DEV Community: Dragonsoft DevSecOps

A review of the PerfDog evolution: Discussing mobile software QA with the founding developer of PerfDog

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:19:17 +0000

Originally published on the WeTest blog. Reach out to DragonSoft, an authorized WeTest partner, for expert support and a free trial.

Author: Baojian Shen,Senior Product Manager, Tencent WeTest

Awen Cao, Chairman of the MTSC (Make Tester Super Cool) Forum and Senior Testing Technology Director at Tencent, is the founding developer of the performance tool PerfDog. Since 2010, Awen has led the PerfDog team to focus on the game engine domain, providing performance optimization services specifically for Tencent Games. With the rapid development of PC and mobile games, the PerfDog team introduced Bench3D for PC game performance and PerfDog for mobile platforms. PerfDog became available to external users in 2019 and has since provided software performance testing services to hundreds of thousands of businesses worldwide.

The Origin of PerfDog: The Challenge of Platform Fragmentation

PerfDog’s development started due to the explosive popularity of PUBG: Battlegrounds. In 2018, PUBG took the world by storm, significantly boosting global PC hardware sales by 40% that year. The game development team aimed to port this game to mobile platforms, maintaining the same gameplay and PC-like experience, leading to the development of PUBG Mobile. This was the first time the PUBG team attempted to create a next-gen quality game using the UE engine on a mobile platform, presenting a significant challenge.

During the performance testing phase, the team faced cross-platform testing issues between iOS and Android. For iOS, applicable Xcode tools only worked in Mac or debug environments. Given the million-plus lines of code in a UE engine game, compiling in debug mode without errors took at least a day, making the process inefficient. Furthermore, there was a lack of comparative data on competitors’ performance and industry standards.

On Android, its openness led manufacturers to release customized system versions with thousands of testing tools, but no unified tool for consistent analysis. Compatibility and accuracy issues further compounded testing challenges, resulting in frequent retests and misjudgments.

Faced with these challenges, Awen decided to lead the team in creating a solution. Their goal was to develop a simple, highly usable tool capable of supporting all mobile platforms. This marked the inception of PerfDog, which showed promising results in internal Tencent projects. As it was adopted for more projects, feedback from developers, testers, product managers, and designers helped refine PerfDog, leading to its public release in 2019.

Growth of PerfDog: Building a Robust User Ecosystem

From a game operator’s perspective, development teams strive to deliver better game experiences to players. With PUBG Mobile being seen as a potential phenomenon, OEMs paid close attention to its performance on their devices, sending their flagship phones to the game team for performance testing. This collaboration highlighted external demand for performance testing, prompting the PerfDog team to extend their tools to OEMs, enhancing player experiences across devices.

As mobile gaming grew, Awen and his team noticed players and tech YouTubers using PerfDog for performance evaluations. Users preferred PerfDog over traditional benchmarking, which only indicated hardware performance but not necessarily gaming experience quality. PerfDog effectively identified hardware performance issues and bugs, crucial factors affecting gameplay.

Social media and YouTube influenced players’ perceptions of device performance, impacting purchasing decisions, which in turn encouraged OEMs to optimize their hardware to address weaknesses identified by PerfDog. Sometimes, issues stem from inadequate GPU or chip optimization, prompting collaboration between OEMs and chip manufacturers for targeted improvements.

Through these partnerships, led by the shared goal of enhancing gaming performance, PerfDog fostered an ecosystem of continuous improvement, involving game companies, OEMs, and tech influencers.

PerfDog’s Evolution: Expanding Beyond Gaming

Initially designed for gaming, PerfDog’s applicability caught the attention of non-gaming teams, demonstrating its versatility. By opening up to external manufacturers, PerfDog found applications across smartphones, chips, and IoT devices, evolving into a universal testing tool suitable for diverse scenarios.

To ensure reliability and professional performance metrics, Awen’s team continuously validates PerfDog’s accuracy. Collaborations with the National Institute of Metrology helped PerfDog achieve authoritative certification. Legal compliance aided by Tencent’s international legal team further solidified PerfDog’s standing.

Awen recalls, “Initially, PerfDog was to serve the internal PUBG project. Later, it expanded within Tencent, then to domestic manufacturers. Eventually, international partners, including Supercell, Riot, EA, and companies like Samsung and SK, expressed interest, leading to PerfDog’s global launch in late 2019. By 2020, its presence at GDC garnered even more attention.”

PerfDog has evolved from a test tool to integrating cloud services and the PerfDog Service for industrial performance management. It also developed products like PerfSight and CrashSight for user game performance solutions and crash analysis, offering comprehensive and convenient gaming performance monitoring. PerfDog now supports a wide range of devices, from mobile phones to VR, providing end-to-end performance testing for apps, videos, browsers, and networks.

Understanding PerfDog’s Metrics
PerfDog features several intuitive metrics developed from team experience, including unique indicators like Jank, Smooth, and Frame Power (FPower).

Jank At WWDC 18, Apple introduced Frame Pacing, highlighting that a high frame rate doesn’t always equate to a smooth experience. Comparing left (40 FPS) and right (30 FPS) frames, the left shows obvious stutter due to a frame exceeding 100ms, while the right maintains a consistent 33ms/frame.

Though early Android had a reputation for lag, Google’s Project Butter - Jank, part of Android 4.4, introduced quantifiable smoothness metrics. Google Jank Calculation Logic: Considering the visual perception and the interval of v-sync in hardware, if the display does not refresh for a subsequent v-sync, it is considered a jank, meaning the next v-sync did not trigger a new frame refresh.

Awen observed that FPS does not fully encompass the user experience, necessitating the integration of multiple metrics for comprehensive analysis. The initial methods combining FPS and Jank yielded discrepancies with user perception, which led to PerfDog's refined Jank metrics. Following the upgrade, the PerfDog team launched the enhanced PerfDogJank indicator and promoted it to the gaming industry. However, a new challenge soon emerged. By 2019, the majority of mobile devices had refresh rates of 60 fps, while flagship phones released after 2020 already had refresh rates of over 120 fps. The rapid upgrade of hardware has led to an increase in user expectations regarding game performance. Even the slightest lag may now be perceived by users, and the established PerfDogJank standard is no longer sufficient for performance testing. Consequently, in subsequent versions, a new indicator, SmallJank, has been designed to accurately reflect minor stutters during the game and restore the real user experience.

Smooth Index The Smooth Index offers a more precise evaluation of the fluidity of a game or app. As illustrated in the frame rate screenshot below, while the overall frame rate of the image remains relatively stable, there is a notable fluctuation in the time taken for a single frame, as reflected in the FrameTime. This demonstrates that in instances where the frame rate remains unaltered, stuttering persists. Furthermore, the duration and performance outcomes of each lag vary. Consequently, the user's perception differs, despite the number of stutters remaining consistent. The development team required more precise metrics to analyse this phenomenon. To this end, PerfDog has introduced the Smooth indicator.

Frame Power (FPower) During the course of their interactions with numerous PerfDog project teams, the developers conveyed their aspiration for the incorporation of additional scientific and quantitative indicators to assess power consumption performance. This is also the rationale behind the FPower metric (energy consumption per frame) in PerfDog.

Awen commented, From the user perspective, it is important that games and apps run on their device with high frame rates, high image quality, low heat generation and low power consumption. However, this approach to performance scheduling will inevitably result in a fragmented user experience. As the temperature of your phone rises and its energy consumption increases, the processor operates less frequently, which in turn results in lower frame rates and a stuttering, overheating user experience. The PerfDog team conducted further analysis of the time and energy consumption of each frame of the software, which led to the development of FPower.

The frame rate is dependent on waiting and operation, while power consumption is determined by operation and mobilisation. It is only through optimising computing that power consumption can be truly optimised.

In the early stages of development, the team may implement measures such as reducing the frame rate to optimise energy consumption. While these adjustments reduce power consumption, they can negatively impact the user experience. The objective is to achieve power reduction without a noticeable change in frame rate. FPower = Power/Frame Rate is a more accurate metric that has become a key performance indicator for power optimisation in PerfDog.

Q&A Session: We have gathered some questions from users and invited Awen to answer them.

Q: Are there any breakthroughs or plans for PerfDog to access deeper-level metrics?

Awen: Absolutely, we aim to provide users with more comprehensive and in-depth low-level metric information. We are actively collaborating with hardware manufacturers like Qualcomm and Imagination. In the near future, we hope PerfDog will be able to offer users detailed information at the hardware and even driver levels, facilitating better and faster performance issue identification.

Q: In game projects, how do various numerical parameters affect the client, and which performance metrics should a new game focus on optimizing?

Awen: Games are incredibly complex from an app perspective, second only to operating systems. During game testing, looking at just one or a few metrics won’t reveal the true performance standards. We often advise examining a comprehensive range of metrics. Furthermore, differences between game types mean performance metrics can vary widely, so it’s not advisable to arbitrarily set standards for projects. I suggest using industry benchmarks from similar competitors as a reference for optimization. PerfDog already offers this functionality, and I encourage users to explore it.

Q: Can PerfDog use a single account to test multiple devices simultaneously?

Awen: Testing multiple phones with a single account on one computer is already a feature of PerfDog. By launching PerfDog software multiple times on a PC, you can test up to three phones simultaneously. Users might wonder why it’s limited to three devices. Given the extensive performance metrics and UI displayed during testing, testing too many phones simultaneously could lead to incomplete results or system overloads. We recommend testing on a maximum of three devices.

Are you curious about how PerfDog can elevate your game testing experience? Or perhaps you'd like to dive deeper into our other cutting-edge testing strategies? Either way, we'd love to hear from you. Our expert team is here to connect and provide you with the guidance and support you need to ensure your game testing is both efficient and precise.

Furthermore, we cordially invite you to try out Tencent's UDT platform, a cloud-based solution that grants you remote access to devices and seamlessly integrates with your local test devices, thereby broadening your testing horizons. We firmly believe that UDT can bring unmatched convenience and efficiency to your game testing endeavors.

About WeTest

WeTest, with over a decade of experience in quality management, is an integrated quality cloud platform dedicated to establishing global quality standards and enhancing product quality. As a member of the IEEE, approved Global Game Quality Assurance Working Group, it is recognized for its commitment to quality assurance. WeTest has served over 10,000 enterprise clients across 140+ countries.

Focusing on advanced testing tools development, WeTest integrates AI technology to launch professional game testing tools such as PerfDog, CrashSight, and UDT (Next-Gen Multi-Terminal Unified Access Management Automated Testing Platform), aiding over a million developers worldwide in boosting efficiency. Additionally, WeTest offers comprehensive testing service solutions for mobile, PC, and console games, covering compatibility, security, functionality, localization testing and other various services, ensuring product quality for over one thousand game companies globally.

About the Author
Baojian Shen is a Senior Product Manager at Tencent WeTest with over 10 years of experience in software testing and game testing. He leads product planning and solution development for testing platforms and quality engineering initiatives, focusing on automated testing, compatibility testing, performance testing, game testing solutions, and scalable test platform development. Baojian’s work bridges practical testing challenges and product strategy, with emphasis on AI-driven testing, quality engineering, and implementable, evidence-based methodologies. He regularly shares industry insights grounded in real-world projects and measurable outcomes.

For more information, please contact Dragonsoft at +852-5167-9050 or email us at customer@hkdsdtech.com

How to use AI for performance reviews: a step-by-step guide in 2026

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:07:46 +0000

Originally published on the monday blog. For expert guidance and support, reach out to DragonSoft, an authorized monday.com partner.

Performance review season has a way of exposing just how much managers rely on memory. When you’re reviewing 10 or 15 people at once, you’re trying to reconstruct months of projects, goals, feedback, 1:1s, and everyday contributions — often from information scattered across different places. AI can reduce some of the preparation involved by organizing review inputs, summarizing documented feedback, and surfacing patterns for the manager to examine.

An employee review template can standardize the questions, criteria, and evidence managers use across reviews. Employee self-evaluations provide another source of context by giving employees space to document achievements, challenges, and development priorities in their own words.

AI can help managers pull together performance evidence, summarize feedback, identify patterns, and turn raw information into a structured first draft. What it shouldn’t do is decide whether someone performed well. Ratings, promotions, compensation decisions, and the review conversation itself still require human judgment.

That distinction matters. The International Labour Organization (ILO) has highlighted risks associated with using AI in HR functions such as performance management, including biased or incomplete data, poorly defined objectives, and limited transparency.

In this guide, we’ll look at how to use AI for performance reviews, what information produces better results, how to write useful AI performance review prompts, and how monday AI Workspace can connect the process to the work employees actually did.

Key takeaways

AI is best used for drafting and synthesis, not decision-making. Let it organize evidence and create a starting point while managers retain responsibility for the evaluation
Good reviews start with good evidence. Project outcomes, goals, feedback, and check-in notes give AI something concrete to work with
AI doesn’t automatically eliminate bias. Human oversight is still essential, and AI-generated language should be checked for consistency and fairness
Connected work data makes AI more useful. When projects, goals, and feedback already live together, managers spend less time reconstructing performance at review time
People still own the consequential parts. Ratings, promotions, compensation, development conversations, and final decisions remain human responsibilities

What is an AI performance review?

An AI performance review is an employee performance evaluation where artificial intelligence assists with parts of the review process.

In practice, that usually means helping a manager turn a large amount of information into something useful. AI might summarize 360-degree feedback, organize achievements around specific goals, identify recurring themes in check-in notes, improve vague feedback, or draft a first version of the written evaluation.

The important word is assists.

There’s a significant difference between using AI to summarize evidence and using an algorithm to evaluate an employee. The ILO describes the broader use of automated systems to organize, monitor, supervise, and evaluate work as algorithmic management and has highlighted the risks that come with delegating managerial decisions to technology.

For performance reviews, a more useful division of responsibility looks like this:

This approach also reflects NIST’s AI Risk Management Framework, which emphasizes clear human roles, accountability, transparency, and oversight when AI contributes to decisions.

Why use AI for performance reviews?

Writing is only one part of a performance review. A lot of the work happens before anyone writes a sentence.

Managers need to remember what happened, find supporting evidence, read feedback, compare results against goals, and work out which events are actually representative of an employee’s performance across

the review period.

AI can reduce that administrative load.

Instead of manually rereading a year’s worth of project updates, for example, a manager can use AI to summarize the employee’s major deliverables, missed or exceeded goals, recurring feedback themes, and documented development areas. The manager then verifies those findings and decides what matters.

That can also help counter one of the weaknesses of memory-based reviews: recency bias. A project completed last month is naturally easier to remember than something delivered nine months ago. Giving AI structured evidence covering the whole review period can help bring older work back into view.

It’s important not to overstate this benefit, though. AI doesn’t automatically make an evaluation objective. NIST notes that bias can enter AI systems through human assumptions, underlying data, and system design. AI can help managers examine more evidence, but people still need to judge that evidence fairly.

What information should you give AI for a performance review?

The biggest mistake you can make is starting with the prompt. Begin by gathering the evidence that will inform the review, including agreed goals, documented outcomes, project updates, feedback, and relevant performance data.

An AI system asked to “write a great performance review for Sarah” has almost nothing useful to work with. It can produce polished performance-review language, but polished language isn’t the same thing as an accurate evaluation.

A better input combines the employee’s goals and OKRs, project outcomes, manager observations, 1:1 notes, peer or 360-degree feedback, documented recognition, and relevant development goals from the previous review.

Specificity matters here. Reviews are more useful when employees are evaluated against goals that were clearly defined in advance. A consistent goal-setting process gives managers and employees a shared reference point for evaluating progress.

“Improved customer retention” gives AI very little context. “Goal: increase renewal rate from 82% to 86% by Q4. Final result: 87.3%” gives it an outcome it can accurately reference.

Project information should work the same way. Rather than simply recording that someone “led the website project,” capture what they owned, who they worked with, the intended deadline, what happened, and what impact the project had.

The ILO has identified data quality as one of the central limitations organizations need to consider when using AI in HR. In performance reviews, that principle is fairly simple: vague evidence produces vague reviews.

How to use AI for performance reviews in seven steps

1. Gather evidence from the entire review period

Before opening an AI tool, gather the information you would need to defend the review yourself.

Look across goals and OKRs, completed projects, check-in notes, peer feedback, previous development goals, recognition, and any relevant performance documentation. Whenever possible, include dates, outcomes, and measurable results.

The aim isn’t to feed AI everything anyone has ever said about an employee. It’s to create a representative record of their performance across the full period.

2. Decide what AI is allowed to do

Set the boundary before you start.

You might decide AI can summarize feedback, organize achievements, draft sections of the review, suggest coaching questions, and help make language more specific. Final ratings, compensation, promotions, disciplinary decisions, and performance improvement plans stay with people.

This isn’t just good workflow design. The NIST AI Risk Management Framework emphasizes managing AI risks throughout the design, development, deployment, and use of AI systems.

3. Write an evidence-rich prompt

A useful AI performance review prompt explains the task, supplies the evidence, and tells the system what it must not infer.

For example:

Draft the achievements section of an annual performance review for a senior project manager. Use only the evidence provided below. Organize the review around business outcomes, collaboration, and delivery. Include specific examples where available. Do not invent achievements, motivations, or results. Flag anything that cannot be supported by the evidence.

Then provide the relevant information.

This gives AI a much narrower job than “write a performance review,” which makes the output easier to verify.

4. Treat the output as a first draft

AI-generated text can sound authoritative even when it is wrong, so the first draft needs active review.

Check whether every project, result, and claim is accurate. Look for achievements AI has exaggerated, team outcomes attributed to one person, missing context, or conclusions the evidence doesn’t support.

If the draft repeatedly gets something wrong, go back to the source information or prompt rather than simply polishing the sentence.

5. Make every important claim specific

One of AI’s most useful roles is helping managers move away from vague performance language.

“Alex demonstrated strong leadership this year” tells the employee very little.

“Alex led the Q3 website migration across design, engineering, and content, coordinating six contributors and delivering the project two weeks ahead of the revised deadline” explains what the manager actually means by leadership.

Not every sentence needs a metric, but consequential feedback should be grounded in something observable.

6. Check for bias and inconsistent language

AI can help identify inconsistent language, but it cannot certify that a review is unbiased.

Compare reviews across employees. Are similar accomplishments described with similar strength? Is one person described using personality labels while another is evaluated on outcomes? Does one employee receive detailed evidence while another gets vague judgments? Is a recent mistake overshadowing the rest of the year?

The ILO has specifically warned against assuming AI automatically makes HR decisions fairer. Biased inputs, poorly chosen objectives, and opaque systems can all affect the result.

That makes the human review stage essential.

7. Finalize the review and document the process

The manager should ultimately be able to stand behind every sentence in the final review.

Verify the evidence, add context AI couldn’t know, remove unsupported conclusions, make the final performance assessment yourself, and prepare for the employee’s questions.

Your organization should also retain appropriate documentation of the review process in line with its HR, privacy, and AI governance policies. NIST’s AI RMF treats governance and documentation as ongoing parts of responsible AI use rather than a final compliance check.

AI performance review prompt examples

A few reusable prompts make this section much more useful for people arriving from search.

To draft a review:

Using only the evidence provided below, draft an employee performance review covering achievements, areas for development, and progress against goals. Include specific examples where evidence is available. Do not invent results, motivations, or behaviors. Flag anything that isn’t sufficiently supported.

To summarize 360-degree feedback:

Summarize the feedback below into recurring themes. Separate strengths, development opportunities, and contradictory feedback. Indicate how many responses support each theme, and don’t treat a single comment as a pattern.

To improve vague manager feedback:

Rewrite the feedback below so it focuses on specific, observable behavior and outcomes. Preserve the manager’s intended meaning and don’t introduce facts or examples that aren’t provided.

To check reviews for consistency:

Compare these reviews for differences in tone, specificity, evidence, and performance standards. Flag places where similar performance appears to be described differently. Do not change ratings or make performance decisions.

Common mistakes when using AI for performance reviews

Asking AI to write a review without evidence

This is how you end up with an extremely professional paragraph saying essentially nothing.

AI needs something concrete to summarize. Without documented work, goals, and feedback, it is mostly generating plausible performance-review language.

Assuming AI-generated feedback is objective

AI output isn't inherently neutral.

The model, prompt, underlying information, and decisions made by the people using it can all influence the result. NIST’s framework specifically treats fairness, transparency, privacy, validity, and accountability as risks that need to be actively managed.

Putting sensitive employee information into an unapproved AI tool

Performance information can include confidential employee data. Before entering it into any AI system, check what your organization’s policies allow and how the provider handles access, retention, security, and model training.

Letting AI make the final performance decision

There’s a meaningful difference between asking AI to summarize evidence and asking it to decide whether someone deserves a promotion.

AI can make the first task easier. The second requires organizational accountability, context, and human judgment.

How monday AI Workspace supports AI-assisted performance reviews

The challenge with a standalone AI tool is that it doesn’t automatically know what happened at work.

Managers still need to find project information, collect feedback, copy in goals, explain context, and work out where every claim came from. That limits how much time AI can actually save.

monday AI Workspace brings the AI closer to the work itself. Projects, goals, workflows, feedback, and AI capabilities can operate in the same environment, making it easier to build reviews around documented performance rather than memory.

For example, monday Workforms can collect self-evaluations, manager observations, and peer feedback in a consistent format. Automations can handle review reminders and handoffs instead of HR manually chasing every participant.

AI blocks can help summarize written feedback and categorize recurring themes, while managers retain access to the original information for verification. Goals and OKRs can connect review discussions to the objectives employees were actually working toward.

For HR teams managing a review cycle across multiple departments, dashboards also provide a live view of which reviews are started, awaiting input, overdue, or complete. AI performance reviews work best as part of an ongoing performance management process rather than as a replacement for regular conversations between managers and employees.

The result isn’t an automated performance decision. It’s a more connected review process where the evidence, workflow, and AI assistance aren’t scattered across separate systems.

Building a better performance review process with AI

The strongest case for AI in performance reviews isn’t that a machine can write nicer feedback.

It’s that managers have more information to process than they can reliably hold in their heads.

Used well, AI can turn a year of goals, projects, notes, and feedback into a more manageable body of evidence. It can summarize information, structure a draft, highlight patterns, and help managers interrogate vague language.

But the final evaluation still belongs to people.

That’s especially important as AI becomes more deeply embedded in HR and performance management. Both the ILO’s research into AI in the workplace and NIST’s AI governance guidance emphasize the risks of treating automated outputs as inherently objective or removing meaningful human oversight.

With monday AI Workspace, teams can connect AI assistance directly to the projects, goals, feedback, and workflows where performance happens — helping managers spend less time reconstructing the year and more time having a useful conversation about it.

For more information about monday AI Workspace , please contact DragonSoft, an authorized monday.com partner.

Website: www.hkdsdtech.com

Phone: +852-51679050

Email: marketing@hkdsdtech.com

Sonar Launches Sonar Vortex and SonarQube Remediation Agent to Improve Agentic Effectiveness

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:01:19 +0000

AI agents now generate over 40% of committed enterprise code, yet the gap between rapid code generation and robust verification continues to widen. How can organizations harness the power of AI development while effectively governing code compliance and controlling token costs?

Sonar has launched Sonar Vortex and the SonarQube Remediation Agent to directly tackle three critical pain points: agentic code quality, token consumption, and technical debt, making enterprise AI investments more efficient and sustainable.

In this article, DragonSoft, an authorized SonarQube partner in Hong Kong, breaks down the core value of these new offerings and provides actionable implementation support to help you build a trusted and highly efficient AI coding loop.

New offerings improve quality of agentic output, decrease token usage by up to 36%, and autonomously burn down technical debt

AI agents now assist in generating more than 40% of committed enterprise code and the gap between how fast that code gets written and how well it gets verified is growing. Most organizations know they need to govern agentic output. Far fewer have a clear, practical path to doing so. Today, Sonar, a global leader in AI code verification, governance, and efficiency is changing that with the launches of Sonar Vortex and the SonarQube Remediation Agent.

Available today, the new products improve agentic development in three ways:

• Ensure agents write conformant code from the start by injecting your project's standards before generation, and then verifies the agent-written code against your team's quality and security standards while it's being written

• Cut LLM token consumption by up to 36% by delivering precise, governed context in a single call, eliminating the iterative file discovery that drives up cost

• Autonomously burn down technical debt at scale, working asynchronously in the background to generate, verify, and raise ready-to-merge PRs without pulling developers away from new work

“The industry conversation about AI slop, token efficiency, and compounding technical risk has been building for months, if not longer,” said Tariq Shaukat, CEO of Sonar. “What's been missing is a way to address those three issues where they occur: inside the agentic loop. We're delivering AI and development leaders a solution they can trust to make their investments in AI more efficient, effective, and sustainable.”

Compounding agentic productivity

Agents are limited by what they don't know. They fall down when they lack the context of architecture, security and quality standards, approved libraries, an organization's conventions, and so on. Left ungoverned, they produce code that works in isolation but often violates the rules of the system it's entering. And the fixes cost more with every passing sprint. Sonar's new offerings address these challenges on both sides of the agentic development loop: Sonar Vortex improves the effectiveness of agents building new code, while the SonarQube Remediation Agent stops the accumulation of technical debt in the existing codebase.

Sonar Vortex: Improved agentic efficiency

Sonar Vortex is an agent effectiveness solution, built to guide, verify, and improve the quality of code agents produce. It works across models and toolchains, operating on two dimensions: agent development quality and token effectiveness.

Development quality

For development quality, Sonar Vortex guides agents with the context and constraints they need before they write a single line of code. This includes the same organizational standards, quality profiles, and security rules that govern projects throughout CI/CD. It then verifies agent output in real time, inside the inner loop, catching security, reliability, and maintainability issues before any PR exists. This approach ensures code conforms from the first line, not after a review cycle. The result is consistent, explainable findings that hold up across teams, tools, and branches.

Token effectiveness

New Sonar research quantifies the impact of Sonar Vortex on token efficiency. In controlled benchmarks across Java, Python, TypeScript, and C#, run on Claude Opus 4.8, a leading frontier model, Sonar Vortex reduced LLM token consumption by up to 36% on refactoring tasks where code discovery represents the majority of the work. Rather than requiring agents to search iteratively and carry context forward across many files, Sonar Vortex delivers governed context in a single, precise call, resulting in less exploration. As a result, in testing, Sonar saw significantly lower token costs and more predictable spend.

Agents that leverage Sonar Vortex produce better code the first time, with fewer tokens, fewer violations, and less rework. The new offering extends that same standard into the agentic loop, so the code AI writes is held to the same bar as everything else in your codebase, automatically, before it ever reaches CI. As AI development spend grows and scrutiny of what it produces grows with it, Sonar gives engineering and AI leaders the answer to both: better output, lower token costs, and a defensible paper trail. The investment in AI gets more efficient and the risk gets smaller. That's the case every CTO needs to be able to make right now.

SonarQube Remediation Agent: Technical debt management

The SonarQube Remediation Agent is designed specifically for backlog burndown and operates as a background agent. Teams can assign historical issues (vulnerabilities, architectural drift, maintainability debt) from the SonarQube dashboard. The agent then works asynchronously, generating fixes, verifying each one against Sonar's own analysis engine, and raising verified, ready-to-merge PRs.

This approach greatly reduces developer toil or context-switching. Instead, every fix is proven clean before it surfaces. This is a proactive technical debt removal engine that targets the existing codebase at scale, without pulling developers away from shipping new work. Sonar was recently named a Leader in the Gartner® Magic Quadrant™ for Technical Debt Management¹.

Momentum behind the launch

Today's announcement is backed by the strongest financial position in Sonar's history. The company has surpassed $430 million in annual recurring revenue (ARR) with accelerated growth. More than 7 million developers use Sonar—75% of the Fortune 100 rely on it, including 19 of the top 20 banks globally outside China, as well as leading organizations like Nvidia, AstraZeneca, and Mercedes-Benz.

That scale reflects a market that considers verification mandatory. Organizations trust Sonar to analyze more than 750 billion lines of code daily. Teams using Sonar are 44% less likely to experience outages from AI-generated code.

About Sonar

Sonar, a global leader in AI code verification, governance, and efficiency, helps reduce outages, improve security, and lower costs and risks associated with AI and agentic coding. As an independent verification platform, Sonar enables organizations to securely develop at the speed of AI, and with the addition of Gitar's AI-native code review, offers the most comprehensive way to verify code in the agentic era. A Leader in the Gartner® Magic Quadrant™ for Technical Debt Management, Sonar is the foundation for high-performance software engineering—analyzing over 750 billion lines of code daily to ensure applications are secure, reliable, and maintainable. Rooted in the open source community, Sonar is trusted by 7M+ developers globally, including teams at Nvidia, ServiceNow, Booking.com, Goldman Sachs, AstraZeneca, and Ford Motor Company.

DragonSoft Support

As an authorized SonarQube partner, DragonSoft does more than just deliver the latest global product updates. We bring a seasoned team of implementation and service experts to ensure your success. From product selection and license planning, on-premise deployment, and custom quality and security policies, to deep integration with your CI/CD pipelines and AI coding toolchains, we provide localized, full-lifecycle professional support. We empower your team to move fast and stay secure in the AI era.

Act now to master code quality and costs in the AI era.

To learn more about the capabilities of Sonar Vortex and the SonarQube Remediation Agent, schedule a 1-on-1 product demo, or request a trial and customized quote, contact us today:

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

The Pros and Cons of Wildfly for Java Developers and a Guide to Boosting Productivity with Perforce JRebel

Dragonsoft DevSecOps — Thu, 27 Aug 2026 01:55:59 +0000

Java developers constantly seek the right tools to build, test, and deploy applications quickly. Selecting the proper application server plays a major role in how well a team meets its goals.

WildFly stands out as a popular choice for teams that want a fast, lightweight, modular application server.

Read on to learn more about the core features of WildFly, how it compares to JBoss and GlassFish, and how you can speed up your workflow by using WildFly with JRebel.

For expert guidance and support, reach out to DragonSoft, an authorized Perforce partner.

What Is WildFly?

WildFly is a fully featured Java application server that provides the necessary environment to run Java web applications. Red Hat maintains the project, focusing on aggressive memory control and fast startup times. Because it uses JBoss Modules, it provides true application isolation and links only the specific JAR files your application needs.

Who Uses WildFly?

According to the 2025 Java Developer Productivity Report, 14% of respondents said they are using JBoss or WildFly as their application server. While 86% reported using Tomcat, WildFly was in equal company with application servers like Jetty (16%), WebLogic (9%), and WebSphere (8%). Interestingly, 14% of respondents reported they don't use an application server.

Common Use Cases for WildFly

Developers choose WildFly for a variety of reasons. It handles everything from traditional web applications to modern, distributed architectures. Additionally, WildFly has full Jakarta EE support, making it an excellent choice for enterprise Java applications.

Key use cases include:

• Running robust Java applications

• Building microservices that need a small memory footprint

• Scaling applications quickly due to its instant start times and stateless administration console

• Building Jakarta EE enterprise applications

Available Versions of WildFly

The community actively updates WildFly to support the latest Java standards. For instance, the WildFly 40 Beta 1 release offers deep integration with Jakarta EE 11 and Eclipse MicroProfile, giving developers the tools they need to stay current.

Is WildFly Open Source?

Yes, WildFly is completely open source. It is free for both development and production deployments. While it operates as a free community project, it still receives backing from Red Hat. If your team needs robust commercial support for WildFly, consider OpenLogic.

Comparing WildFly vs. JBoss

It's easy to confuse WildFly and JBoss because they share a common history. In 2012, Red Hat rebranded the open source community version of JBoss AS to WildFly.

The name JBoss now typically refers to JBoss Enterprise Application Platform (EAP). While JBoss EAP builds upon the WildFly source code, the two are not identical. The main differentiators are price, speed of updates, and support.

Comparing WildFly vs. GlassFish

GlassFish is another fully featured, open source application server for Java EE. Sun Microsystems originally sponsored it before Oracle acquired the project. Today, the Eclipse Foundation maintains the GlassFish code base.

For most modern development teams, WildFly wins out due to its speed, efficiency, and active community.

Develop Java Applications Faster With JRebel + WildFly

No matter which application server you choose, waiting for applications to redeploy breaks developer flow. Even with fast startup times for WildFly, those disruptions can hamper Java development productivity.

Fortunately, you can eliminate these frustrating delays by pairing WildFly with JRebel to eliminate redeploys, allowing you to see code changes in your application server instantly.

Final Thoughts

Choosing WildFly gives you a fast, modular, and standard-compliant foundation for your Java applications. When you compare it to alternatives like JBoss EAP and GlassFish, WildFly strikes a perfect balance between cutting-edge features and lightweight performance.

To maximize your efficiency, pair WildFly with tools like JRebel that compound that performance. Skip the rebuilds, keep your flow state intact, and deliver better software, faster.

DragonSoft Support

Whether you are evaluating WildFly as your application server or looking to introduce JRebel to break through development bottlenecks, DragonSoft, Perforce authorized partner, provides comprehensive, end-to-end solutions.

We offer official JRebel licensing, along with localized deployment, technical support, and tailored training, ensuring your team can maximize the full potential of the WildFly + JRebel solution.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

4 Key GitHub Copilot Stats That Reveal the True Power of AI Coding!

Dragonsoft DevSecOps — Wed, 19 Aug 2026 06:13:19 +0000

As a globally acclaimed AI coding assistant, GitHub Copilot is fundamentally reshaping developer workflows. It goes far beyond smart code completion, deeply integrating into the entire lifecycle of code review, quality assurance, and security governance.

In this article, DragonSoft, GitHub’s authorized partner, will walk you through the core value and practical adoption strategies of GitHub Copilot, providing valuable insights to help your team evaluate and integrate AI coding assistants.

Accelerate timelines, improve the rigor of code reviews, and expand capacity for strategic initiatives.

Modern enterprises are under constant pressure to deliver software faster, with higher quality, and under increasingly complex governance expectations. As organizations scale, leaders often face a familiar challenge: developers are talented and motivated, but their time is consumed by repetitive tasks, fragmented workflows, and review bottlenecks. GitHub Copilot changes that equation.

GitHub Copilot enhances enterprise efficiency, elevates software quality, and provides strategic support to development teams. By embedding AI-powered assistance directly into workflows, GitHub Copilot accelerates digital transformation, reduces friction, and strengthens competitive advantage.

In this section, we'll review how GitHub Copilot:

• Enhances developers task resolution by 55%

• Increases developers reviews by 67%

• Improves code quality by 85%

• Help developers maintain flow by 88%

Free Developers' Time — 55% Faster Task Resolution
The journey begins where most development teams feel the strain: time. Developers spend a significant portion of their day on routine tasks including, boilerplate code, syntax lookups, and repetitive patterns. GitHub Copilot reduces this friction immediately.

Enterprises need developers focused on highvalue initiatives, not repetitive tasks. GitHub Copilot accelerates common programming work, freeing capacity for innovation.

Developers resolved programming tasks 55% faster with GitHub Copilot.

As developers gain back time, the next problem to solve is how this gained time translates into the collaborative processes that shape software quality. That leads us to the next dimension of GitHub Copilot’s impact: code reviews.

Enterprise-Ready AI — 67% Faster Reviews
Code reviews are essential for governance, security, and quality, and code reviews are also a common bottleneck. GitHub Copilot helps teams move through reviews with greater speed and clarity, reducing cycle times without compromising rigor.

GitHub Copilot is designed with enterprisegrade security, compliance, and governance in mind. Adoption by leaders like Duolingo demonstrates measurable gains in speed and review efficiency.

Duolingo reported a 25% increase in developer speed and 67% faster code reviews.

With time gained and review cycles accelerating, organizations naturally question if this speed comes at the cost of quality. The data shows the opposite. GitHub Copilot enhances confidence and elevates the standard of code being shipped.

GitHub Copilot Chat Improves Code Quality — 85% Confidence
GitHub Copilot Chat acts as a realtime collaborator, helping developers reason through logic, validate assumptions, and refine their solutions. Developers get immediate feedback that improves both the code and their understanding of the code instead of waiting for human reviewers.

Beyond code completion, GitHub Copilot Chat acts as a collaborative reviewer. It boosts developer confidence and accelerates actionable reviews.

85% of developers felt more confident in code quality; reviews completed 15% faster.

Talent Attraction & Retention — 88% Maintain Flow State
Top engineering talent thrives when they can stay in flow, keep focus, maintain creativity, and remain uninterrupted. GitHub Copilot helps developers maintain this state by reducing context switching and minimizing frustration.

Developers stay longer when they feel supported and empowered. They collaborate more effectively and contribute more meaningfully to strategic initiatives. This cultural impact is often one of the most overlooked outcomes of GitHub Copilot adoption.

88% of developers reported maintaining flow state with GitHub Copilot Chat.

Of course, even with strong productivity gains, leaders must ensure that AIgenerated code meets enterprise standards. That’s where validation practices come in.

Check GitHub Copilot's Work
GitHub Copilot is powerful, and like any tool, GitHub Copilot performs best when paired with strong engineering discipline. Enterprises reinforce accuracy and compliance by combining GitHub Copilot with established review processes, automated testing, and security scanning.

GitHub Copilot is powerful, but validation ensures accuracy and compliance. Best practices include:

• Use GitHub Copilot Chat to explain suggestions.

• Review for functionality, security, readability, maintainability.

• Apply automated tests, linting, code scanning, IP scanning.

Leaders will then turn their attention to the next critical area, security and intellectual property protection, when validation is in place.

Security — Public Code Filter & LoC Metrics
Enterprises need assurance that AIgenerated code is safe, compliant, and free from IP risk. GitHub Copilot’s public code filter and lineofcode metrics provide that visibility.

GitHub Copilot suggestions are synthesized, not copied. Administrators can enable filters and track LoC metrics to safeguard IP and compliance.

For deeper insights into GitHub Copilot’s use cases, core features, and real-world implementation, contact DragonSoft, an authorized GitHub partner, for dedicated support.

We provide a comprehensive, end-to-end service for GitHub Copilot, covering everything from initial assessment and solution design to deployment, training, and ongoing maintenance. We ensure your team doesn’t just adopt GitHub Copilot, but leverages it effectively and securely.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

Meet Datadog: A observability and security platform for cloud applications

Dragonsoft DevSecOps — Wed, 19 Aug 2026 06:03:39 +0000

Datadog is the observability and security platform for cloud applications

Datadog is the essential monitoring platform for cloud applications. It brings together data from servers, containers, databases, and third-party services to make your stack entirely observable. These capabilities help DevOps teams avoid downtime, resolve performance issues, and ensure customers are getting the best user experience.

Datadog Platform Core Benefits

See across systems, apps, and services

With turn-key integrations, Datadog seamlessly aggregates metrics and events across the full devops stack.

SaaS and Cloud providers
Automation tools
Monitoring and instrumentation
Source control and bug tracking
Databases and common server components
All listed integrations are supported by Datadog

Get full visibility into modern applications

Monitor, troubleshoot, and optimize application performance.

Trace requests from end to end across distributed systems
Track app performance with auto-generated service overviews
Graph and alert on error rates or latency percentiles (p95, p99, etc.)
Instrument your code using open source tracing libraries

Analyze and explore log data in context

Quickly search, filter, and analyze your logs for troubleshooting and open-ended exploration of your data.

Automatically collect logs from all your services, applications, and platforms
Navigate seamlessly between logs, metrics, and request traces
See log data in context with automated tagging and correlation
Visualize and alert on log data

*Proactively monitor your user experience
*
End-to-end user experience visibility in a single platform.

Monitor critical user journeys captured with an easy-to-use web recorder
Save engineering resources with AI-powered, self-maintaining tests
Detect and alert on performance issues for users in various locations
Manage your SLAs and SLOs

Correlate frontend performance with business impact

Prioritize business and engineering decisions with user experience metrics.

Visualize load times, frontend errors, and resources for every user session
Slice and dice data using custom attributes
Troubleshoot quickly with frontend, backend and business metrics in one view

Unify network visibility across your clouds, applications, and devices

Get complete visibility across all your environments with Datadog Network Monitoring.
Unify your network visibility across multi-cloud, hybrid, and on-premises environments
Correlate across applications, networks, devices, and infrastructure
Remediate issues effectively with intelligent insights and alerting

Build real-time interactive dashboards

More than summary dashboards, Datadog offers all high-resolution metrics and events for manipulation and graphing.

See graphs across sources in real-time
Slice data by host, device, or any other tag
Compute rates, ratios, averages or integrals
Easily customize views, interactively or in code

Share what you saw, write what you did

System events and metrics are only part of the story. Datadog is built to give visibility across teams.

Discuss issues in-context with production data
Snapshot potential issues and notify your team
See who responded to that alert before
Remember what was done to fix it

Get alerted on critical issues

Datadog notifies you of performance problems, whether they affect a single host or a massive cluster.

Receive alerts on any metric, for a single host or for an entire cluster
Get notifications via e-mail, PagerDuty, Slack, and other channels
Build complex alerting logic using multiple trigger conditions
Mute all alerts with 1 click during upgrades and maintenance

Instrument your apps, write new integrations

Datadog includes full API access to bring observability to all your apps and infrastructure.

Capture events and metrics from your own applications using Datadog client libraries
Tag servers or query Datadog in command-line
Generate and upload JSON-formatted dashboards
UseDatadog Restful HTTP API for full data access

About DragonSoft：Your DevSecOps Solutions Expert

As a leading DevSecOps solution provider operating in Greater China, DragonSoft is dedicated to helping enterprises build efficient and secure software delivery pipelines. With extensive technical experience serving high-demand industries such as financial, technology, game development, automotive, and semiconductor design, we offer end-to-end services spanning from version control and project management to full-stack system observability.

As a key Datadog partner in Hong Kong, we go beyond official licensing and local technical support. We specialize in seamlessly integrating Datadog into your existing R&D and operations toolchains, ensuring your technology investment translates into tangible, pragmatic improvements in business performance.

To learn more about Datadog or to apply for a free trial, please contact us:

🌐 Website: www.hkdsdtech.com
📞 Phone: +852-51679050
✉️ Email: marketing@hkdsdtech.com

ITSM案例 | 某全球諮詢公司：從 ServiceNow 到 HaloITSM，實現效率、靈活性與成本節約的全面提升

Dragonsoft DevSecOps — Tue, 11 Aug 2026 05:45:43 +0000

本案例來源HaloITSM。由HaloITSM授權合作夥伴——龍智（DragonSoft）为您带来分享解读，旨在通過這一成功案例，為您展現 HaloITSM 在降本增效、敏捷部署和用戶體驗方面的卓越能力。如需試用HaloITSM，請隨時聯繫龍智團隊。

隨著 inlumi 的業務持續擴展，他們亟需一套能夠跟上發展節奏的 ITSM 解決方案。面對 ServiceNow 日益上漲的成本、複雜的定制化以及不斷下滑的技術支持，inlumi 最終決定轉用 HaloITSM 平臺。

許可成本降低 30%
回應時效提升 20%
一套方案覆蓋 12 個國家/地區

關於 inlumi

inlumi 是一家全球性諮詢公司，總部位於荷蘭烏得勒支，專注於財務報告與企業績效管理。自 2000 年成立以來，inlumi 已從一家小眾諮詢公司發展為遍佈 12 個國家、擁有 250 餘名員工的國際化組織。inlumi 致力於服務大型企業客戶，並不斷尋求最佳技術解決方案來提升其運營水準。

面臨的挑戰

隨著 inlumi 的業務不斷擴張，其對強大的 IT 服務管理（ITSM）平臺的需求也與日俱增。

ServiceNow 作為他們的解決方案已使用多年，但卻限制了他們的發展步伐：inlumi 希望為客戶提供新的集成方案，並開始探索 AI 功能，而這些在 ServiceNow 中要麼實施難度太大，要麼價格極其高昂。此外，他們還面臨以下問題：

• 成本持續攀升：儘管價格不斷上漲，inlumi 卻未能看到相應的價值提升或功能增強。

• 定制化複雜：雖然 ServiceNow 具備 inlumi 所需的功能，但對其進行配置以滿足特定的需求，這點往往既困難又耗時。ServiceNow 的開箱即用功能無法滿足他們的需求，迫使他們不得不額外付費購買附加模組。

• 支持品質下降：隨著時間的推移，inlumi 發現 ServiceNow 的技術支持水準和回應速度都在下滑。

這些問題促使 inlumi 開始評估市面上的其他 ITSM 解決方案，以便更好地契合其不斷發展的需求。

需求

inlumi 進行了全面的市場分析，對多款 ITSM 平臺進行了對比評估，其中包括再次考量 ServiceNow。他們的核心需求包括：

• 解決方案需要開箱即用且功能豐富

• 具備更直觀、更友好的用戶介面

• 具備強大的集成能力，能夠與 CRM 系統、財務系統和註冊系統相容

• 具有高性價比的許可模式，期望新解決方案的許可成本可降低 30%

• 提供可靠且回應及時的技術支持

經過評估，HaloITSM 成為唯一能夠滿足其全部需求的平臺。

"Halo的脫穎而出，不僅僅在於價格優勢，更在於我們雙方的合作方式、他們對產品的定位，還有他們售前團隊與我們通力合作，共同打造出的應用案例，清晰展示了該產品的能力和應用場景。”——Frank Wessels，首席技術官

解決方案

從一開始，inlumi 就對 Halo 的強大功能印象深刻。其遷移體驗的關鍵亮點包括：

• 即時價值與豐富功能：許多在 ServiceNow 中難以或無法實現的功能，在 Halo 中都已經開箱可用。每當 inlumi 詢問特定功能時，得到的回答始終是“沒問題，我們可以做到”。

• 無縫實施：遷移過程順暢直觀，確保了內部團隊和客戶都能夠快速上手。

• 卓越的用戶體驗：Halo 具備簡潔的介面和用戶友好的導航，使客服人員和客戶都能高效地使用系統。一些細節改進，例如可以直接在文本字段中插入截圖（而在 ServiceNow 中需要單獨上傳附件），徹底改變了他們與客戶的交互方式。

• 強大的可定制性，無需複雜編碼：與 ServiceNow 不同，借助Halo，inlumi 團隊無需高級編程技能即可自定義表單和工作流，讓新部門和流程的創建變得和構想一樣簡單。輕鬆創建具有動態可見性的工單類型更是顛覆性的改變——這在過去必須通過編寫腳本來實現。

• 透明且高性價比的許可模式：Halo 的核心套件已包含基本功能和集成，無需再額外購買昂貴的附加許可。

“從一開始，我就被Halo所提供的無限可能深深折服，特別是當我們列出了一份願望清單，上面都是 ServiceNow 做不到或極難實現的功能時。Halo 團隊的回應總是非常乾脆：‘沒問題，我們能做到，而且是這樣做的。’”——Marissa Nijhof，ITSM 專家
成果

向 Halo ITSM的轉型為 inlumi 帶來了顯著收益：

• 效率提升：Halo 的直觀特性使團隊工作效率大幅提高，減少了系統配置和故障排障的時間。

• 溝通與支持改善：Halo 的支持服務品質卓越，回應速度快，技術水準高。

• 面向未來增長的可擴展性：inlumi 擁有清晰的發展路線圖，將 Halo 視為長期的 IT 服務管理合作夥伴，以支持其持續擴張和創新。

• 許可成本降低 30%：這不僅體現在整體許可成本的下降，還得益於併發許可模式，允許多個客服人員通過共用許可訪問系統。

"許多之前從未使用過 ServiceNow 的部門，現在都主動要求使用 Halo。有部門來找我提出特定的表單需求，而我能用拖拽功能自己搞定，這種感覺真的太好了。" ——Marissa Nijhof，ITSM 專家

結論

切換至 Halo ITSM後，inlumi 得到了一個更敏捷、成本更低，且更加易用的解決方案，完美契合自身業務需求。現在，inlumi 能夠靈活高效地調整和擴展其流程，同時享有優質支持和增強功能。Halo 不僅滿足了inlumi 的需求，甚至超出了預期，為他們今後的持續發展奠定了堅實基礎。

系統部署完成後，inlumi 正著手進行優化升級。盡可能實現自動化是他們當前的首要任務——而此前在 ServiceNow 平臺中，如果不額外付費則無法實現這一功能。他們還對 AI 落地充滿期待，計畫從自動解決方案推薦、AI 分流和知識庫增強等方面著手。

隨著組織內其他部門也看到 Halo 帶來的實際收益，inlumi 正計畫將其擴展為全面的企業服務管理（ESM）解決方案。

HaloITSM中國授權合作夥伴——龍智（DragonSoft）

作為 HaloITSM 在中國的官方授權代理商，龍智（DragonSoft）已經通過HaloTISM官方的技術認證，將向中國、香港用戶提供從需求調研、方案定制、系統實施到本地化支持的一站式服務。我們不僅交付國際領先的工具，更提供貼合本土企業需求的最佳實踐，確保您的 ITSM/ESM 轉型順利落地。

如果您也正面臨 ITSM 工具選型、替換或升級的困擾，渴望打造一個統一、智能且高性價比的服務管理平臺，歡迎隨時聯繫龍智，獲取Halo產品諮詢與演示：

官網: www.hkdsdtech.com

電話: +852-51679050

郵箱: marketing@hkdsdtech.com

Java Application Server Selection Guide: WebLogic vs. Tomcat Comparative Analysis (Featuring Perforce JRebel for Enhanced Productivity)

Dragonsoft DevSecOps — Tue, 11 Aug 2026 05:42:50 +0000

Originally published on the Perforce blog. For expert guidance and support, reach out to DragonSoft, an authorized Perforce partner.

When selecting a Java enterprise application architecture, WebLogic and Tomcat represent two fundamentally different technology paths. WebLogic, provided by Oracle, is a full-featured, commercial-grade application server, making it the premier choice for handling large-scale, complex, and highly compliant Jakarta EE mission-critical workloads. In contrast, Tomcat is an open-source, lightweight Servlet container from the Apache Software Foundation. Thanks to its free and agile nature, it has become the gold standard for microservices architectures and Spring Boot applications.

Choosing the wrong server not only causes performance bottlenecks but also leads to exorbitant migration costs and budget-draining licensing fees. Translated and adapted by DragonSoft—a technology service provider deeply specializing in DevOps and engineering productivity—this article delivers an in-depth analysis of the differences between these two mainstream Java servers. We will break down core dimensions such as licensing costs, Jakarta EE specification compliance, and operations and technical support, helping your team make the most cost-effective infrastructure decision.
Furthermore, whether your team ultimately opts for the robust WebLogic or the agile Tomcat, frequent code builds and server restarts will inevitably consume valuable development time. Therefore, this article will also reveal how to leverage enterprise-grade instant hot reload technologies like Perforce JRebel to eliminate application server deployment wait times. This ensures that while you establish a solid architectural foundation, you are also maximizing the delivery efficiency of your Java team.

So, in real-world technology stack selection, what are the essential differences between these two widely deployed Java servers? Let's first dive into WebLogic and its enterprise-grade positioning.

WebLogic: Commercial Support & Full Feature Set

Oracle WebLogic Server is a full-featured Java application server that supports the complete Java EE (now Jakarta EE) specification. This includes enterprise features such as Enterprise JavaBeans (EJB), Java Messaging Service (JMS), Java Transaction API (JTA), Java Connector Architecture (JCA), and more. For organizations running complex, multi-tier enterprise applications, these capabilities are essential.

WebLogic is designed with large-scale deployments in mind. Its architecture supports clustering, load balancing, high availability, and failover—capabilities that matter when downtime is not an option.

Financial institutions, healthcare organizations, and government agencies frequently choose WebLogic precisely because of this reliability at scale.
As a commercial product, WebLogic comes with paid Oracle support, regular security patches, and long-term maintenance guarantees. Organizations operating in regulated industries or under strict SLAs often find this level of vendor-backed support non-negotiable.

Tomcat: Open Source & Lightweight

Apache Tomcat is an open-source web server and Servlet container for Java code. It's a production-ready Java development tool used to implement many types of Jakarta EE (formerly known as Java EE) specifications.

Tomcat is designed to be fast, lightweight, and easy to deploy. Because it implements only a subset of the Jakarta EE specification, it is often chosen by teams that need to serve Java web applications quickly, without the overhead of a full application server.

The open-source nature of Tomcat also makes it highly accessible. There are no licensing fees, a vast community of contributors maintaining its codebase, and an extensive library of documentation and third-party integrations exists.

Key Similarities Between WebLogic and Tomcat

Core Java Functionality
Both WebLogic and Tomcat are built to run Java-based web applications. Both implement the Jakarta Servlet specification, meaning Java servlets and JSPs will run on either platform. Both support HTTPS, session management, and standard Java web application packaging.

Key Differences Between WebLogic and Tomcat

Licensing
Tomcat is free and open-source, distributed under the Apache License 2.0. There are no per-core, per-processor, or per-user licensing fees. Organizations of any size can deploy Tomcat at scale without licensing overhead.

WebLogic is a commercial product licensed by Oracle. Licensing costs vary based on deployment model, number of processors, and the specific edition (Standard, Enterprise, or Suite). For large deployments, WebLogic licensing represents a significant investment to be weighed against the value of its enterprise features.

Jakarta EE Compatibility
Tomcat implements the Jakarta Servlet, JSP, and Expression Language specifications. It does not natively support the full Jakarta EE suite, which means features such as EJB, JMS, JTA, and JCA are not available out of the box.

WebLogic provides certified compliance with the full Jakarta EE specification. All enterprise Java APIs are available natively, eliminating the need for third-party integrations for core enterprise services.

Support
Tomcat relies on community support, and while this community is large and active, there is no formal SLA-backed support directly from Apache.

WebLogic comes with Oracle's commercial support infrastructure, including access to My Oracle Support (MOS), critical patch updates, and long-term product maintenance. For enterprises with strict uptime requirements or regulatory obligations, this structured support model carries significant value.

When Should I Use WebLogic?

WebLogic is the right choice when your application environment demands enterprise-grade features, compliance, and long-term vendor support.

Choose WebLogic if:
• Your application relies on full Jakarta EE services without the overhead of integrating multiple third-party libraries.
• You are operating in a regulated industry where vendor-backed support and guaranteed patch schedules are required.
• You need a proven, certified platform for mission-critical systems where application server stability is non-negotiable.

WebLogic's operational complexity and licensing cost make it a serious commitment, but for enterprises where full functionality and support come first, that investment is consistently justified.

When Should I Use Tomcat?

Tomcat is the right choice when simplicity, speed, and cost-efficiency are priorities—and when your application does not require the full Jakarta EE feature set.

Choose Tomcat if:
• Budget constraints make commercial licensing impractical, and community support is sufficient for your operational needs.
• You need to deploy quickly, with a lightweight footprint and minimal server configuration overhead.
• Running in containers/cloud
• Using Spring Boot

Tomcat's strength is its simplicity. When your application architecture is well defined and does not require the full Jakarta EE functionality, Tomcat is a fast, reliable, and cost-effective choice.

Final Thoughts

WebLogic offers more robust features, commercial-grade support, and enterprise-scale reliability. Tomcat offers a lean, open-source foundation for teams that value speed, flexibility, and cost efficiency.

The decision comes down to what your application actually requires. If you are running complex, distributed enterprise applications with regulatory constraints and strict uptime SLAs, WebLogic's depth and Oracle support justify the investment. If you are deploying web applications or microservices with a modern framework like Spring, Tomcat's simplicity and zero licensing cost are compelling.

Before committing to either platform, map your application's dependencies against the feature sets described here. A thorough requirements analysis will consistently surface the right choice and protect your organization from the cost of migrating later.

Whether you choose to move forward with WebLogic, Tomcat, or another application server, JRebel integrates seamlessly with leading Java IDEs, frameworks, and technologies. Eliminate redeploys and get instant feedback on your code changes.

About Perforce JRebel
Accelerate Java Development with Instant Code Reloading

Perforce JRebel is a JVM plugin that accelerates Java application development by eliminating time-consuming build and redeployment cycles.
With Perforce JRebel, you simply write your code and refresh your browser. It is compatible with all Java applications, spanning desktop, web, microservices, and enterprise environments. Whether deployed on a local server, a remote server, or in the cloud, JRebel effortlessly reloads your changes.

Eliminate time-consuming build and redeployment cycles in Java development.
Visualize the impact of code changes in real time.
Minimize developer downtime and unbudgeted labor costs.
Preserve application state seamlessly across reloads.

DragonSoft Insights & Support

Choosing between WebLogic and Tomcat is fundamentally about finding the optimal balance between enterprise-grade robustness and lightweight flexibility. Whichever application server you select, the key lies in seamlessly integrating it into your technology stack and maximizing engineering productivity through an efficient development toolchain.
As an authorized Perforce partner, DragonSoft provides genuine licensing and expert technical support for JRebel. We ensure rapid integration and accelerated Java application development for your team.

Contact the DragonSoft team today to claim your 14-day free trial of Perforce JRebel or to discuss your Java development optimization needs:

🌐 Website: www.hkdsdtech.com
📞 Phone: +852-51679050
✉️ Email: marketing@hkdsdtech.com

Introducing Cursor in Jira: Enabling AI Agents to Execute Engineering Tasks Directly

Dragonsoft DevSecOps — Tue, 11 Aug 2026 05:36:44 +0000

Originally published on the Atlassian blog. Curated by DragonSoft, an Atlassian Platinum Partner.

As AI fundamentally reshapes the software development lifecycle, a critical question emerges for engineering leaders: How do we seamlessly integrate AI agents into the team's operational context, rather than letting them remain as siloed coding assistants?

Atlassian’s newly launched Cursor in Jira integration directly answers this challenge. It transforms Jira into the central orchestration hub for human-AI collaboration, bridging the gap between rich work context and actual code execution to forge a single, cohesive workflow.

As an Atlassian Platinum Partner, DragonSoft brings you this expert breakdown. We aim to help you quickly unlock the core value and practical use cases of this new integration, providing a strategic roadmap for your organization's transition to AI-native development.

Starting today, Jira teams can assign work directly to Cursor, where a cloud agent will pick it up and begin working.

You can steer agents directly from Jira, your IDE, or Cursor on the web. When Cursor needs input or is ready for review, it will notify you in Jira. When it opens a pull request, it will be automatically linked back to Jira.

Based on a multi-year DX study of AI usage and engineering throughput, we've seen developer velocity failing to keep pace with model capability because agents lack context. The respondents cite things like context switching, planning, alignment, bug triage, and review as primary friction points outside of their IDE.

Now, Atlassian is enabling AI-native workflows right from Jira for any engineering team using Cursor.

"The question we're asking isn't how do we get engineers to use more AI. It's how do we build a system where humans and agents are working from the same context, toward the same goals. Assigning work directly to Cursor from Jira, with all that rich context, is a meaningful step towards being able to orchestrate agents effectively at scale." ——Jason Andrews，Vice President – Engineering Operations, Cisco

Intent to action with Cursor in Jira:

Trigger agents directly from Jira: Assign a work item to @cursor or mention @cursor in a comment to start a new agent session for the task at hand.

Automate workflows: Create rules that automatically assign certain tasks to Cursor, helping you tackle repetitive work and improve code quality.

Enable the whole team to make changes: Any team member can use Cursor to start tasks and open a pull request, without needing to set up a local dev environment.

Work with rich context: Use Rovo to enrich your task with context from across Atlassian's Teamwork Graph, then assign to Cursor so it has more context with less manual effort.

Enable spec-driven development flows: Automatically sync agent-readable specs with collaboration documents in Confluence, and work items, plans, and goals

"We're seeing teams ship the fastest when they give their agents as much context as possible. Jira is where work is defined, and engineers build in Cursor. Now that context can easily be shared, with Jira as the orchestration layer connecting all of it." —— Tamar Yehoshua，Chief Product and AI Officer, Atlassian

All context. No switch. Update Jira directly from Cursor.

Atlassian holds the full context of work: issues, linked specs, dependencies, decisions, and the teams working on all of it.

Now, local agents can access that context directly within the terminal, browser, or app with Atlassian's Teamwork Graph CLI or the Rovo MCP.

With a simple command, engineers in Cursor can update work items, tag teammates for review, surface Confluence specs and decisions attached to their work, check release status and dependencies, and more. The Teamwork Graph from Atlassian provides a live, intelligent map of your organization's people, work, and knowledge. It gives coding agents the precise context they need to deliver more accurate results with fewer tokens. In our internal testing, agents that leverage Teamwork Graph context achieved a 44% improvement in answer quality and used 48% fewer tokens.

"With Atlassian's Teamwork Graph CLI, developers have full project context—issues, dependencies, Confluence pages—right inside Cursor. With Cursor in Jira, anyone on the team can go from a ticket to a merge-ready PR without switching tools. This partnership connects your planning tools with your coding agents so they share the same context. Our shared customers tell us it's fundamentally changing the first hour of every task and allowing them to ship faster."—— Tido Carriero，Head of Engineering, Product, & Design, Cursor

Teams can keep Jira work items and Confluence documentation up to date directly from Cursor. This turns single-player AI software development into a multiplayer workflow grounded in the same system of record. No context switching required.

Availability

Cursor in Jira is now available with every paid Jira subscription.

To learn more, reach out to DragonSoft, an Atlassian Platinum Partner.

DragonSoft Insights & Support

Atlassian's launch of Cursor in Jira marks a paradigm shift in R&D collaboration: moving from "human-driven tooling" to "context-driven AI agents." When Jira serves as the orchestration layer, the AI Agent is no longer just a siloed coding assistant, but a collaborative partner seamlessly integrated into the end-to-end workflow.

As an officially authorized Atlassian partner, DragonSoft provides genuine licensing, deployment, implementation, and technical support for the full suite of Atlassian products, including Jira, Confluence, Jira Service Management, and Rovo. Furthermore, we offer expert consulting and tailored solutions for requirements analysis, solution customization, and Agent integration, empowering your team to smoothly transition to AI-native development.

Contact DragonSoft today to get installation and usage support for Cursor in Jira, or to explore comprehensive Atlassian solutions for your enterprise.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

Automating Build Chains: A Practical Guide to Integrating AI Agents with TeamCity

Dragonsoft DevSecOps — Mon, 03 Aug 2026 12:25:30 +0000

Originally published on JetBrains.com by Sergei Ugdyzhekov. For expert guidance and support, please contact DragonSoft, an authorized JetBrains partner.

As AI Agents evolve from merely proposing solutions to executing closed-loop workflows, the CI/CD configuration paradigm is undergoing a fundamental shift. The feedback loop—once reliant on developers' repetitive manual debugging—is now being autonomously driven by agents.

This article demonstrates the end-to-end synergy between AI Agents and TeamCity: from reading documentation and proposing solutions, to invoking REST APIs to configure build chains, observing outcomes, and iteratively refining the setup. Explore a new approach to CI/CD automation.

TL;DR: At some point, we crossed an interesting threshold. AI agents can now set up TeamCity build configurations and even full build chains, add build features, and configure parameters.

This works because TeamCity documentation is structured and accessible through MCP via Context7, and because agents can rely on tools like the TeamCity CLI and the skill.teamcity-cli

I ran a couple of experiments recently to see how far this can go in practice.

1 In search of a solution

First, I asked ChatGPT to come up with a solution for a customer request.

ChatGPT read TeamCity documentation via Context7 and proposed a setup that included:

• multiple build configurations

• two aggregate builds

• two build chains combining them

• triggers based on file extensions

• artifact and snapshot dependencies

So far, this is what you would expect from a capable LLM: a reasonably solid design.

Then I passed this solution to Codex and asked it to actually set everything up in TeamCity Nightly, in my personal sandbox project.

Five minutes later, I had a working demo.

There were some mistakes, but they were fixed in a few more minutes. Codex used the TeamCity REST API and executed the setup step by step via teamcity api commands, effectively reproducing the entire configuration from the original description.

The interesting part here is not that the configuration was correct on the first try. It was not.

The interesting part is how quickly the agent could:

• apply the configuration

• observe what did not work

• adjust and retry

What matters here is that the gap between describing a pipeline and actually having it running is now very small. The agent does not stop at producing a plan. It executes it and iterates until the result is usable.

At this point, the agent is not just describing a solution. It is implementing and refining it.

2 Go project

In the second experiment, I cloned a small personal Go project from GitHub and asked Codex to set up CI for it in TeamCity.

It created a simple pipeline with “Tests” and “Build” configurations.

One funny detail: it managed to reuse my GitHub PAT from the gh utility to create the VCS root. “Stole” is not exactly the right word here, but it definitely felt funny.

The success condition was simple: the build should be green.

It was not.

After a few attempts, the agent figured out that Go was missing in the build agent environment. It then modified the build steps to work around this and retried until the build passed.

In other words, the agent is not just configuring TeamCity. It is working towards a goal and adapting its actions based on what happens during the build.

After reviewing the result, I noticed that Go tests were not reported properly in TeamCity.I pointed this out.

The agent updated the configuration, added the required build feature, and on the next run the test results were reported correctly.

What these experiments show

In both cases, the agent followed a similar pattern:

• read documentation

• propose a solution

• apply it through the API

• observe the result

• iterate until the goal is reached

This loop is the main difference compared to earlier experiments with LLMs.

Instead of stopping at “here is how you could configure it”, the agent continues until the system actually works. This turns CI configuration into an iterative process that can converge on its own, instead of stopping at a static definition written upfront.

Conclusion

TeamCity works with AI agents, and AI agents can meaningfully help configure it. But the more interesting finding is how they go about it.

In both experiments the same pattern emerged: the agent didn’t stop at producing a configuration. It applied it, watched what happened, and kept adjusting until the pipeline ran. That feedback loop, which normally requires a developer to run the pipeline, read the output, fix something, and run it again, was happening inside the system on its own.

That said, these are early results. Agents need clear goals, good documentation, and a controlled environment to operate in. Setup tasks that used to take several manual iterations can now converge faster, with the agent handling much of the cycle.

DragonSoft Insights & Support

The fusion of AI Agents and TeamCity unlocks the true potential of modern development automation. But turning cutting-edge technology into real business value requires more than just software—it demands expert toolchain guidance and reliable, localized support.

As an Authorized JetBrains Partner, DragonSoft delivers comprehensive TeamCity solutions. From flexible licensing and strategic planning to seamless implementation, team training, and 24/7 technical support, we’ve got you covered. We don’t just hand over a tool; we embed TeamCity seamlessly into your existing tech stack and engineering workflows, empowering your team to make the leap from manual configuration to intelligent, automated operations.

Whether you're evaluating TeamCity for the first time or looking to optimize your current CI/CD pipelines, we provide end-to-end guidance—from initial assessment to successful, scalable deployment.

Ready to elevate your engineering productivity? Contact us today for a customized trial and consultation:

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

How to Accelerate Java Development by Using Perforce JRebel in Cursor

Dragonsoft DevSecOps — Mon, 03 Aug 2026 12:19:46 +0000

This guide walks you through leveraging Perforce JRebel directly in Cursor to supercharge your Java development. Ready to equip your team with JRebel? Contact DragonSoft, an authorized Perforce partner, for expert guidance and licensing support.

Generative AI is changing the way we work — and Java developers are not immune to that upheaval. AI-native IDEs like Cursor automate repetitive tasks, detect bugs and code errors, and speed up the development workflow.

However, writing code faster is only half the battle for more efficient Java development. Experienced and novice Java developers alike still face frustrating delays when waiting for builds and redeploys, which slow down their iteration speed.

JRebel solves this problem by eliminating redeploys entirely while maintaining application state. When you combine JRebel with Cursor, you accelerate your Java workflow from code generation to final testing, saving time and enabling innovation.

What Is Cursor?

Cursor is an AI-native IDE built on a VS Code fork. It embeds artificial intelligence directly into the development workflow. Instead of acting as a simple chat assistant, Cursor operates as an active collaborator that plans architecture, writes full functions, and refactors large blocks of code.

Is Cursor Good for Java Development?

Yes. Cursor has made a significant investment to improve Java support in the past year, including speeding up the Java Language Server Protocol (LSP) and contributing to the open-source VS Code ecosystem. According to Cursor, these updates deliver project imports that are 10% faster and reduce debugger scans from 5+ seconds to mere milliseconds in large codebases.

What's the Difference Between Cursor and Traditional IDEs?
IntelliJ IDEA is a traditional IDE that relies on plugins to add AI features. The developer prompts the AI, and the AI provides suggestions. As of March 2026, Cursor is also available in all JetBrains IDEs, including IntelliJ IDEA, through the Agent-Client Protocol (ACP). The ACP is not a plugin; it is an open source protocol that defines how Cursor and IntelliJ communicate with each other.

Cursor is an AI-native IDE. It operates autonomously to complete entire engineering tasks, including code completion, refactoring, error detection, and more. Cursor securely indexes your entire repository, navigates files, and runs commands directly in the terminal.

Can I Use Cursor in IntelliJ?

Yes. Developers who rely on JetBrains IDEs can now access Cursor through the Agent Client Protocol (ACP). This integration allows you to run Cursor agents directly inside IntelliJ IDEA, PyCharm, and WebStorm. You get the powerful AI assistance of Cursor while keeping the robust Java support of IntelliJ.

For many Java developers, this integration represents the best of both worlds. They can leverage the AI functions of Cursor and the robust Java support of IntelliJ IDEA, all without having to manually copy and paste code from Cursor to IntelliJ IDEA.

How Java Developers Are Using Cursor

Java developers apply Cursor to automate routine tasks and redirect their energy toward complex problem-solving.

Intelligent code completion: Cursor predicts your next lines of code based on class structures, method signatures, and surrounding logic. This reduces keystrokes and helps you build features faster.
Refactoring: The AI agent analyzes your codebase for inefficiencies and suggests improvements. This keeps technical debt low and maintains a secure code structure.
Error detection: Cursor identifies complex bugs, concurrency issues, and logic errors that traditional static code analyzers often miss.
Autonomous agents: You can instruct the Cursor agent to add a new feature, and the agent will plan the steps, write the code across multiple files, and verify the results.

How to Install & Use JRebel in Cursor

Cursor is a fork of VS Code, so it supports extensions from the Open VSX registry. You can install the JRebel plugin in Cursor, Windsurf, Kiro, or any other VS Code fork using the exact same process.

Installing JRebel With the Open VSX Registry Extension

The simplest way to install the JRebel plugin in Cursor is through the Open VSX Registry. Follow the instructions in this video to get started or read them here.

Final Thoughts

The combination of JRebel and Cursor offers a unique advantage for Java developers seeking efficiency and innovation. By integrating the time-saving capabilities of JRebel with the intelligent automation of Cursor, you can drastically streamline your workflow from code creation to deployment.

DragonSoft Insights & Support

The integration of JRebel and Cursor is far more than just "hot reload + AI coding." It fundamentally redefines the developer inner loop for Java: AI helps you code faster, while JRebel lets you verify those changes instantly.

In an era where Developer Experience is a true competitive advantage, every second saved from build waits translates directly into measurable productivity gains for your team.

How to Get Started with JRebel?
As an Authorized Perforce Partner, DragonSoft provides comprehensive JRebel solutions, including flexible licensing, technical enablement, and best-practice consulting.

We don't just deliver software; we seamlessly embed JRebel into your existing tech stack and engineering workflows, empowering your team to achieve measurable leaps in development productivity.

Contact the DragonSoft team today to claim your 14-day free JRebel trial, or to request a customized enterprise licensing and deployment plan.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

Deep Dive: SonarQube Plugin for Cursor – How It Works, Setup, and Enterprise Implementation Support

Dragonsoft DevSecOps — Mon, 03 Aug 2026 12:15:45 +0000

In today's landscape of ubiquitous AI coding tools, generating code quickly is no longer the challenge. The real pain point for engineering teams is generating code they can trust. As AI agents like Cursor routinely generate hundreds of lines of code at a time, deferring quality and security validation until the CI pipeline or pull request (PR) review stage exponentially increases both risk and rework costs.

To address this, SonarSource has officially launched a SonarQube plugin for Cursor, shifting deterministic code quality gates and security scanning directly into the AI coding session. As an authorized SonarQube partner, DragonSoft is here to provide an exclusive, first-look breakdown of this new plugin. We are committed to helping your engineering teams harness the full potential of AI while rigorously safeguarding your code quality and security baselines.

TL;DR overview

The SonarQube plugin for Cursor connects Cursor to a SonarQube instance via MCP Server to deliver deterministic, in-chat code quality and security verification.

This extension installs specific sonar-* skills to query quality gate status, assess dependency risks, check code coverage, and scan 450+ secret types before code generation.

Driven by the SonarQube CLI runtime, it executes Agentic Analysis to automatically analyze, surface inline findings, and apply rule-driven fixes on every file the agent touches.

The plugin enables the verify step of the Agent-Centric Development Cycle (AC/DC), resolving code quality issues immediately within the active session rather than delaying until CI/PR reviews.

What is the SonarQube plugin for Cursor?

If you're already using Cursor to write code, you've probably felt the gap between how fast the agent generates and how long it takes to find out whether the output holds up. CI catches things. PR review catches more. But neither happens in the same session that writes your code.

The SonarQube plugin for Cursor closes that gap. It connects Cursor to your SonarQube instance through the SonarQube MCP Server and installs a set of sonar-* skills into your project. From there, Cursor can query quality gate status, list open issues, check code coverage and duplication, and assess dependency risks without you ever leaving the chat. The same quality profiles and gates your organization already has in place govern every result.

One thing worth knowing if you're also using the SonarQube for IDE extension inside Cursor: the two are complementary. The extension drives real-time editor feedback through Connected Mode; this plugin drives the in-chat agent loop. They don't overlap — they stack.

How does the SonarQube plugin for Cursor work?

Setup runs through a single sonar-integrate skill after installing the plugin from the Cursor marketplace. That skill runs the sonar integrate cursor command which prompts for and wires authentication, the MCP server, hooks, an Agentic Analysis rule, and a Context Augmentation skill into the .agent/skills/ directory. It's idempotent, so re-running it reports what's already in place rather than overwriting things. Alternatively, with the SonarQube CLI already installed, all it takes is a single sonar integrate cursor command to get everything up and running.

Under the hood, the SonarQube CLI is the runtime everything depends on.

Secrets scanning on every prompt and file read. A beforeSubmitPrompt hook scans every prompt before it reaches the model. If a recognized credential pattern is detected—the plugin covers 450+ secret types—the prompt is blocked outright and never sent. A preToolUse hook and a beforeReadFile hook run the same scanner in front of file reads. When either fires a denial, the plugin also appends the file path to .cursorignore, which is what actually prevents Cursor from reaching the file on subsequent attempts.

Context Augmentation before generation. Sonar Context Augmentation delivers your coding guidelines, architectural intent, third-party dependency health, and semantic navigation to Cursor at prompt time. The agent picks this up on the first prompt of a session and carries it forward, so code generation is informed by SonarQube's view of your project from the start. (Context Augmentation is currently only available on SonarQube Cloud).

Agentic Analysis on every file the agent touches. A Cursor rule installed by sonar integrate tells the agent to run sonar analyze agentic on each file it creates or edits before ending the turn. Findings surface inline. Where a rule-driven fix is available, the agent applies it and re-runs analysis to confirm the issue is resolved before handing control back. The turn doesn't close until each remaining finding is either fixed or explicitly left open with a reason.

The result is the same closed loop the plugin delivers in other agent environments: guide with context, verify every edit, fix before the session ends.

Why should I verify code quality inside Cursor during the session?

AI models are probabilistic. The same prompt can produce different output on different days, and the same model can produce subtly different results across a long session. That makes deterministic, independent code verification essential — SonarQube produces the same result for the same code every time, giving you an auditable standard that agent self-review can't replicate.

This is the Verify step of Sonar's Agent-Centric Development Cycle (AC/DC) in practice: guide the agent with context and constraints, verify output deterministically, and solve issues in the same session. Catching a problem at the point of generation is faster and less disruptive than catching it in CI or during a PR review — and small errors compound. When an agent writes hundreds of lines before verification runs, a missed issue early can propagate through the rest of the output.

How do I set up the SonarQube plugin in Cursor?

Install the SonarQube plugin from the Cursor marketplace, open your project in a new Cursor Agent session, and run sonar-integrate in the chat. The skill walks you through authentication, scopes the integration to your project, and writes the MCP registration, hooks, rule, and Context Augmentation skill into place. Once that's done, open Settings → Tools & MCPs and toggle sonarqube on — Cursor doesn't enable MCP servers automatically after setup.

The full walkthrough, including step-by-step screenshots and a worked example using a real open source project, is in the Cursor plugin blueprint.

Accelerate with Cursor. Build trust with SonarQube. In this new era of agent-centric development, seamlessly embedding SonarQube’s deterministic validation into your AI workflow is no longer optional—it is the definitive path to efficient, secure, and compliant software delivery.

As an authorized SonarQube partner, DragonSoft is dedicated to delivering comprehensive, full-lifecycle code quality management solutions for your enterprise. Partner with us to gain:

Expert Implementation & Integration Support: We provide seamless on-premise or cloud deployment of any SonarQube edition, alongside robust integration with your existing CI/CD pipelines and AI coding tools (like Cursor).
Targeted Training & Enablement: We deliver customized training for your Engineering, Security, and DevOps teams, ensuring code quality best practices are rapidly adopted across your organization.
Dedicated Technical Support: Enjoy localized, high-priority technical assurance with rapid response times to resolve any SonarQube operational challenges your team may face.

Website: www.hkdsdtech.com

Phone: +852-51679050

Email: marketing@hkdsdtech.com