Unfragile

SpotBugs itself is not among the candidate products, so none of the listed tools is a direct match. The closest fits for Java bug and static analysis are SonarQube, which scans for bugs and security issues across 40+ languages 313, and detekt, a static analyzer for Kotlin 2. Joern offers code analysis for C, C++, JVM bytecode and JavaScript 1.

1
SonarQube Cloudsonarsource.comverified and signed
A managed SaaS code analysis platform that reviews source code for bugs, security vulnerabilities and code smells across 40+ languages, with a scan action for CI pipelines 313.
Website Docs Pricing Get started
+19 community tools built for it
for agents: SonarSource/sonarqube-scan-action · sonarqube · SonarSource/sonarqube-quality-gate-action
2
detektdetekt.devwebsite read, tools not yet checked
A static analyzer for Kotlin code that flags anti-patterns and can be extended with custom rules, configured through Gradle or Maven builds 2.
Website Docs
+2 community tools built for it
3
Joernjoern.iowebsite read, tools not yet checked
An interactive code analysis shell for finding attack surface, sloppy coding practices and variants of known vulnerabilities, supporting JVM bytecode via Soot 1.
Website Docs
+6 community tools built for it

Sources

1Joern - The Bug Hunter's Workbenchjoern.io · read 2026-10-29
2Hello from detekt | detektdetekt.dev · read 2026-10-29
3Homepage | SonarQube Cloud | Sonar Documentationdocs.sonarsource.com · read 2026-10-29
13Official SonarQube Scan: declares "SonarSource/sonarqube-scan-action" (the record we read and signed)unfragile.ai · read 2026-10-24

For agents: the 10 actions behind this answer

· Joern website read, tools not yet checked
· detekt website read, tools not yet checked
The official website of detekt - A static analyzer for Kotlin
SonarSource/sonarqube-scan-action · Official SonarQube Scan verified and signed
Scan your code with SonarQube Server and Cloud to detect issues in 30+ languages. (Formerly SonarQube and SonarCloud)
· OpenJDK website read, tools not yet checked
graalvm/setup-graalvm · GitHub Action for GraalVM verified and signed
Set up a specific version of the GraalVM JDK and add the command-line tools to the PATH
mypy · typedload verified and signed
· Cprover website read, tools not yet checked
webdriver · WebDriver Support verified and signed
gradle/actions · Build with Gradle verified and signed
A collection of actions for building Gradle projects, as well as generating a dependency graph via Dependency Submission.
· JBang website read, tools not yet checked

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.