You need to have clarity on what is your expectation from the vendor. Sonarqube is good for code quality and easy integration with build cycle. Veracode is good for SAST, recently DAST with reduced false positives. Has some complexity in SDLC integration.