube and the Sonar CLI can flag for SonarQube and the Sonar CLI can flag for SonarQube and the Sonar CLI can flag for you before you ship this code to you before you ship this code to you before you ship this code to production. The CLI has an agentic production. The CLI has an agentic production. The CLI has an agentic analysis command. You call it with sonar analysis command. You call it with sonar analysis command. You call it with sonar analyze agentic. You specify your analyze agentic. You specify your analyze agentic. You specify your project name and the file you want to project name and the file you want to project name and the file you want to analyze as well as the depth of the analyze as well as the depth of the analyze as well as the depth of the analysis. So, standard analysis is just analysis. So, standard analysis is just analysis. So, standard analysis is just going to examine this one file and give going to examine this one file and give going to examine this one file and give you back the results and you can see it you back the results and you can see it you back the results and you can see it doesn't flag any issues. However, if I doesn't flag any issues. However, if I doesn't flag any issues. However, if I change the depth to be a deep agentic change the depth to be a deep agentic change the depth to be a deep agentic analysis, it's also going to look at the analysis, it's also going to look at the analysis, it's also going to look at the broader context like the nested calls in broader context like the nested calls in broader context like the nested calls in this case to the document path resolver this case to the document path resolver this case to the document path resolver and you will see that this flags our and you will see that this flags our and you will see that this flags our specific issue in real time. So, how do specific issue in real time. So, how do specific issue in real time. So, how do we bridge this gap from having to we bridge this gap from having to we bridge this gap from having to manually run the agentic analysis every manually run the agentic analysis every manually run the agentic analysis every time while being able to work with time while being able to work with time while being able to work with agents like Cloud Code or Code X.

agents like Cloud Code or Code X. agents like Cloud Code or Code X. Luckily, there's a very nice integration Luckily, there's a very nice integration Luckily, there's a very nice integration with Cloud Code that I'm going to show with Cloud Code that I'm going to show with Cloud Code that I'm going to show you here and you enable it by saying you here and you enable it by saying you here and you enable it by saying sonar integrate cloud very similar to sonar integrate cloud very similar to sonar integrate cloud very similar to how we added the pre-commit hook and you how we added the pre-commit hook and you how we added the pre-commit hook and you specify your project name. I'm going to specify your project name. I'm going to specify your project name. I'm going to hit enter and this will do a couple of hit enter and this will do a couple of hit enter and this will do a couple of things. First, it's going to find my things. First, it's going to find my things. First, it's going to find my project inside of SonarQube Cloud and project inside of SonarQube Cloud and project inside of SonarQube Cloud and then it's going to give me a couple of then it's going to give me a couple of then it's going to give me a couple of questions if I want to install the questions if I want to install the questions if I want to install the secret scanning hook. Now, this is secret scanning hook. Now, this is secret scanning hook. Now, this is separate from our pre-commit hook with separate from our pre-commit hook with separate from our pre-commit hook with Git but nonetheless, I still want to Git but nonetheless, I still want to Git but nonetheless, I still want to install it. Then it's going to ask me if install it. Then it's going to ask me if install it. Then it's going to ask me if I want to install Vortex and this is the I want to install Vortex and this is the I want to install Vortex and this is the actual tool that's going to enrich the actual tool that's going to enrich the actual tool that's going to enrich the agent with additional context and it's agent with additional context and it's agent with additional context and it's also going to verify your agent's work also going to verify your agent's work also going to verify your agent's work by running agentic analysis within the by running agentic analysis within the by running agentic analysis within the agent loop. So, of course, I want this. agent loop. So, of course, I want this. agent loop. So, of course, I want this. It's also going to prompt me if I want It's also going to prompt me if I want It's also going to prompt me if I want to install the SonarQube MCP server and to install the SonarQube MCP server and to install the SonarQube MCP server and this is what lets our AI agents this is what lets our AI agents this is what lets our AI agents communicate with our SonarQube Cloud communicate with our SonarQube Cloud communicate with our SonarQube Cloud instance. So, of course, I do want this. instance. So, of course, I do want this. instance. So, of course, I do want this. So, this is what's going to be So, this is what's going to be So, this is what's going to be installed. The secret scanning hook, the installed. The secret scanning hook, the installed. The secret scanning hook, the Vortex analysis hook, the MCP server.

Vortex analysis hook, the MCP server. Vortex analysis hook, the MCP server. Let me hit install, and then this is Let me hit install, and then this is Let me hit install, and then this is going to add a couple of files into our going to add a couple of files into our going to add a couple of files into our project, and I want to walk you through project, and I want to walk you through project, and I want to walk you through what they are. So, you can see we've got what they are. So, you can see we've got what they are. So, you can see we've got a couple of hooks here. These are Cloud a couple of hooks here. These are Cloud a couple of hooks here. These are Cloud Code hooks. It's also going to add a Code hooks. It's also going to add a Code hooks. It's also going to add a context augmentation skill, and update context augmentation skill, and update context augmentation skill, and update your Cloud MD file, which is your agent your Cloud MD file, which is your agent your Cloud MD file, which is your agent file, and also connect the SonarQube file, and also connect the SonarQube file, and also connect the SonarQube MCP. Now, let me show you these files MCP. Now, let me show you these files MCP. Now, let me show you these files real quick. So, NCP.json is our MCP real quick. So, NCP.json is our MCP real quick. So, NCP.json is our MCP server connection, and this is going to server connection, and this is going to server connection, and this is going to run inside of a Docker container run inside of a Docker container run inside of a Docker container locally. The Cloud MD file contains locally. The Cloud MD file contains locally. The Cloud MD file contains general instructions for the Cloud Code general instructions for the Cloud Code general instructions for the Cloud Code agent on how it can use the tools made agent on how it can use the tools made agent on how it can use the tools made available for the SonarQube CLI and the available for the SonarQube CLI and the available for the SonarQube CLI and the Vortex integration. Then, inside of the Vortex integration. Then, inside of the Vortex integration. Then, inside of the dot cloud folder, I'll open first the dot cloud folder, I'll open first the dot cloud folder, I'll open first the settings.json file, and here you can see settings.json file, and here you can see settings.json file, and here you can see a couple of hooks. So, we've got a pre a couple of hooks. So, we've got a pre a couple of hooks. So, we've got a pre tool use hook. This runs before the tool use hook. This runs before the tool use hook. This runs before the agent uses a tool. Then, when a user agent uses a tool. Then, when a user agent uses a tool. Then, when a user submits a prompt, and then a hook after submits a prompt, and then a hook after submits a prompt, and then a hook after using a tool to verify the outputs. And using a tool to verify the outputs. And using a tool to verify the outputs. And you can see the Sonar secrets scanning you can see the Sonar secrets scanning you can see the Sonar secrets scanning hook, and the quality analysis hook.

hook, and the quality analysis hook. hook, and the quality analysis hook. There's also a Sonar context There's also a Sonar context There's also a Sonar context augmentation skill, and this is how augmentation skill, and this is how augmentation skill, and this is how we're actually going to kick off the we're actually going to kick off the we're actually going to kick off the agent work, and this gives the agent agent work, and this gives the agent agent work, and this gives the agent instructions on how to actually use instructions on how to actually use instructions on how to actually use Sonar Vortex. Now, Sonar Vortex is Sonar Vortex. Now, Sonar Vortex is Sonar Vortex. Now, Sonar Vortex is available as an add-on. It's actually available as an add-on. It's actually available as an add-on. It's actually part of the Sonar agent essentials, part of the Sonar agent essentials, part of the Sonar agent essentials, which contains Sonar Vortex, but also which contains Sonar Vortex, but also which contains Sonar Vortex, but also the remediation agent, which can run in the remediation agent, which can run in the remediation agent, which can run in the background and fix any issues the background and fix any issues the background and fix any issues automatically. If you're on the automatically. If you're on the automatically. If you're on the enterprise plan on the or on the team enterprise plan on the or on the team enterprise plan on the or on the team annual plan, you should be able to add annual plan, you should be able to add annual plan, you should be able to add this integration. Now, the skill itself this integration. Now, the skill itself this integration. Now, the skill itself is pretty long, and I'm not going to is pretty long, and I'm not going to is pretty long, and I'm not going to review every part of it, but just know review every part of it, but just know review every part of it, but just know that this is going to tell the agent how that this is going to tell the agent how that this is going to tell the agent how to explore the code base, and gain more to explore the code base, and gain more to explore the code base, and gain more context of the work that we are doing, context of the work that we are doing, context of the work that we are doing, as well as how to run analysis using the as well as how to run analysis using the as well as how to run analysis using the agentic analysis feature. And finally, agentic analysis feature. And finally, agentic analysis feature. And finally, let's see how all of this comes together let's see how all of this comes together let's see how all of this comes together to help you work better with agents like to help you work better with agents like to help you work better with agents like Cloud Code. I'll start a new session Cloud Code. I'll start a new session Cloud Code. I'll start a new session with Cloud Code, and I'm going to tell with Cloud Code, and I'm going to tell with Cloud Code, and I'm going to tell it to use the SonarQube MCB server. And it to use the SonarQube MCB server. And it to use the SonarQube MCB server. And now I'm going to give it a sample prompt now I'm going to give it a sample prompt now I'm going to give it a sample prompt to set a webhook signing secret with to set a webhook signing secret with to set a webhook signing secret with some random value. Now, if I try to run some random value. Now, if I try to run some random value. Now, if I try to run this, it should trigger our secret this, it should trigger our secret this, it should trigger our secret scanning hook, which you can see it does scanning hook, which you can see it does scanning hook, which you can see it does on the user prompt submit operation. And on the user prompt submit operation. And on the user prompt submit operation. And it's going to block it because the Sonar it's going to block it because the Sonar it's going to block it because the Sonar analysis is going to flag this as a hook analysis is going to flag this as a hook analysis is going to flag this as a hook and prevent us from accidentally or and prevent us from accidentally or and prevent us from accidentally or intentionally adding it into our code intentionally adding it into our code intentionally adding it into our code base. Now, let's try to do something base. Now, let's try to do something base. Now, let's try to do something more interesting. I'm going to use the

more interesting. I'm going to use the more interesting. I'm going to use the Sonar context augmentation skill. I'm Sonar context augmentation skill. I'm Sonar context augmentation skill. I'm going to first ask it, "What is the going to first ask it, "What is the going to first ask it, "What is the current architecture of the project?" current architecture of the project?" current architecture of the project?" Now, this is going to use the skill and Now, this is going to use the skill and Now, this is going to use the skill and the available commands from the the available commands from the the available commands from the SonarQube CLI to find more context about SonarQube CLI to find more context about SonarQube CLI to find more context about our code base. And this is the result. our code base. And this is the result. our code base. And this is the result. It's going to find our two projects It's going to find our two projects It's going to find our two projects because our solution is fairly simple. because our solution is fairly simple. because our solution is fairly simple. It'll find what depends on what. And It'll find what depends on what. And It'll find what depends on what. And then the next question I want to ask it then the next question I want to ask it then the next question I want to ask it is, "Find everything related to is, "Find everything related to is, "Find everything related to resolving a document path." Now, the resolving a document path." Now, the resolving a document path." Now, the reason I'm doing this is because I want reason I'm doing this is because I want reason I'm doing this is because I want it to be aware of the security it to be aware of the security it to be aware of the security vulnerability that we have inside of our vulnerability that we have inside of our vulnerability that we have inside of our code base. Now, you can see it's using code base. Now, you can see it's using code base. Now, you can see it's using Sonar context navigation to find any Sonar context navigation to find any Sonar context navigation to find any relevant files and classes inside of our relevant files and classes inside of our relevant files and classes inside of our code base. And so the agent is slowly code base. And so the agent is slowly code base. And so the agent is slowly building up context about the project we building up context about the project we building up context about the project we are working on. And this in turn is are working on. And this in turn is are working on. And this in turn is going to make it easier for us to ask it going to make it easier for us to ask it going to make it easier for us to ask it to implement a fix later because it will to implement a fix later because it will to implement a fix later because it will know where to look. And also there's a know where to look. And also there's a know where to look. And also there's a feedback loop in place that's going to feedback loop in place that's going to feedback loop in place that's going to allow it to verify its work. I'll show allow it to verify its work. I'll show allow it to verify its work. I'll show you how this works in a moment. And you you how this works in a moment. And you you how this works in a moment. And you can see that while exploring the code can see that while exploring the code can see that while exploring the code base, it already flags the potential base, it already flags the potential base, it already flags the potential issue that we have. So, I'm going to issue that we have. So, I'm going to issue that we have. So, I'm going to finally ask it to fix the path traversal finally ask it to fix the path traversal finally ask it to fix the path traversal problem inside of the document path problem inside of the document path problem inside of the document path resolver, and I want it to verify the resolver, and I want it to verify the resolver, and I want it to verify the fix using Vortex. So, let's hand off the fix using Vortex. So, let's hand off the fix using Vortex. So, let's hand off the prompt to the agent, and it's going to prompt to the agent, and it's going to prompt to the agent, and it's going to continue iterating using the SonarQube continue iterating using the SonarQube continue iterating using the SonarQube CLI. And you can see as it does the work CLI. And you can see as it does the work CLI. And you can see as it does the work that it's going to ask us if we are that it's going to ask us if we are that it's going to ask us if we are satisfied with the changes, and you can satisfied with the changes, and you can satisfied with the changes, and you can see that our context augmentation skill

see that our context augmentation skill see that our context augmentation skill instructs the agent to pull the code instructs the agent to pull the code instructs the agent to pull the code base guidelines base guidelines base guidelines before making any edits to the actual before making any edits to the actual before making any edits to the actual files. Cloud Code is going to tell me files. Cloud Code is going to tell me files. Cloud Code is going to tell me what are the changes that it wants to what are the changes that it wants to what are the changes that it wants to make inside of the document path make inside of the document path make inside of the document path resolver, and it basically revolves resolver, and it basically revolves resolver, and it basically revolves around solving the issue that we flagged around solving the issue that we flagged around solving the issue that we flagged earlier. So, I'm going to let it earlier. So, I'm going to let it earlier. So, I'm going to let it continue its work. I'll say yes to the continue its work. I'll say yes to the continue its work. I'll say yes to the changes here. Now, the next thing that I changes here. Now, the next thing that I changes here. Now, the next thing that I really like is it's now going to figure really like is it's now going to figure really like is it's now going to figure out that the existing test for this out that the existing test for this out that the existing test for this behavior no longer holds with the new behavior no longer holds with the new behavior no longer holds with the new implementation. So, it's also going to implementation. So, it's also going to implementation. So, it's also going to update the respective tests, and it's update the respective tests, and it's update the respective tests, and it's also going to add more test cases, which also going to add more test cases, which also going to add more test cases, which is what we want. So, I'll also hit yes is what we want. So, I'll also hit yes is what we want. So, I'll also hit yes here, and it's going to build our code here, and it's going to build our code here, and it's going to build our code base and run the tests to make sure that base and run the tests to make sure that base and run the tests to make sure that all the tests are passing. And then this all the tests are passing. And then this all the tests are passing. And then this is the final part of the agent loop that is the final part of the agent loop that is the final part of the agent loop that relies on Sonar Vortex, where it's going relies on Sonar Vortex, where it's going relies on Sonar Vortex, where it's going to run the deep Vortex analysis on all to run the deep Vortex analysis on all to run the deep Vortex analysis on all of the files that it changed inside of of the files that it changed inside of of the files that it changed inside of this session, which are the document this session, which are the document this session, which are the document path resolver and the respective tests path resolver and the respective tests path resolver and the respective tests for this. So, you can see it's running a for this. So, you can see it's running a for this. So, you can see it's running a deep analysis, and I'm going to hit yes deep analysis, and I'm going to hit yes deep analysis, and I'm going to hit yes and allow it to proceed. And remember and allow it to proceed. And remember and allow it to proceed. And remember that earlier running the deep agentic that earlier running the deep agentic that earlier running the deep agentic analysis flagged this same class with a analysis flagged this same class with a analysis flagged this same class with a potential security vulnerability. Now, potential security vulnerability. Now, potential security vulnerability. Now, with the fixes in place, we expect the with the fixes in place, we expect the with the fixes in place, we expect the analysis to not return any issues, and analysis to not return any issues, and analysis to not return any issues, and you can see that it still comes back you can see that it still comes back you can see that it still comes back with two issues, but more on this in a with two issues, but more on this in a with two issues, but more on this in a moment. What you're going to quickly moment. What you're going to quickly moment. What you're going to quickly find is that this actually doesn't have find is that this actually doesn't have find is that this actually doesn't have anything to do with the current problem

anything to do with the current problem anything to do with the current problem that we are working on. And finally, we that we are working on. And finally, we that we are working on. And finally, we get a message that path traversal is get a message that path traversal is get a message that path traversal is fixed and Vortex confirmed that the fixed and Vortex confirmed that the fixed and Vortex confirmed that the particular error from earlier is gone. particular error from earlier is gone. particular error from earlier is gone. Then it's going to outline the fix, and Then it's going to outline the fix, and Then it's going to outline the fix, and I want to flag this part here where it I want to flag this part here where it I want to flag this part here where it deliberately left the other issue that deliberately left the other issue that deliberately left the other issue that we have alone because it simply wasn't we have alone because it simply wasn't we have alone because it simply wasn't part of the problem that we were trying part of the problem that we were trying part of the problem that we were trying to solve. I'm going to exit my Cloud to solve. I'm going to exit my Cloud to solve. I'm going to exit my Cloud Code session, and I want to run another Code session, and I want to run another Code session, and I want to run another Agenti analysis on the two files from Agenti analysis on the two files from Agenti analysis on the two files from earlier. We'll do a deep analysis, and earlier. We'll do a deep analysis, and earlier. We'll do a deep analysis, and you'll see that now, once the fix is in you'll see that now, once the fix is in you'll see that now, once the fix is in place, if I now list out the open issues place, if I now list out the open issues place, if I now list out the open issues inside of our SonarQube project, you can inside of our SonarQube project, you can inside of our SonarQube project, you can see that we are now down to one of the see that we are now down to one of the see that we are now down to one of the two security vulnerabilities that we two security vulnerabilities that we two security vulnerabilities that we started with, and we've successfully started with, and we've successfully started with, and we've successfully used the Vortex-powered agent loop to used the Vortex-powered agent loop to used the Vortex-powered agent loop to solve the path traversal problem with solve the path traversal problem with solve the path traversal problem with our document path resolver. And if you our document path resolver. And if you our document path resolver. And if you want to give this a try and improve your want to give this a try and improve your want to give this a try and improve your agent-driven development, go ahead and agent-driven development, go ahead and agent-driven development, go ahead and check out the pinned comment right below check out the pinned comment right below check out the pinned comment right below this video. I think this nicely this video. I think this nicely this video. I think this nicely demonstrates how we can improve our demonstrates how we can improve our demonstrates how we can improve our existing AI agents and make them more existing AI agents and make them more existing AI agents and make them more powerful by adding the right tools in powerful by adding the right tools in powerful by adding the right tools in the right place. Sonar Vortex is one of the right place. Sonar Vortex is one of the right place. Sonar Vortex is one of those excellent tools, and it adds more those excellent tools, and it adds more those excellent tools, and it adds more context and verification to your agent context and verification to your agent context and verification to your agent workflows. As I said, if you want to workflows. As I said, if you want to workflows. As I said, if you want to give it a try, take a look at the pinned give it a try, take a look at the pinned give it a try, take a look at the pinned comment right below this video. I'll comment right below this video. I'll comment right below this video. I'll also leave some useful resources in the also leave some useful resources in the also leave some useful resources in the description of this video. And if you description of this video. And if you description of this video. And if you want to learn how to get started with want to learn how to get started with want to learn how to get started with the SonarQube and CP server, I think the SonarQube and CP server, I think the SonarQube and CP server, I think you'll enjoy this video next. Consider

you'll enjoy this video next. Consider you'll enjoy this video next. Consider smashing the like button if you like smashing the like button if you like smashing the like button if you like this video. Thanks a lot for watching, this video. Thanks a lot for watching, this video. Thanks a lot for watching, and until next time, stay awesome.