Best for
- Teams using SonarQube
- Developers who want to integrate static analysis into AI workflows
- Organizations needing automated code review and compliance checks
S
SonarQube MCP Server
Official
Seamless integration of SonarQube code quality and security analysis into AI assistants.
GitHub source repository ↗
66FMRS · C
The SonarQube MCP Server is an officially maintained server providing a rich set of code quality and security tools, supporting multiple clients and transports, but requires valid SonarQube credentials and careful security configuration.
The SonarQube MCP Server is an official MCP server that enables AI agents to directly access code quality and security data from SonarQube Server or Cloud. It supports analyzing code snippets directly in the agent context and provides a rich set of tools for searching issues, security hotspots, quality gates, coverage, dependency risks, and more. The server supports both Stdio and Streamable HTTP transports, with configurable options like selective toolset enablement, read-only mode, and workspace mounting to reduce context usage. It works with all major AI coding assistants, including Claude, VS Code, Cursor, and others.
Tools
analyze_code_snippet
Analyze file content to identify code quality and security issues, optionally filtered to a specific code snippet.
analyze_file_list
Analyze a list of files using SonarQube for IDE.
toggle_automatic_analysis
Enable or disable automatic analysis in SonarQube for IDE.
run_advanced_code_analysis
Run advanced code analysis on a single file in SonarQube Cloud.
search_files_by_coverage
Search files in a project sorted by coverage to identify files needing test improvements.
get_file_coverage_details
Get line-by-line coverage information for a specific file.
search_dependency_risks
Search for software composition analysis issues (dependency risks) in a project.
list_enterprises
List enterprises available in SonarQube Cloud that you have access to.
change_sonar_issue_status
Change the status of a SonarQube issue (accept, false-positive, or reopen).
search_sonar_issues_in_projects
Search for SonarQube issues in your organization's projects.
search_security_hotspots
Search for Security Hotspots in a project.
show_security_hotspot
Show detailed information about a Security Hotspot.
change_security_hotspot_status
Review a Security Hotspot by changing its status.
list_languages
List all programming languages supported in this SonarQube instance.
get_component_measures
Get SonarQube measures for a component (project, directory, file).
search_metrics
Search for SonarQube metrics.
list_portfolios
List enterprise portfolios available in SonarQube.
search_my_sonarqube_projects
Find SonarQube projects with pagination.
list_branches
List analyzed branches for a project.
list_pull_requests
List all pull requests for a project.
get_project_quality_gate_status
Get the Quality Gate status for a project.
list_quality_gates
List all quality gates in your SonarQube.
show_rule
Show detailed information about a SonarQube rule.
search_duplicated_files
Search for files with code duplications in a project.
Setup
- Ensure Docker (or compatible OCI runtime) is installed. 2. Create a SonarQube user token. 3. Use the configuration generator or manually edit the MCP configuration file. 4. For SonarQube Cloud, set SONARQUBE_TOKEN and SONARQUBE_ORG; for SonarQube Server, set SONARQUBE_TOKEN and SONARQUBE_URL. 5. Restart your AI client and verify the connection.
claude_desktop_config.json
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "<your-token>",
"SONARQUBE_ORG": "<your-org>"
}
}
}
}
Fit and risk
Not for
- Users without a SonarQube account or token
- Personal projects that don't require code quality analysis
- Users who want to use MCP without external dependencies
Required permissions
- Requires a SonarQube user token to access the API
- May require organization key or server URL
- Needs network access to the SonarQube instance when running in a container
- Optional workspace mount to read files
Risks and side effects
- Token leakage: ensure tokens are stored securely and not hardcoded
- Data privacy: code analysis may involve sensitive code; ensure secure connection
- Resource consumption: large analyses may consume computational resources
- Container security: use official images to avoid malicious code
Troubleshooting
- Check that environment variables are correctly set and the token is valid
- Confirm network connectivity to the SonarQube instance
- View logs (SONARQUBE_DEBUG_ENABLED=true) for debugging information
- Ensure you are using the latest image version (--pull=always)
- For Streamable HTTP mode, check the Authorization header
Use cases
Get code quality analysis results directly in your IDE
Search and filter issues and security hotspots in your projects
Check quality gate status and coverage reports
Analyze code snippets for immediate feedback
Integrate code quality checks into CI/CD workflows
Supported clients
Claude DesktopFull support
Claude CodeFull support
VS CodeFull support
CursorFull support
ZedFull support
WindsurfFull support
Gemini CLIFull support
GitHub Copilot CLIFull support
GitHub Copilot coding agentFull support
AntigravityFull support
KiroFull support
Codex CLIFull support