The Good Tech Companies - Bring Your Own Hook: a 5-line PostToolUse Template Calling Sonar Analyze Agentic

Episode Date: August 21, 2026

This story was originally published on HackerNoon at: https://hackernoon.com/bring-your-own-hook-a-5-line-posttooluse-template-calling-sonar-analyze-agentic. Build a five-line Claude Code hook that runs SonarQube Vortex Agentic Analysis after every edit and feeds CI-grade findings back to Claude. Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #large-language-models, #career, #cloud-computing, #cybersecurity, #databases, #developer-tools, #claude-code-hooks, #good-company, and more. This story was written by: @sonarsource. Learn more about this writer by checking @sonarsource's about page, and for more stories, please visit hackernoon.com. Build a five-line Claude Code hook that runs SonarQube Vortex Agentic Analysis after every edit and feeds CI-grade findings back to Claude.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. Bring your own hook. A five-line post tool use template calling Sonar analyze agentic by Sonar. We'll set up an agentic analysis, one of the vortex's capability, hook for you. That is the right call for most people, but sometimes you want to own the hook yourself, to scope it to a subset of files, to decide exactly when it blocks, to check it into a repo your teammates share, or just to understand what is running before you trusted. This post is the smallest hook that does the job, five lines, one command, and your agent

starts getting C-grade feedback on every edit. One naming note up front. The CLI subcommand is, is an alias, and there is no subcommand, the installed hook is just named. As of CLA-0-14, X has, and when in doubt, what do you need before setting up a Claude Code? SonarCube hook. Sonarchube CLI installed and authenticated, then run, confirm with, a SonarCube cloud project with the Vortex Entitlement. Vortex is SonarCube cloud only and is a paid add-on. One prior C analysis, the project has to have been analyzed in your C pipeline on a long-lived branch at least once after Vortex was enabled for the org. That C-run is what agentic analysis of Vortex restores as context. Without it there is nothing to analyze against. On your path, the hook uses it to read

Claude Cod Codes event JSON. Vortex's agentic analysis runs server side over HTTTPS against SonarCube Cloud, so you do not need Docker for this CLEI path. The template, two files, first the hook script, then wire it to the event for the file writing tools in. Restart Codod code so it picks up the new hook. That is the whole thing. How does each line of the Sonar analyze agentic hook script work? The mechanism only works if you understand two contracts. How Claude Code hands you the event, and how it reads your answer. Claude code passes the event as JSON on STD-D-I-N, not as environment variables. There is no. The variables Claude Code does export are path placeholders dollar-clod underscore project underscore D-Ir, Dollar Claude underscore plugin underscore root, and dollar-clod underscore plugin underscore data,

and none of them carry the event. Beyond those, hooks simply inherit the parent environment. So the first thing every hook does is read STD-I-N and parse it. 1. Reads the event Jason from STD-N and pulls out the path of the file Claude just wrote. Fur and that field is. 2. Bails out cleanly if there is no real file to look at, also covers the empty string case. Exit O means, no opinion, carry on. Quote.3. Runs agentic analysis on just that one file, using the restored C context.

It exits 51 when it reports issues and zero when the file is clean. We capture both the output and the exit code, the is not decoration, a single defaults to standard depth, and only deep turns on cross-file analysis, taint analysis, at present. Only the file you pass is uploaded. SonarCube evaluates it against the project as of your last C analysis with your modified file substituted in. You can pass several files with repeated flags, or used to pick up whatever Git has staged. 4. If the exit code is 51, we print the findings to STD-E-R-R and on a hook exit 2 does not undo the edit. The tool already ran, but it does feed your STD-E-R-R back to Claude as feedback. Claude reads the findings, fixes the code, edits again, and the hook fires again. That is the loop. 5. Otherwise, nothing to say, the choice of matters and is easy to get wrong. Per the Claude Code Hook's reference, on most events only exit code.

two blocks are feeds back, exit code 1 is treated as a non-blocking error and the turn just continues. And four specifically, plain STD out on exit O goes to the debug log, not to the model, though a valid JSON object printed on exit zero is still parsed, which is the escape hatch used below. So if you want the findings in front of Claude, STDRRR plus exit 2 is the reliable path. Why this gives you C-grade feedback and not lint noise is not a local linter. It ships the changed file to SonarCube Cloud, which restores the dependency graph, type information, and quality profile from your last C analysis and runs the same engineer pipeline runs, then returns findings in seconds. That is why, at deep depth, it can catch things a single file tool cannot, like a tainted value

flowing from a request parameter into a SQL sync. The exit 51 convention gives you a clean, deterministic signalto branch on, with no output parsing and no LLM judge in the middle deciding whether your code is fine. How do I handle Sonar analyze agentic errors and exit codes in a hook? The five-liner fails open. Any exit code that is not 51 or zero, an a off failure, a transient server error, a bad flag, falls through two, and the edit sales passed unverified. For a real guardrail, branch on all three cases and decide whether an analysis failure should fail closed. If you would rather not interrupt the turn and instead attach findings as advisory context. Drop the in return and payload on Exidoa instead. Both are valid. The difference is whether a

finding stops Claude to fix now or just rides along as a note. Note that is capped at 10,000 characters. Anything longer is written to a file and replaced with a path and a short preview. Check the JSON output, section of the Hooks Docs for the exact decision control fields your Claude Code version supports. How do I test a Claude code post tool use hook with SonarCube? Ask Claude to write something obviously unsafe in a file in your project. Claude writes the file, the hook fires, and agentic analysis comes back with ASQL injection finding. The database queries should not be vulnerable to injection, taint rule. Claude reads it off STD-E-R-R and offers to switch to A. If you see that round trip, your hook is live. You can sanity check the command in its own too. Bonus. A commit gate with the same

primitive. Same idea, different event. A hook-on can refuse a while blocker severity. issue surrey open. Note the flags. Requires and severity filtering is, plural, when should I use Sonar integrate clod instead of a custom hook? If you do not need custom scoping or blocking behavior, installs the vortex's agentic analysis hook plus secret scanning hooks for you and manages the wiring. Rerunning it refreshes those artifacts, but updating the CLI binary itself is a separate, keeps the CLI updated and manages the wiring. Bring your own hook when you want control over which when it blocks and what your team sees inversion control. The primitive is identical either way.

A deterministic command at a fixed point in the agent's loop. Thank you for listening to this Hackernoon story, read by artificial intelligence. Visit hackernoon.com to read, write, learn and publish.