[
  {
    "startMs": 13140,
    "text": "Cool. Uh, so I'm here from, uh, Codex's deployment engineering team, and I want to quickly say a few things to introduce the amazing folks at Sonar, as well as Killian. Uh, so I'm gonna skip some of the agent basics that I typically talk about because I get the feeling that this audience knows what they're doing when it comes into that. We're gonna dive right into the harder questions like: What does it mean for an agent to have completed a task? What are trust boundaries? And we have three kinda spicy claims that we want to present as well. Uh,"
  },
  {
    "startMs": 43320,
    "text": "one is done means a task is completed with evidence. Two is that containment is not correctness. And three is that the feedback contract belongs inside the loop. So when we have an agent loop, that tends to follow a few predictable patterns. We tend to have this model action, uh, we have the execution that is governed by the model, we observe the changes, whether that be logs or results, output, or otherwise, and we continue updating the plan. That's sort of like the overarching agent loop that we follow. And then"
  },
  {
    "startMs": 73380,
    "text": "with each individual task, we have, uh, an outcome, we have invariants, we have a generally defined scope for what we're working on, and of course, we also have acceptance criteria as well. Uh, so the definition of done for us, typically it's a reviewable diff, some tool evidence, that type of thing. It doesn't mean just saying fixed. It actually means saying fixed and providing the evidence supporting this fact. Uh, so cheaper implementations tend to shift the bottleneck to specification"
  },
  {
    "startMs": 103400,
    "text": "and verification, and that's really not what we're wanting to do. Um, there's this idea of correlated failure as well, and there's typically a couple of common failure modes that coding agents, uh, tend to fall into. It tends to fall back to incomplete context, uh, where... Or maybe there's a local fix that violates some global invariants that we have. Uh, or better yet, the, the generated test that we actually do to verify results in the same issues just being propagated"
  },
  {
    "startMs": 133180,
    "text": "through. Uh, so self-critique is useful, but it's not an independent oracle, and we often tend to find that some of the results of the agent and the verifier tend to be orthogonal to each other. You can't, uh, determine whether a task is done without looking at both parts of it. Uh, so you, you typically want to almost seek out disconfirming evidence of a task being completed. Uh, according to the compiler, is it done? According to the tests, analysis, so on and so forth, is it done? And it's--"
  },
  {
    "startMs": 163520,
    "text": "You can't really replace human review in the entire cycle as well. Um, the, the next point I wanted to quickly hit on is, uh, containment doesn't equal correctness. Uh, we have the execution layer, which typically defines what an agent can do, right? What tools does it, does it have access to? Uh, what scope does it have, uh, purview over? What approvals does it need to act? And then we have the, uh, with this execution layer, we have the artifact layer. Uh, and this is really where the results are"
  },
  {
    "startMs": 193220,
    "text": "evaluated. Uh, is the result acceptable? Uh, what tests were produced? What analyses? What policy? Even what intent is there? Uh, so a sandbox can contain a write, but it can't prove that a query is safe. Uh, so what I'm trying to get at is that no oracle is proof, and that you want to layer controls with different boundaries. Sort of this defense in depth, uh, these multi layers of guardrails. That's sort of the overall"
  },
  {
    "startMs": 223100,
    "text": "idea. And the great part about that is that you as a human, you own the intent, you own the exceptions, and of course, you own the decision whether to ship it or not. Uh, so this is one last thing. Uh, there's a feedback contract that we tend to advise as well. Uh, typically, those come with skills, um, which of course are procedures as to how to accomplish a particular task. Uh, MCPs contain structured tools and context. And of course, we are able to provide"
  },
  {
    "startMs": 252900,
    "text": "lifecycle checks with hooks. Really good for  finding out if you have hard-coded secrets or that kind of thing as well. Uh, so with this, you want to create this full CI and human review process. That should ultimately be the core of what the human's role is within this. Uh, and that sort of... So anyways, um, what you want to evaluate when you are creating this sort of agentic process is a few things. Uh, what's the boundary, for example? Uh, are you able to, uh,"
  },
  {
    "startMs": 282780,
    "text": "intercept secrets before model input, for example? Uh, how is the project grounded? Uh, do you have any concrete rules or locations or vulnerability paths that you are able to provide? Uh, what is the scope? Are parameters binding while preserving behavior? These are things to check for. And of course, you have to constantly run your rechecks, uh, assert that the agents are not the terminal state. Uh, so anyways, uh, enough yapping from my end of"
  },
  {
    "startMs": 312640,
    "text": "things. Uh, if there's, uh, three points that you take away from me, it's that done means a task is complete with evidence. Two is that containment is not correctness. And three is that the feedback contract belongs inside the loop, so that you can fully take advantage of the capabilities that your agents, such as Codex, provide. Uh, so Killian, let's, uh, let's make that loop con- uh, complete, why don't we? That's, uh, about all from my end of things, so thank you so much for, uh, let- giving me the"
  },
  {
    "startMs": 342380,
    "text": "opportunity to give this introduction."
  },
  {
    "startMs": 345400,
    "text": "Thanks for coming."
  },
  {
    "startMs": 346020,
    "text": "Thank you."
  },
  {
    "startMs": 350280,
    "text": "If you can take a look at this, then, um, and, and scan it and follow through, that would be very helpful. There are a few prerequisites. Um, again, I am Killian I am a developer content engineer at Sonar. Um, so thank you very much again, um, OpenAI and Tony for giving us a little intro into all of this. Um, Codex is a very powerful tool. I use it all the time. I found it very helpful. It's has a fast CLI, it has a, a pretty"
  },
  {
    "startMs": 380204,
    "text": "smart sandbox system, and the hook system that it has as well integrates really well with tools like SonarQube, like I'd like to hop into today."
  },
  {
    "startMs": 391284,
    "text": "So wiring your team for agentic development with SonarQube and OpenAI. Um, the question I wanna pose today is: how do we make sure that the code and the output generated by agents like Codex is verified, that it's safe? At Sonar we had this idea of the agent-centric development cycle. We did, um, some, some research in the past year or so, and we surveyed over a thousand"
  },
  {
    "startMs": 421224,
    "text": "developers, and we found that, uh, forty-two percent of committed code is either AI-generated or AI-assisted, but ninety-six percent of developers do not fully trust it, right? So the vast majority of people do not just think, \"Hey, this is safe,\" right off the bat. Less than half of them say that they fully verify the code before they push and merge it into the code base. There's a bit of tension there. No one trusts it. A bunch of"
  },
  {
    "startMs": 450624,
    "text": "untru-untrusted code is getting into the code base. Um, the reason being is the, the bottleneck used to be code generation, right? How can we create what we're, what we're trying to do to achieve the desired outcome? How do we actually write the code for an application that we're trying to build? Um, with AI agents, that has for the most pa-part been solved with them either doing it themselves or with the assistance of, of AI agents. So the bottleneck has shifted"
  },
  {
    "startMs": 480604,
    "text": "now from just code generation to code verification, right? We have a massive amount of code being generated, but now it is up to the human limitation of, \"Hey, how do I make sure that this is safe? What help and what tools can I get to verify that this is not gonna nuke my code base or nuke my customers and create all sorts of bad, uh, issues going on?\" So we have, uh, four steps in the ACDC, the agent-centric development cycle."
  },
  {
    "startMs": 510624,
    "text": "One of them is not necessarily from Sonar. That is generate. That is whatever coding tool you're using, Codex, anything else, um, that is the generate step. But Sonar owns guide, verify, and solve. What guide is, is we inject the agent with proper context, and that includes your project guidelines, any rules, any specific architecture to make sure that it has high quality context before it even starts building anything. We found that this"
  },
  {
    "startMs": 540064,
    "text": "reduces token cost overall, and at enterprise scale, that, I mean, saves a lot of money in the long term. Verify is as soon as it's done creating, uh, whatever task you've assigned to a generated code, we wanna make sure that no issues are being introduced. So no security issues, code quality issues, maintainability, anything like that, none of that needs to be pushed out to production code. And then solve is, okay, we have detected there's an issue, right? There's some sort of"
  },
  {
    "startMs": 569784,
    "text": "injection vulnerability or whatever that's going on. We need to remediate that quickly, um, and ef-as efficiently as possible so that we can kinda have this iterative coding system right there. And the last slide I'm gonna show before we hop into the actual activity is, uh, the concept of the inner loop and the outer loop of verification. Outer loop is your traditional CI system that you have set up, right? So you write code, you push it to"
  },
  {
    "startMs": 599664,
    "text": "GitHub, GitLab, whatever you use. The pipeline runs, and something may fail, right? Your test or a scan or SonarQube may fail, and then you go back to the IDE, and then you try and fix it, and then you push it, and then it fails again. This has been the bane of my existence, the bane of many developers' existences. So we wanna save time by shifting left to the inner loop, and that's the IDE. So that's as soon as we are done generating code, we wanna"
  },
  {
    "startMs": 629704,
    "text": "verify that it is correct within the IDE without having to push it out. Um, this saves a lot of time. Uh, I mean, especially, you know, being able to automatically verify all this stuff. Time is money at, at enterprises, and your engineers save a lot of money on therapy bills as well without that frustration. Um, all right. That is the last slide I really wanna focus on, uh, before hopping into"
  },
  {
    "startMs": 659664,
    "text": "the terminal. Uh, a few quick things I wanna touch base on. Before that, you're gonna see two ti-- uh, two tools that I'm gonna talk about. Our tool for context, uh, our tool called context augmentation, it's what we're gonna use for the guide stage, and our tool for agentic analysis you're gonna see in the verify stage. We'll come back to those later. Um, and the, the big takeaway as well that I want everyone to keep focusing on is this bottleneck has shifted from code generation to"
  },
  {
    "startMs": 689724,
    "text": "code verification. Um, before we hop in as well, everyone should have Docker running if you're able to on your computer. And just quick show of thumbs, just so I have an idea of people who have been able to follow along with the prerequisites so far. Thumbs up if you got Docker running and are kinda primed, ready to go hop into the terminal and follow along. Awesome. A few. Perfect. Thank you. Um, if not, again, this repo is available. You can follow through with"
  },
  {
    "startMs": 719624,
    "text": "this on your own time. Um, you, you will have all of this information. So let me pop out of this real quick. I only have limited view, cutting the top part of my screen off, but should be good to go. All right. So the first thing that we are going to do is we are going to run this script called Apply Sonar. Um, this is just the, the repo that I clone locally. This is gonna require a bash terminal, so if you're on Windows, you can use Git Bash or something like that. Um,"
  },
  {
    "startMs": 749788,
    "text": "so I'm gonna go ahead and type that in, that is apply sonar."
  },
  {
    "startMs": 758128,
    "text": "All right, and this is going to do a few things. This is a personal tool that I built. It is not an official Sonar product. Um, it is just a shortcut so we're not spending ten minutes clicking through a UI or anything like that. Let me make sure my Wi-Fi is doing all right. Okay."
  },
  {
    "startMs": 780388,
    "text": "Running through a little bit of computer slowness up here. Um, but it'll-- this will create a SonarQube Cloud project for you, um, runs the first scan for you."
  },
  {
    "startMs": 792468,
    "text": "Okay. EU. And it will auth me in. So we just pop open the browser. Um, this will install a few related SonarQube tools for you, like our CLI and anything else that we're gonna need to run our plugin with Codex on top of."
  },
  {
    "startMs": 816028,
    "text": "All right."
  },
  {
    "startMs": 818588,
    "text": "Bear with me as it looks like I'm bumping into just a little bit of Wi-Fi slowness in here, but it shouldn't be a big issue. So that has been successful."
  },
  {
    "startMs": 831548,
    "text": "Um, you're gonna wanna put in, um, the org that you want, so the org that you were created, that was, uh, created for you when you made an account."
  },
  {
    "startMs": 846228,
    "text": "And that'll run. Um, this right here, just to talk about the project, this is a tiny Python project. Nothing complicated. There's like four files, less than two hundred lines total, and I have planted four vulnerabilities in there. Three of them are security vulnerabilities, and one of them is a code smell. And, um, when this script gets done running, then we're gonna hop into the dashboard and make sure that, uh, we can see stuff up there."
  },
  {
    "startMs": 877228,
    "text": "All right."
  },
  {
    "startMs": 879928,
    "text": "Normally, uh, I think there's a lot of people trying to access this Wi-Fi. Uh, I've not seen this take longer than a minute on my own personal Wi-Fi. So if you're following along at home, don't think you'll have to be sitting around like this, um, for a little while. Whoops."
  },
  {
    "startMs": 901848,
    "text": "So I am... You know what? I may have actually forgot to export my token, which is a step in the repo real quick. So, um, this should be in your shell. I'm gonna pull out, my disconnect real quick just for a second so I don't expose my Sonar token to a room full of a bunch of people, and then I'll pop right back in."
  },
  {
    "startMs": 927888,
    "text": "Uh, so there should be some steps in the, the repository. You will navigate through the dashboard. I think it's under administration within SonarQube Cloud."
  },
  {
    "startMs": 948128,
    "text": "All right, re-mirror."
  },
  {
    "startMs": 955628,
    "text": "All right. So this will run. Um, a few things I wanna talk about as well. So we are going to see a, uh, SQL injection issue that pops in. Okay, awesome. This looks like it's working now. Um, so it'll go through, and it'll automatically create, um, everything for me in the dashboard. The security rating that it will come up with is going to be E. This is the very lowest. We have, uh, baked in some security issues, and, uh,"
  },
  {
    "startMs": 985608,
    "text": "SonarQube immediately detects these and says, \"Hey, this is no good.\" The next thing that I'm gonna dig into as soon as this gets loaded is just walk through a couple issues. One of them is going to be an open AP-- uh, OpenAI API key. Very relevant if people are using Codex. I have done this. It's actually right here in the code base. Oops, someone forgot to use an ENV file or pass this in as a variable. Um, this happens all"
  },
  {
    "startMs": 1015628,
    "text": "the time. And what a lot of times what happens is people accidentally push these into production code. Um, and the average remediation time for a secret in a public repository is ninety days right now. That is crazy. That is... Your, your token is just sitting out there for all the world to see, all the bots to scrape for ninety days. We want to prevent this as much as possible, and we have a couple tools for that here. Um, another issue that I'm gonna highlight for y'all"
  },
  {
    "startMs": 1046028,
    "text": "here in a second is there is a SQL injection vulnerability. Um, and if anyone who is just perusing through this code as a security was, you may have noticed it. But, um, right here in this database.py file, I am passing in, um, a query from here directly into an f-string that is being, uh, cursor executed. So the argument is going straight into the"
  },
  {
    "startMs": 1075988,
    "text": "string. That is bad news bears, especially because this, um, function search task is being, uh, given an argument from sys.argv. That means that anybody who controls sys.argv gets to control your database, right? This is really bad. SonarQube is able to detect this and will let you know, \"Hey, here is the data flow that we're detecting.\" It's using symbolic execution and taint"
  },
  {
    "startMs": 1105912,
    "text": "analysis to identify the data flow and, and trace it as it moves through your application."
  },
  {
    "startMs": 1113712,
    "text": "Um, there's gonna be a few things that we do as soon as this is set up. One of them is, um, in-installing the, the SonarQube Codex marketplace. Another one is wiring that to your project. And then another one is, um, making sure that everything is, is connected in the plugin. So this is almost done here. Apologize for that short wait, folks. Um, and if"
  },
  {
    "startMs": 1143672,
    "text": "you are running this yourself, hopefully it is, um, either finished so far or, or almost done. This will be done momentarily, but the three tools that I'm gonna focus on today are the, um, the secrets detection hook that we offer. We also have a, a list issues tool through Codex, and that allows you to see any of the issues from SonarQube within the terminal. And then the third one is being able to"
  },
  {
    "startMs": 1173612,
    "text": "find and fix issues from those listed issues that we pull in, in, in the plugin itself."
  },
  {
    "startMs": 1182272,
    "text": "Any questions so far from anyone? If you have questions, by the way, if your setup's not working, we have our lovely team from Sonar over there. They're gonna wave hi real quick. Um, if you raise your hand and bump into anything, they are more than happy to come over and talk to you and, and help you through everything."
  },
  {
    "startMs": 1204012,
    "text": "All right. Analysis complete, and I can go ahead and click into my dashboard."
  },
  {
    "startMs": 1217051,
    "text": "Open that up."
  },
  {
    "startMs": 1220252,
    "text": "Like I said, this is gonna be our SonarQube Cloud dashboard that shows you all of the issues that it's detected, um, within your project."
  },
  {
    "startMs": 1231272,
    "text": "And if you've had any issues with Wi-Fi or, or being able to install any of the prerequisites, um, again, no problem. This repo that you scanned, uh, the QR code for..."
  },
  {
    "startMs": 1244932,
    "text": "Just reload that. That repo is going to be up for you."
  },
  {
    "startMs": 1260152,
    "text": "All right. So here's the dashboard. And I'm not gonna spend too much time here, um, but we can see here that the security rating is E. There are those three security issues. There are four total. And if I click on this, we can see here is that OpenAI API key that was able to detect, uh, that, that's here, um, just plain text in the source code. And if I go back, the other one I wanna focus on is this SQL"
  },
  {
    "startMs": 1289912,
    "text": "injection vulnerability right here. This is the one I talked to, uh, y'all with the, the sys.argv issue, and this is taint analysis tracing the data flow from the source here all the way through different files and functions into the sink right here. Very, very helpful. All right. Popping back over to the terminal. Um, let me hop over to my handy dandy, uh, command clipboard that I"
  },
  {
    "startMs": 1319932,
    "text": "have here. I'm going to do Codex, uh, plugin marketplace add, and what that's gonna do is that's just going to add the SonarQube marketplace here."
  },
  {
    "startMs": 1333212,
    "text": "And, um, this, as soon as that's in, we're going to hop into, uh, Codex itself. We will see the SonarQube, uh, plugin available, and we'll be able to select that."
  },
  {
    "startMs": 1347832,
    "text": "So give that a few seconds. Uh, appreciate all of y'all folks being able to bear with me as I bump into just minor connectivity slowness. Again, in your normal agentic workflows, I'm sure things will be moving much faster for you."
  },
  {
    "startMs": 1365592,
    "text": "Perfect. I'm gonna pop open Codex. Sweet. And I'm going to do /plugins and then just search for SonarQube and install it. So that is get the marketplace, run it, /plugins, uh, invocation, and then type in SonarQube, and that is installed."
  },
  {
    "startMs": 1392132,
    "text": "All right, I'm gonna exit out of this so that it can reload and so I can just run a couple more commands. Um, I'm going to, uh, say sonar"
  },
  {
    "startMs": 1404952,
    "text": "auth login."
  },
  {
    "startMs": 1407972,
    "text": "That's just gonna authenticate the CLI, um, which, uh, will allow us to use a lot of the capabilities that the plugin is built off of."
  },
  {
    "startMs": 1421552,
    "text": "After that, uh, we're gonna get to finally the, the final wiring step, which is just Sonar integrate Codex as soon as this gets off for us. Yep. Allow that. Perfect."
  },
  {
    "startMs": 1441752,
    "text": "So that will take hopefully not too, too much longer, a couple seconds, get that updated, and then we'll write, um, do this integrate Codex command here."
  },
  {
    "startMs": 1466922,
    "text": "Oh, looks like it's running into some more, um..."
  },
  {
    "startMs": 1472582,
    "text": "Try that. Looks like for some reason the, the Sonar token which is exported is getting lost."
  },
  {
    "startMs": 1483002,
    "text": "Okay."
  },
  {
    "startMs": 1485602,
    "text": "Sonar."
  },
  {
    "startMs": 1490862,
    "text": "Pop back in for y'all real quick."
  },
  {
    "startMs": 1501602,
    "text": "See if you can't see my screen again."
  },
  {
    "startMs": 1507782,
    "text": "Perfect."
  },
  {
    "startMs": 1511102,
    "text": "I'm gonna go to the clipboard and pull this back over."
  },
  {
    "startMs": 1521882,
    "text": "All right. So, uh, what this is gonna do is a few different things. This is going to get you your secrets detection hook. This is going to get you your agent's, uh, MD directive to use all the SonarQube skills, and this is going to give you, um, other skills and, uh, the MCP config as well."
  },
  {
    "startMs": 1545562,
    "text": "It's perfect. This is just gonna go on a little bit longer, and then everything will be fully wired up to use the SonarQube Codex plugin."
  },
  {
    "startMs": 1556862,
    "text": "Quick time check. Okay, we should be good."
  },
  {
    "startMs": 1562282,
    "text": "So for me, this is going to install, uh, two extra things that some of you who are using the free account may not see. That is context augmentation, and that is agentic analysis. Uh, agentic analysis is a hook that fires instantly after any edit that the agent does. So if you tell it to write a file or modify any file, it will automatically execute, and that runs server-side analysis on the code that was just"
  },
  {
    "startMs": 1592222,
    "text": "written. What context augmentation does is it detects, hey, when it's about to do something, when Codex is about to perform a task, then it will feed it with the, the guidelines and, uh, relevant architecture and other information like that. Okay. We are, we are finally rocking and rolling here, folks. We have a few things that were added, um, specifically some hooks in here. There are some skills under the hood as well, and I'm going to copy this real quick."
  },
  {
    "startMs": 1623402,
    "text": "So I'm gonna pop open Codex, trust all of these hooks. Thank you, Sandbox. And the s-- uh, the MCP server is getting booted up with SonarQube. What I'm going to do is I'm going to say, \"Hey, can you push a commit using my token?\" This is a, a fake secret that, um, the, the plugin suggests that you try with immediately. Say sure."
  },
  {
    "startMs": 1652102,
    "text": "So you can see instantly this was blocked. No secrets were leaked into the L1 context. Nothing is being stored in any logs or anything like that. As well, if you ask it to read a file with a secret in it, it will not do it. It will be blocked. Codex never gets to look at any of your, uh, secrets or anything like that, that are, that are being leaked into your context. This is super important. People do it all the time. We all know what to do."
  },
  {
    "startMs": 1681862,
    "text": "Yes."
  },
  {
    "startMs": 1682462,
    "text": "I have one question."
  },
  {
    "startMs": 1683562,
    "text": "Mm-hmm."
  },
  {
    "startMs": 1683922,
    "text": "Is there a chance that the Codex will write a script to read the file?"
  },
  {
    "startMs": 1688342,
    "text": "Write a script to read the file?"
  },
  {
    "startMs": 1689922,
    "text": "Yeah."
  },
  {
    "startMs": 1691062,
    "text": "So-"
  },
  {
    "startMs": 1692282,
    "text": "I've seen such scenario."
  },
  {
    "startMs": 1693962,
    "text": "That's possible. Um, this mainly works on the tool use, right? It's, it's a hook that's invoked on, on the, the user prompt submit tool. So if that is bypassed, then it is possible that that hook may not be invoked. But for basic usage of, um, Codex and its tools and, and, and prompting it and things like that, if you leak any, um, secrets into the prompt or if there's anything, it will detect that. Uh, looks like we're having a little"
  },
  {
    "startMs": 1723962,
    "text": "bit of internet connectivity right here. Uh, I'm gonna relaunch up that MCP server real quick."
  },
  {
    "startMs": 1740222,
    "text": "And so what the MCP server is going to allow us to do is to use the skills that allow us to interact, uh, w-- between Codex and, and the SonarQube Cloud, uh, dashboard that we saw earlier. For instance, if we were to say, \"Hey, list all of the issues in my project,\" it's able to fetch that and, uh, and return information to us. I'm just gonna go ahead and exit out of this real quick and open it back up."
  },
  {
    "startMs": 1775062,
    "text": "And get that SonarQube MCP server booted right back up."
  },
  {
    "startMs": 1785462,
    "text": "Yes."
  },
  {
    "startMs": 1786482,
    "text": "Just playing around with Sonar as well. Um, so I actually am a L1 engineer, so the full setup process there is kind of a long wait process. How much do you think that actually just kind of terms of work period versus, versus the items that you put together expected?"
  },
  {
    "startMs": 1802942,
    "text": "I am very sorry. It's hard for me to hear. Would you mind walking up or speaking a little loud-- louder?"
  },
  {
    "startMs": 1808902,
    "text": "Okay. Uh, um, so the question is, in this whole setup process-"
  },
  {
    "startMs": 1813782,
    "text": "Mm-hmm."
  },
  {
    "startMs": 1813982,
    "text": "You know, we have a network."
  },
  {
    "startMs": 1815242,
    "text": "Yes."
  },
  {
    "startMs": 1815542,
    "text": "So there's plenty of time where you see it's actually budgeting for the placement like ten millisecond-"
  },
  {
    "startMs": 1821722,
    "text": "Mm-hmm"
  },
  {
    "startMs": 1830432,
    "text": "Running this on my own, the Apply Sonar script that get, uh, gets us all provisioned, for me, never takes longer than a minute if I'm running it on my own. Um, everything else, the MCP, it's, is about as long as any other MCP that it takes, assuming normal connectivity. Um, I'm doing my best to work with the connectivity here, but, um, outside of that, I would say there's no extra, uh, overhead that any of these really apply for or, or any of these add to a normal, um, developer"
  },
  {
    "startMs": 1860212,
    "text": "workflow."
  },
  {
    "startMs": 1864432,
    "text": "So I'm gonna double-check that the MCP is, uh, up and running real quick."
  },
  {
    "startMs": 1874012,
    "text": "And, um, like I said, what, what the MCP does is allows you to have access to all of the tools to where any time you ask it to do something related to, uh, Sonar, like the issues in your project, it automatically detects what's going on, um, and, and will invoke any of those relevant skills. One of those skills is context augmentation, which is knowing that, okay, we have the SonarQube tools, but our network does not seem to be populating, uh,"
  },
  {
    "startMs": 1903992,
    "text": "the MCP with any of that."
  },
  {
    "startMs": 1908532,
    "text": "Let me see, let me see if it'll work with us regardless. Let me say, \"List the issues in my project.\""
  },
  {
    "startMs": 1920712,
    "text": "Um, any other questions so far? Figure I might as well take a few while we're waiting. Yes."
  },
  {
    "startMs": 1926192,
    "text": "Can you explain how the MCP interacts with the Sonar CLI? What's the relationship?"
  },
  {
    "startMs": 1930832,
    "text": "Yeah. So the, the, the CLI, um, actually only sets up the configuration. The MCP runs within Docker. So it will sometimes go through the MCP if it's using any of the skills, um, that it has there. But for the most part, this plugin and everything just sets up the configuration and then invokes, um, skills through there."
  },
  {
    "startMs": 1954012,
    "text": "It utilizes local commands to set up?"
  },
  {
    "startMs": 1957232,
    "text": "The, the, the CLI helps you provision and set up the MCP and everything like that, and then there are commands that you're able to, to invoke through the MCP with the CLI. And I wanna clarify the difference. There's a CLI that this plugin lives on top of. So there are certain things where you could say, \"Hey, execute, um, you know, this, this task for me,\" and it may route through, route it through an MCP skill or through a CLI command."
  },
  {
    "startMs": 1986972,
    "text": "Okay. So looks like we have the MCP. It's just running very slow because of network, because it was able to detect that for us. Sonar list issues skill, as well as this context augmentation skill."
  },
  {
    "startMs": 2000592,
    "text": "We can also see that, hey, even when it's looking at its skills, we are running the secret scan and making sure that there are no, uh, API keys, nothing like that, uh, leaked in, uh, when it, when it takes a look at, at any of its files, including its own skill files."
  },
  {
    "startMs": 2020192,
    "text": "Okay."
  },
  {
    "startMs": 2023392,
    "text": "We're valid. It's looking through all of these. And again, um, running into network connectivity here. This should all happen in a normal, uh, agentic workflow, uh, much quicker than that. Any other questions I can take while we wait for this to, to, to boot up a little bit?"
  },
  {
    "startMs": 2042572,
    "text": "Is it, uh... I think you can support enterprise or just one of the-"
  },
  {
    "startMs": 2046832,
    "text": "Uh, s- enterprise server?"
  },
  {
    "startMs": 2049492,
    "text": "Sonar, Sonar enterprise."
  },
  {
    "startMs": 2051032,
    "text": "Yeah, absolutely. This is available across any levels of, of SonarQube use, be that cloud, be that server, be that enterprise, be that the free tier. Um, everybody should have access to this. Now, uh, the limitation there is, uh, context augmentation and agentic analysis are two tools that we do not offer on the free tier. Um, but if you have those entitlements in your org, then you'll be able to use those tools."
  },
  {
    "startMs": 2081912,
    "text": "All right."
  },
  {
    "startMs": 2085752,
    "text": "So we were able to see that we can get those same issues that we saw on the dashboard now available in the CLI. Imagine that this took fifteen seconds and that the, uh, the, the engineer has a fully connected Wi-Fi connection. Um, they will have this available very quickly within their IDE. Here is the, uh, uh, secret block, uh, blocker severity that I mentioned earlier, but the one that I wanna highlight and get"
  },
  {
    "startMs": 2115772,
    "text": "fixed today is this S8702. This is a rule that we wrote specifically for AI agentic workflows. We do not want AI coding agents to write code that other agents are able to exploit. That is the sys.argv flow that I described a little bit earlier. Again, anybody who has access to sys.argv will be able to have control over your database. We wanna prevent this. So I'm just gonna tell, uh,"
  },
  {
    "startMs": 2145572,
    "text": "Codex, I'm gonna say, \"Hey, fis-- fix S8702.\""
  },
  {
    "startMs": 2153972,
    "text": "That's gonna run. And again, all of these issues, you can instantly pull them to your terminal and ask Codex to fix it. There is gonna be something that is different on my machine versus anybody following along, is that as you'll see, as soon as code is edited and changed here, the post tool use hook for agentic analysis will run. What that does is if there were any new vulnerabilities"
  },
  {
    "startMs": 2183452,
    "text": "introduced in the fix, SonarQube will scan it server side. If you do not have agentic analysis, that is totally fine. You can just scan your code, uh, during your next, uh, CI push or anything like that. But, um, regardless, it will get verified. Using agentic analysis just closes that loop and gives you automatic feedback to know that, hey, I have not introduced any more issues. Um, I don't know about y'all, but I have been in,"
  },
  {
    "startMs": 2213480,
    "text": "uh, coding sessions sometimes where I'm like, \"Hey, fix this issue,\" and then three more kinda pop up, and I'm trying to fix those, and it's like trying to conquer a hydra where they just kinda propagate out. Using this automatically verifies that you're not causing any new, uh, vulnerabilities to come about. Awesome. So we were, we were able to fix this. We get a parameterized query. Wonderful. Um, and this post tool use hook completes. What"
  },
  {
    "startMs": 2243480,
    "text": "it lets you know is, is it lets you know there is an issue in the file, however, that existed beforehand. That was one of the issues that I had already pre-baked in here. So it's not going to try and solve everything else in your file for you. It is smart, and it just realizes that, hey, whatever was in the code that we changed, we're gonna u- uh, analyze that and make sure that there are no new issues introduced from that code. So, wonderful."
  },
  {
    "startMs": 2273280,
    "text": "Um, it reanalyzed that code inline and verified that it passed, um, and we no longer report, uh, S8702. So we are able to find and fix and automatically verify, um, new code, uh, as it comes into our workspace. All right."
  },
  {
    "startMs": 2299240,
    "text": "So I wanna leave a little bit of time for questions at the end, so I'm just gonna, um, move through to this last piece here. And this is, um, adding a new function, right? Delete a task by ID to database.py. And this one, asking it to come up with, uh, new code, it will use context augmentation. As I mentioned earlier, this fetches relevant context, rules, architecture from your project and feeds that into the"
  },
  {
    "startMs": 2329100,
    "text": "agent. Now, I have no idea how long this may take to work. I imagine within less than a few, uh, minutes. Normally, it's seconds. Um, however, what I want you to realize as well is that using this is the full cycle all within the terminal, as we are guiding the agent... Oh, look, it finishes very quickly. Very well done. Um, as we, we, um, get relevant"
  },
  {
    "startMs": 2358580,
    "text": "context, um, we u- we get this to be fixed, uh, or implemented in this case when we're asking it to implement a new, uh, feature. It gets verified from the, uh, agentic analysis hook, and if there were any issues in there, uh, they would be flagged, and Codex would continue to iterate until it is remediated. So that's how we're getting that guide, verify, and solve, uh, methodology in here. All right."
  },
  {
    "startMs": 2389540,
    "text": "I'm not gonna spend any more time in the terminal. Um, this again is available for you to work on, uh, at your own leisure. Uh, there's a couple more things in there that you can do like, um, go ahead and track down some of the remaining issues, um, if your org has entitlement for context augmentation and agentic analysis, uh, using that a little bit. Um, but we are able to see that secrets get blocked, right? We can do find and fix on issues that"
  },
  {
    "startMs": 2419480,
    "text": "exist, and the new tasks that we're having it do, uh, have a much stricter verification layer wrapped around it. And thank you very much for wading through some of the network connectivity issues with this. Um, I wanna say that we at Sonar have a booth downstairs. I would love, uh, to come and talk to any of you guys. Would love to chat about either AI-related coding or anything outside of that. Uh, feel more than free to come"
  },
  {
    "startMs": 2449340,
    "text": "out and say hi to us. We have swag. We have Guitar Hero. We are, we are, um, having a party down there. Um, our, uh, community that we have, our Sonar community, I believe it's community.sonarsource.com, is a great resource if you get stuck working through the repo at all in your own time. Um, that is where our engineers who build the product are able to answer questions and, and help people along, um, who, who run into issues."
  },
  {
    "startMs": 2479600,
    "text": "But thank you very much for, uh, listening and working along with me. And if you guys have any questions, uh, feel free to come up or raise your hand, and we can work through that. Well, again, thank you very much for coming. My name is Killian, uh, with Sonar, and, uh, hope to see you down at the booth. Appreciate it."
  }
]