SonarQube MCP Server

Official

Seamless integration of SonarQube code quality and security analysis into AI assistants.

How to install ↓ Compare GitHub source repository ↗

Category: Dev Tools #38 of 438
Stars: ★ 660 Very popular
Transport: stdio (local process) · Streamable HTTP
Runtime: Docker
Credentials: API key / credential required
License: Other / unspecified
Last commit: 2 days ago
Tools: 24

66FMRS · C

The SonarQube MCP Server is an officially maintained server providing a rich set of code quality and security tools, supporting multiple clients and transports, but requires valid SonarQube credentials and careful security configuration.

Strongest · Documentation 17/20 Weakest · Reliability 10/20

Reliability

10/20

Security and permissions

15/20

Maintenance

10/20

Documentation

17/20

Setup experience

14/20

Why each score

Reliability 10/20: The manifest is conformant to the 2025-12-11 schema and the README consistently describes three transports (stdio, Streamable HTTP, HTTPS), health-check endpoints, and a coherent tool surface (analysis, issues, hotspots, quality gates, etc.), so a clean init and tools/list handshake is plausible on paper. However, this is a static review and the supplied material contains no source code, no committed tests, and no CI workflow files (README badges are untrusted evidence), so actual startup behavior, tool/behavior consistency, error handling, and edge cases cannot be verified. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence, and uncertainty lowers the score, so I award 10.
Security and permissions 15/20: No red lines are triggered: every install example uses placeholders (e.g., <YOUR_TOKEN>) with no real secrets; the manifest marks SONARQUBE_TOKEN as isSecret; the README includes a security best-practices section explicitly warning against hardcoding tokens and recommending environment variables. Least privilege is well designed: SONARQUBE_READ_ONLY mode, SONARQUBE_TOOLSETS tool filtering, per-request header narrowing in HTTP mode that can only reduce scope, and localhost-only default binding for HTTP; TLS/HTTPS, custom CA, proxy, and mTLS guidance is also present. Deductions: no client-side confirmation flow is documented for the write tools (e.g., change_sonar_issue_status, change_security_hotspot_status); the HTTPS default keystore password 'sonarlint' is a weak default; the manifest over-marks SONARQUBE_ORG and SONARQUBE_URL (an org key and a URL, not credentials) as secrets; opt-in debug logging writes to files and STDERR and could expose sensitive data. Overall credential handling and data boundaries are strong, but confirmation and some defaults are incomplete, giving 15.
Maintenance 10/20: The repository is not archived, the manifest carries a concrete version (1.24.0), the README documents both an auto-update Docker tag and reproducible pinned tags (e.g., 1.19.0.2785), ownership by SonarSource is clear, and 17 open issues indicate an ongoing tracker. However, there are clear governance gaps: the license is NOASSERTION (no license identified in the supplied evidence), and no dedicated security-response channel (SECURITY.md, advisory feed, or contact) is visible in the material. Badges in the README are untrusted evidence and were not used. This matches the 'active but governance/versioning gaps' anchor at 10: versioning is solid, but license and security response are missing.
Documentation 17/20: Documentation is layered and unusually complete: install guides for 11+ clients (Antigravity, Claude Code, Codex, Cursor, Gemini, Copilot CLI/Agent, Kiro, VS Code, Windsurf, Zed), manual Docker/JAR config snippets, full environment-variable tables with required/optional flags and types, per-tool parameters with limits (pageSize max 500, duplications cap of 10,000 files), a workspace-mount section explicitly addressing context-window cost, transport-mode comparison tables, /health and /info endpoint documentation, custom certificate/proxy/mTLS guides, and a deprecation notice for the SONARQUBE_TOKEN header. Deductions: no dedicated troubleshooting/FAQ section beyond a debug-log toggle, no link to a standalone docs site or API reference in the supplied material, and the tool listing is truncated at the end of the README. Close to the 'layered docs, sufficient examples, disclosed limitations' anchor, but these modest gaps cap it at 17.
Setup experience 14/20: The path from runtime to a working client connection is short and concrete: pull the official OCI image (sonarsource/sonarqube-mcp), set two or three environment variables, and paste a ready-made config block; copy-paste examples exist for virtually every mainstream client (Docker run args plus env sections) and an official configuration generator is linked. Cross-platform coverage comes via Docker, with Podman/nerdctl noted as compatible runtimes, and there is even a --network=host tip for Linux containers connecting to SonarQube for IDE. Deductions: per the static calibration rule, the material contains no committed tests or CI workflow files to verify execution, so setup cannot exceed 15; the setup is container-first and the non-container JAR path is mentioned but not fully documented in the supplied material; token acquisition/filling remains a manual step. Awarding 14.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

Teams using SonarQube
Developers who want to integrate static analysis into AI workflows
Organizations needing automated code review and compliance checks

Not for

Users without a SonarQube account or token
Personal projects that don't require code quality analysis
Users who want to use MCP without external dependencies

Required permissions

Requires a SonarQube user token to access the API
May require organization key or server URL
Needs network access to the SonarQube instance when running in a container
Optional workspace mount to read files

Risks and side effects

Token leakage: ensure tokens are stored securely and not hardcoded
Data privacy: code analysis may involve sensitive code; ensure secure connection
Resource consumption: large analyses may consume computational resources
Container security: use official images to avoid malicious code

Setup

Before you start

Runtime：Docker

SONARQUBE_TOKEN requiredsecret SonarQube user token from your account's Tokens page; must be a USER token when connecting to SonarQube Server.

SONARQUBE_ORG optionalsecret SonarQube Cloud organization key, found at sonarcloud.io/account/organizations; setting it selects Cloud mode.

SONARQUBE_URL optionalsecret SonarQube Server URL (or https://sonarqube.us for Cloud US); required when SONARQUBE_ORG is not set.

SONARQUBE_HTTPS_KEYSTORE_PASSWORD optionalsecret HTTPS keystore password; treat as a secret.

Other optional settings (14)

STORAGE_PATH optional Mandatory absolute path to a writable directory for logs and server files; provided automatically by the container image.

SONARQUBE_PROJECT_KEY optional Optional default project key; removes the projectKey parameter from tools that require it.

SONARQUBE_IDE_PORT optional Port (64120-64130) used to connect with SonarQube for IDE.

SONARQUBE_DEBUG_ENABLED optional Set to true to enable debug logging to file and STDERR for troubleshooting.

SONARQUBE_LOG_TO_FILE_DISABLED optional Set to true to disable file logging entirely; useful in containerized environments.

SONARQUBE_TOOLSETS optional Comma-separated list of toolsets to enable; reduces context overhead by disabling others.

SONARQUBE_READ_ONLY optional Set to true to disable all write operations such as changing issue status.

SONARQUBE_TRANSPORT optional Set to http or https to enable Streamable HTTP transport; defaults to stdio.

SONARQUBE_HTTP_PORT optional Listening port for HTTP(S) mode, default 8080.

SONARQUBE_HTTP_HOST optional Host to bind in HTTP(S) mode, defaults to 127.0.0.1.

SONARQUBE_HTTP_ALLOWED_ORIGINS optional Comma-separated browser origins allowed for CORS.

SONARQUBE_MCP_IN_CONTAINER optional Set to true when running in other OCI runtimes (Podman, Kubernetes); the official image sets it automatically.

SONARQUBE_HTTPS_KEYSTORE_PATH optional Path to the keystore file (.p12 or .jks) for HTTPS mode.

SONARQUBE_HTTPS_KEYSTORE_TYPE optional Keystore type (PKCS12 or JKS), default PKCS12.

Ensure Docker (or compatible OCI runtime) is installed.
Create a SonarQube user token.
Use the configuration generator or manually edit the MCP configuration file.
For SonarQube Cloud, set SONARQUBE_TOKEN and SONARQUBE_ORG; for SonarQube Server, set SONARQUBE_TOKEN and SONARQUBE_URL.
Restart your AI client and verify the connection.

claude_desktop_config.json

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add sonarqube -e 'SONARQUBE_TOKEN=<your-token>' -e 'SONARQUBE_ORG=<your-org>' -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After starting the client, confirm the sonarqube tools (e.g. search_my_sonarqube_projects) appear in the tool list, or ask it to list your SonarQube projects to prove the connection works.

Troubleshooting

Check that environment variables are correctly set and the token is valid
Confirm network connectivity to the SonarQube instance
View logs (SONARQUBE_DEBUG_ENABLED=true) for debugging information
Ensure you are using the latest image version (--pull=always)
For Streamable HTTP mode, check the Authorization header

Things to try

Once connected, you can ask your AI assistant things like:

Analyze src/main/java/MyClass.java for code quality and security issues
Show the ten files with the worst test coverage in my project
What is the Quality Gate status for project my_project?
Mark this SonarQube issue as a false positive

Tools 24

analyze_code_snippet read-only

Analyze file content to identify code quality and security issues, optionally filtered to a specific code snippet.

analyze_file_list read-only

Analyze a list of files using SonarQube for IDE.

toggle_automatic_analysis writes

Enable or disable automatic analysis in SonarQube for IDE.

run_advanced_code_analysis read-only

Run advanced code analysis on a single file in SonarQube Cloud.

search_files_by_coverage read-only

Search files in a project sorted by coverage to identify files needing test improvements.

get_file_coverage_details read-only

Get line-by-line coverage information for a specific file.

search_dependency_risks read-only

Search for software composition analysis issues (dependency risks) in a project.

list_enterprises read-only

List enterprises available in SonarQube Cloud that you have access to.

Show 16 more tools

change_sonar_issue_status writes

Change the status of a SonarQube issue (accept, false-positive, or reopen).

search_sonar_issues_in_projects read-only

Search for SonarQube issues in your organization's projects.

search_security_hotspots read-only

Search for Security Hotspots in a project.

show_security_hotspot read-only

Show detailed information about a Security Hotspot.

change_security_hotspot_status writes

Review a Security Hotspot by changing its status.

list_languages read-only

List all programming languages supported in this SonarQube instance.

get_component_measures read-only

Get SonarQube measures for a component (project, directory, file).

search_metrics read-only

Search for SonarQube metrics.

list_portfolios read-only

List enterprise portfolios available in SonarQube.

search_my_sonarqube_projects read-only

Find SonarQube projects with pagination.

list_branches read-only

List analyzed branches for a project.

list_pull_requests read-only

List all pull requests for a project.

get_project_quality_gate_status read-only

Get the Quality Gate status for a project.

list_quality_gates read-only

List all quality gates in your SonarQube.

show_rule read-only

Show detailed information about a SonarQube rule.

search_duplicated_files read-only

Search for files with code duplications in a project.

Use cases

Get code quality analysis results directly in your IDE

Search and filter issues and security hotspots in your projects

Check quality gate status and coverage reports

Analyze code snippets for immediate feedback

Integrate code quality checks into CI/CD workflows

Supported clients

Claude Desktop

Claude Code

VS Code

Cursor

Zed

Windsurf

Gemini CLI

GitHub Copilot CLI

GitHub Copilot coding agent

Antigravity

Kiro

Codex

Listed from the project's documentation, not tested by this site.

Overview

The SonarQube MCP Server is an official MCP server that enables AI agents to directly access code quality and security data from SonarQube Server or Cloud. It supports analyzing code snippets directly in the agent context and provides a rich set of tools for searching issues, security hotspots, quality gates, coverage, dependency risks, and more. The server supports both Stdio and Streamable HTTP transports, with configurable options like selective toolset enablement, read-only mode, and workspace mounting to reduce context usage. It works with all major AI coding assistants, including Claude, VS Code, Cursor, and others.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →

NPM Sentinel MCP Server 79 · B

AI-powered NPM package analysis MCP server

★ 18 · Tools 19 Compare with this →

MartinLoop MCP Server 79 · B

An independent control layer that gives AI coding agents budgets, brakes, and receipts

★ 410 Compare with this →

GitHub MCP Server 76 · B

GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language

★ 33.5k · Tools 15 Compare with this →

Compare with other MCP servers

Source revision f579f7658136 Data synced 2026-10-12 Read the FMRS scoring method