MCP100 IndexSecurity & Testing

MCP100 RecommendedFirst-party MCP

sonarqube

by ecosystem:sonarqube

Updated September 24, 2026

Security & TestingCybersecuritySoftware & TechnologyAccess · Self-hosted

MCP100 verdict

Bring SonarQube code-quality and security findings into AI-assisted development for issue inspection, project analysis, and remediation workflows.

MCP100 Assessment

Editorial verdict

Recommended for supervised code-quality investigation when project access is scoped and suggested remediations are validated through normal engineering review and CI.

Reviewed July 30, 2026

Task Fit

Mapped

Specialized workflows

Trust

Reviewed

A dated editorial review is published on the MCP detail page.

Maintenance

Activity observed

A dated repository or package update is available; editorial maintenance review is still pending.

Popularity

Signals available

Visible usage signals are shown for discovery only, not as proof of safety.

Best for

Code-quality and application-security investigation with optional controlled project operations.

Not ideal for

Teams outside the publisher ecosystem or without least-privilege credentials

Avoid if

The connected identity is broader than the task requires
Tool calls cannot be reviewed before consequential mutations

Trade-offs

Source findings and code excerpts can be sensitive; mutation tools should remain disabled unless required.

Evidence scope

Evidence

Current source snapshot

Popularity

656 MCP repository stars

No MCP-specific package metric is stored

Repository identity: SonarSource/sonarqube-mcp-server

Package identity: mcp/sonarqube

Stars observed September 24, 2026 · Downloads observation date unavailable

Exact reviewed repository identity; current GitHub repository stars are eligible as repository-level adoption evidence.

No exact MCP-specific package metric was sufficiently verified in this snapshot; preserve existing Not measured/unknown rather than guessing.

Maintenance

Publisher activity observed September 24, 2026

Current source snapshot

Trust review

Source relationship: First-party MCP

Reviewed July 30, 2026

Sources

GitHub repository ↗

Evidence-backed setup

Install & Agents

Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.

Claude Code

Local stdio

MCP100 logic checked

claude mcp add sonarqube -e SONARQUBE_TOKEN="YOUR_SONARQUBE_TOKEN" -e SONARQUBE_ORG="YOUR_SONARQUBE_ORG" -- docker "run" "--init" "--pull=always" "-i" "--rm" "-e" "SONARQUBE_TOKEN" "-e" "SONARQUBE_ORG" "sonarsource/sonarqube-mcp"

The publisher connection details were combined with this client's official MCP transport configuration; installation was not executed by MCP100.

Verify safely: Restart Claude Code, confirm sonarqube tools are listed, and perform one read-only test with non-sensitive data.

Uninstall and revoke

Remove sonarqube from Claude Code, restart the client, remove any separately installed package, and revoke dedicated credentials if used.

Evidence & methodology

Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.

Evidence checked 2026-08-12

Evidence 1 ↗Evidence 2 ↗

Read additional publisher installation details

From the publisher README

Publisher installation details

Original client setup and configuration retained from the publisher documentation.

View original README ↗

Publisher-documented clients

Claude CodeCursorVS CodeWindsurf

These names appear in the publisher's installation documentation. MCP100-verified configurations are shown separately above when available.

Configuration

Depending on your environment, you should provide specific environment variables.

Base

You should add the following variable when running the MCP Server:

Environment variable	Description
`STORAGE_PATH`	Mandatory absolute path to a writable directory where SonarQube MCP Server will store its files (e.g., for creation, updates, and persistence), it is automatically provided when using the container image
`SONARQUBE_PROJECT_KEY`	Optional default project key. When set, all tools that require a project key will use this value automatically — the `projectKey` parameter is removed from their schema entirely. Useful when working on a single project.
`SONARQUBE_IDE_PORT`	Optional port number between 64120 and 64130 used to connect SonarQube MCP Server with SonarQube for IDE.
`SONARQUBE_FORCE_LOCAL_ANALYSIS`	Set to `true` to use `analyze_code_snippet` instead of Vortex analysis on Cloud stdio, including for entitled organizations. Requires the `analysis` toolset. Default: `false`. Has no effect on SonarQube Server or Cloud HTTP.
`SONARQUBE_DEBUG_ENABLED`	When set to `true`, enables debug logging. Debug logs are written to both the log file and STDERR. Useful for troubleshooting connectivity or configuration issues. Default: `false`.
`SONARQUBE_LOG_TO_FILE_DISABLED`	When set to `true`, disables writing logs to disk entirely. No log files will be created under `STORAGE_PATH/logs/`. Useful in containerized or ephemeral environments where file logging is undesirable. Default: `false`.

Workspace Mount (Reducing Context Bloat)

By default, analysis tool analyze_code_snippet requires the agent to pass the full file content as a fileContent argument. For large files or when analyzing many files in a session, this significantly increases context window usage and cost.

Solution: mount your project directory into the container at /app/mcp-workspace. When this mount is detected, the server reads files directly from disk using the project-relative filePath argument — file content never passes through the agent context.

{
  "args": [
    "run", "-i", "--rm", "--init", "--pull=always",
    "-e", "SONARQUBE_TOKEN",
    "-e", "SONARQUBE_ORG",
    "-v", "/path/to/your/project:/app/mcp-workspace",
    "sonarsource/sonarqube-mcp"
  ]
}

With a mount, analysis tools read files directly using filePath; fileContent is not needed.

Over stdio, analysis is selected at startup (subject to enabled toolsets):

SonarQube Cloud: Vortex analysis (run_advanced_code_analysis) with a workspace mount and at least one entitled organization; local analysis otherwise. Vortex analysis only accepts entitled organizations.
SonarQube Server: Vortex analysis for entitled instances (requires a workspace mount); local analysis for instances without Vortex.

Local analysis uses SonarQube for IDE if connected or analyze_code_snippet. Without a mount, snippet analysis requires fileContent.

On Cloud, SONARQUBE_ORG limits the entitlement check to that organization. To use snippets for all organizations, set SONARQUBE_FORCE_LOCAL_ANALYSIS=true, enable the analysis toolset, and restart. This setting has no effect on Server.

Over HTTP/HTTPS, Server supports snippet analysis with a startup SONARQUBE_TOKEN; Cloud exposes no analysis tools.

Selective Tool Enablement

MCP clients load every enabled tool — its name, description, and input schema — into the agent's context on every conversation. Limiting that list with SONARQUBE_TOOLSETS cuts context usage and the token cost of each session.

By default, only important toolsets are enabled. Enable additional toolsets only when you need them.

Environment variable Description

SONARQUBE_TOOLSETS Comma-separated list of toolsets to enable. When set, only these toolsets will be available. If not set, default important toolsets are enabled (analysis, ide, issues, projects, quality-gates, rules, duplications, measures, security-hotspots, dependency-risks, coverage, cag). Note: The projects toolset is always enabled as it's required to find project keys for other operations. Vortex context tools (deprecated name: Context Augmentation/CAG) and Vortex analysis tools (deprecated name: Advanced Analysis/A3S) are only available in stdio mode and share a single combined organization entitlement — an org must be entitled to both to use either. Cloud built-in analysis checks the organization selected at runtime; proxied context tools use the startup organization. On SonarQube Server, stdio lists Vortex context and run_advanced_code_analysis when both the CAG and A3S hubs are entitled. Prefer the unified vortex toolset key. The deprecated cag and analysis keys still work; a startup warning and a deprecation note in the server instructions are emitted when they are used without vortex. In Streamable HTTP mode, clients can send a SONARQUBE_TOOLSETS HTTP header to narrow this further per-request, but cannot enable toolsets beyond what the server was launched with (see Streamable HTTP transport below).

SONARQUBE_READ_ONLY When set to true, enables read-only mode which disables all write operations (changing issue status for example). This filter is cumulative with SONARQUBE_TOOLSETS if both are set. Default: false. In Streamable HTTP mode, clients can send a SONARQUBE_READ_ONLY HTTP header to further restrict individual requests to read-only, but cannot lift a server-level read-only restriction (see Streamable HTTP transport below).

Toolset	Key	Description
Analysis	`analysis`	Code analysis tools (local analysis via `analyze_code_snippet`, deprecated in favor of `analyze_file_list`/Vortex analysis)
IDE	`ide`	SonarQube for IDE bridge tools (file analysis, automatic analysis toggle) — currently also included in `analysis`
Issues	`issues`	Search and manage SonarQube issues
Security Hotspots	`security-hotspots`	Search and review Security Hotspots
Projects	`projects`	Browse and search SonarQube projects
Quality Gates	`quality-gates`	Access quality gates and their status
Rules	`rules`	Browse and search SonarQube rules
Sources	`sources`	Access source code and SCM information
Duplications	`duplications`	Find code duplications across projects
Measures	`measures`	Retrieve metrics and measures (includes both measures and metrics tools)
Languages	`languages`	List supported programming languages
Portfolios	`portfolios`	Manage portfolios and enterprises (Cloud and Server)
System	`system`	System administration tools (Server only)
Webhooks	`webhooks`	Manage webhooks
Dependency Risks	`dependency-risks`	Analyze dependency risks and security issues (SCA)
Coverage	`coverage`	Test coverage analysis and improvement tools
Vortex Context	`cag`	Vortex context tools — stdio only. Deprecated in favor of `vortex` (old name: Context Augmentation/CAG)
Vortex	`vortex`	Unified, recommended toolset surfacing both Vortex context and Vortex analysis tools under one name (stdio only; Cloud needs combined org entitlement; Server needs both hubs entitled)
Agentic Readiness	`agentic-readiness`	Agentic Readiness Assessment tools (SonarQube Cloud, requires org entitlement)

Examples

Enable analysis, issues, and quality gates toolsets (using Docker with SonarQube Cloud):

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_TOOLSETS="analysis,issues,quality-gates" \
  sonarsource/sonarqube-mcp

Note: The projects toolset is always enabled automatically, so you don't need to include it in SONARQUBE_TOOLSETS.

Enable read-only mode (using Docker with SonarQube Cloud):

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_READ_ONLY="true" \
  sonarsource/sonarqube-mcp

SonarQube Cloud

For stdio, configure the following environment variables:

Environment variable	Description	Required
`SONARQUBE_TOKEN`	Your SonarQube Cloud token	Yes
`SONARQUBE_ORG`	Optional fixed SonarQube Cloud organization key	No
`SONARQUBE_URL`	Custom SonarQube Cloud URL (defaults to `https://sonarcloud.io`). Use this for SonarQube Cloud US: `https://sonarqube.us`	No

Examples:

SonarQube Cloud: Only SONARQUBE_TOKEN is required. SONARQUBE_ORG fixes the organization when set.
SonarQube Cloud US: Set SONARQUBE_TOKEN and SONARQUBE_URL=https://sonarqube.us; SONARQUBE_ORG is optional.

SonarQube Server

Environment variable	Description	Required
`SONARQUBE_TOKEN`	Your SonarQube Server USER token	Yes
`SONARQUBE_URL`	Your SonarQube Server URL	Yes

Version requirement: SonarQube Server 2025.1 (SQS) or 25.1 (SonarQube Community Build) or later is required. At startup, the MCP server reads the connected instance version and exits with an error if it is too old (for example, legacy 9.x/10.x Server releases and Community Build 24.x are not supported). SonarQube Cloud is not subject to this check.

⚠️ Connection to SonarQube Server requires a token of type USER and will not function properly if project tokens or global tokens are used.

💡 Configuration Tip (stdio mode): A token without a URL defaults to SonarQube Cloud. Set SONARQUBE_URL for SonarQube Server or a different Cloud region. SONARQUBE_ORG fixes the Cloud organization when set.

In stdio, setting SONARQUBE_ORG fixes the Cloud organization. Tool organization arguments are omitted from schemas and rejected, like projectKey when SONARQUBE_PROJECT_KEY is set.

With SONARQUBE_ORG unset, agents can call list_organizations to discover organization keys, names, IDs, and UUIDs accessible to your user account, then pass a key as the optional organization argument on organization-aware tools. Stdio retains a uniquely detected organization as its default; zero or multiple organizations leave it unresolved. A tool argument applies only to that call and never changes the detected default. Snippet profile and rule lookups use the organization selected for that call.

For HTTP/HTTPS token requests, server-level SONARQUBE_ORG remains supported for compatibility but is deprecated and logs a startup warning. It fixes the organization for every request and rejects client organization headers and tool organization arguments. When no server organization is configured, an optional client SONARQUBE_ORG header fixes the organization for that request and disallows tool organization arguments. Without the header, use the tool argument. Tools that require an organization report discovery guidance when all are missing. Organization discovery and tools whose APIs consume only resource identifiers do not require an organization argument. Organization-aware issue search and dependency-risk entitlement checks use the selected organization. When OAuth is configured, server-level SONARQUBE_ORG is rejected. OAuth requests also reject organization headers; select organizations through tool arguments.

Vortex context tools use the configured or uniquely detected startup organization. Runtime organization arguments do not reconfigure the proxied context engine; unresolved startup organizations skip that proxy. The built-in run_advanced_code_analysis tool checks combined Vortex entitlement for the organization selected on each invocation.

Transport Modes

The MCP specification defines two transport mechanisms: Stdio and Streamable HTTP. The SonarQube MCP Server supports both:

MCP transport	Server mode	Typical use
Stdio	Default (no `SONARQUBE_TRANSPORT`)	Local MCP clients that launch the server as a subprocess (Cursor, Claude Code, VS Code, etc.)
Streamable HTTP	`SONARQUBE_TRANSPORT=http` or `https`	Remote or multi-user deployments; clients connect to `/mcp` over HTTP(S) (e.g. Windsurf with a self-hosted server URL)

Note: Streamable HTTP is the current MCP network transport. The older SSE-only HTTP transport from earlier MCP versions is deprecated and not supported.

1. Stdio (Default - Recommended for Local Development)

The recommended mode for local development and single-user setups, used by most MCP clients.

Example - Docker with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

2. HTTP (Streamable HTTP)

Unencrypted Streamable HTTP transport. Use HTTPS instead for multi-user deployments.

⚠️ Not Recommended: Use Stdio for local development or HTTPS (Streamable HTTP) for multi-user production deployments.

Environment variable	Description	Default
`SONARQUBE_TRANSPORT`	Set to `http` to enable Streamable HTTP transport	Not set (stdio)
`SONARQUBE_HTTP_PORT`	Port number (1024-65535), or `0` for an OS-assigned port	`8080`
`SONARQUBE_HTTP_HOST`	Host to bind (defaults to localhost for security)	`127.0.0.1`
`SONARQUBE_HTTP_ALLOWED_ORIGINS`	Comma-separated browser origins allowed for CORS (e.g. `https://my-app.example.com`)	Not set
`SONARQUBE_MCP_IN_CONTAINER`	Set to `true` when running inside a container. The official Docker image sets this automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.).	`false`

Note: HTTP/HTTPS accepts the user's SonarQube token through Authorization: Bearer <token>. Sonar's hosted Cloud service also supports OAuth. For SonarQube Cloud token requests, the organization is resolved as follows:

SONARQUBE_ORG is an optional request header that fixes the organization for that request. Deprecated server-level configuration fixes it for all requests and rejects client organization headers and tool organization arguments.
Organization-aware tools accept an optional organization argument when neither server configuration nor the request header fixes the organization. Supplying the argument when the organization is fixed is rejected.
Without a default, agents can call list_organizations using only their token, then pass the chosen key to subsequent tools.

Clients can also narrow the visible tools per-request by supplying SONARQUBE_TOOLSETS and/or SONARQUBE_READ_ONLY headers; these apply additional filtering on top of the server-level configuration — they can only reduce the scope, never expand it. No session state is maintained between requests.

Deprecated: For SonarQube tokens, the SONARQUBE_TOKEN request header is still accepted for backward compatibility but will be removed in a future version. Migrate to Authorization: Bearer <token>.

3. HTTPS (Streamable HTTP over TLS) (Recommended for Multi-User Production Deployments)

Secure Streamable HTTP transport with TLS encryption. Requires SSL certificates.

✅ Recommended for Production: Use HTTPS when deploying the MCP server for multiple users over Streamable HTTP. The server binds to 127.0.0.1 (localhost) by default for security.

Environment variable	Description	Default
`SONARQUBE_TRANSPORT`	Set to `https` to enable Streamable HTTP transport over TLS	Not set (stdio)
`SONARQUBE_HTTP_PORT`	Port number (typically 8443 for HTTPS), or `0` for an OS-assigned port	`8080`
`SONARQUBE_HTTP_HOST`	Host to bind (defaults to localhost for security)	`127.0.0.1`
`SONARQUBE_HTTP_ALLOWED_ORIGINS`	Comma-separated browser origins allowed for CORS (e.g. `https://my-app.example.com`)	Not set
`SONARQUBE_MCP_IN_CONTAINER`	Set to `true` when running inside a container. The official Docker image sets this automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.).	`false`

SSL Certificate Configuration (Optional):

Environment variable	Description	Default
`SONARQUBE_HTTPS_KEYSTORE_PATH`	Path to keystore file (.p12 or .jks)	`/etc/ssl/mcp/keystore.p12`
`SONARQUBE_HTTPS_KEYSTORE_PASSWORD`	Keystore password	`sonarlint`
`SONARQUBE_HTTPS_KEYSTORE_TYPE`	Keystore type (PKCS12 or JKS)	`PKCS12`

Example - Docker with SonarQube Cloud:

Note: When running in a container, set SONARQUBE_HTTP_HOST=0.0.0.0 so the container listens on all interfaces and the runtime's port mapping works, and set SONARQUBE_MCP_IN_CONTAINER=true to tell the server it is inside a container. The official Docker image sets the latter automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.). The host-side port flag controls who can reach the server from outside the container. SONARQUBE_HTTP_HOST=0.0.0.0 only controls where the server listens inside the container — browser CORS still allows localhost origins by default.

For a server running locally on your machine (accessible only from localhost):

docker run --init --pull=always -p 127.0.0.1:8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  sonarsource/sonarqube-mcp

For a server accessible from the network (remote deployments):

docker run --init --pull=always -p 8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  sonarsource/sonarqube-mcp

Client Configuration (SonarQube Cloud):

For SonarQube token requests, optionally set SONARQUBE_ORG in client headers to fix the request organization, or omit it to select organizations through tool arguments.

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Client Configuration (SonarQube Server):

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Note: SONARQUBE_TOOLSETS and SONARQUBE_READ_ONLY are optional per-request headers that narrow the server-level tool set for that specific request. They can only reduce scope — they cannot enable toolsets or lift restrictions beyond what the server was launched with.

Note: For local development, use Stdio transport instead (the default). HTTPS Streamable HTTP is intended for multi-user production deployments with proper SSL certificates.

Hosted SonarQube Cloud OAuth

OAuth support targets Sonar's hosted SonarQube Cloud MCP service. Use an OAuth-capable MCP client and sign in when prompted; no OAuth server settings are needed in your client configuration. Existing SonarQube token clients remain supported.

The mcp:tools:read and mcp:tools:write scopes independently control access to read and write tools, subject to your Cloud permissions. Use list_organizations and tool organization arguments to select an organization.

Self-hosted deployments continue to use SonarQube tokens; OAuth for SonarQube Server is not supported yet.

Service Endpoints

When running in Streamable HTTP mode (http or https), the server exposes a few unauthenticated service endpoints in addition to the MCP endpoint at /mcp. These are intended for service-to-service use (monitoring, orchestration, client compatibility checks) and do not require an Authorization header.

Endpoint	Method	Description	Example response
`/health`	`GET`	Liveness probe. Returns `200 OK` with an empty body once the server is accepting requests.	(empty body)
`/info`	`GET`	Returns the MCP server version as JSON. Useful for verifying the deployed server version.	`{"version":"1.16.0"}`

These endpoints are not available when running with the Stdio transport.

Custom Certificates

If your SonarQube Server uses a self-signed certificate or a certificate from a private Certificate Authority (CA), you can add custom certificates to the container that will automatically be installed.

Using Volume Mount

Mount a directory containing your certificates when running the container:

docker run --init --pull=always -i --rm \
  -v /path/to/your/certificates/:/usr/local/share/ca-certificates/:ro \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_URL="<url>" \
  sonarsource/sonarqube-mcp

Supported Certificate Formats

The container supports the following certificate formats:

.crt files (PEM or DER encoded)
.pem files (PEM encoded)

MCP Configuration with Certificates

When using custom certificates, you can modify your MCP configuration to mount the certificates:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-v",
      "/path/to/your/certificates/:/usr/local/share/ca-certificates/:ro",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Note: Running the server from a JAR instead of the container? The volume mount above installs certificates into the container's OS trust store, which the server also reads. If you cannot use the OS trust store — notably on Windows, where it is not consulted — point the JVM at a Java truststore holding the CA certificate: -Djavax.net.ssl.trustStore=/path/to/truststore.p12 -Djavax.net.ssl.trustStoreType=PKCS12 -Djavax.net.ssl.trustStorePassword=<passphrase>. It is added on top of the default trusted certificates.

Proxy

The SonarQube MCP Server supports HTTP and SOCKS5 proxies through standard Java proxy system properties.

HTTP/HTTPS Proxy

You can configure proxy settings using Java system properties. These can be set as environment variables or passed as JVM arguments.

Common Proxy Properties:

Property	Description	Example
`http.proxyHost`	HTTP proxy hostname	`proxy.example.com`
`http.proxyPort`	HTTP proxy port	`8080`
`https.proxyHost`	HTTPS proxy hostname	`proxy.example.com`
`https.proxyPort`	HTTPS proxy port	`8443`
`http.nonProxyHosts`	Hosts that bypass the proxy (pipe-separated)	`localhost\|127.0.0.1\|*.internal.com`

HTTP/HTTPS Proxy Authentication:

Property	Description	Example
`http.proxyUser`	HTTP proxy username	`myuser`
`http.proxyPassword`	HTTP proxy password	`mypassword`
`https.proxyUser`	HTTPS proxy username	`myuser`
`https.proxyPassword`	HTTPS proxy password	`mypassword`

SOCKS5 Proxy

SOCKS5 proxies are supported.

Property	Description	Default	Example
`socksProxyHost`	SOCKS5 proxy hostname	—	`localhost`
`socksProxyPort`	SOCKS5 proxy port	`1080`	`1080`
`java.net.socks.username`	SOCKS5 username (if auth required)	—	`myuser`
`java.net.socks.password`	SOCKS5 password (if auth required)	—	`mypassword`

Client Certificate (Mutual TLS)

If your SonarQube Server requires clients to present a certificate during the TLS handshake (mutual TLS), you can provide a PKCS12 keystore by mounting it into the container and passing its location via JAVA_OPTS.

Using a PKCS12 keystore

Mount your .p12 or .pfx file into the container and set the JAVA_OPTS environment variable with the keystore properties:

docker run --init --pull=always -i --rm \
  -v /path/to/client.p12:/etc/ssl/mcp/client.p12:ro \
  -e JAVA_OPTS="-Djavax.net.ssl.keyStore=/etc/ssl/mcp/client.p12 -Djavax.net.ssl.keyStoreType=PKCS12 -Djavax.net.ssl.keyStorePassword=<passphrase>" \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_URL="<url>" \
  sonarsource/sonarqube-mcp

Note: The certificate file must be readable by the container process. Check and fix permissions if needed:
ls -la /path/to/client.p12       # look for -rw-r--r-- (644) or wider
chmod 644 /path/to/client.p12    # grant read access to the container user

Omit -Djavax.net.ssl.keyStorePassword if the keystore has no passphrase. Note that the passphrase used here would be visible through docker inspect or process list.

MCP Configuration with a Client Certificate

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run", "--init", "--pull=always", "-i", "--rm",
      "-v", "/path/to/client.p12:/etc/ssl/mcp/client.p12:ro",
      "-e", "JAVA_OPTS",
      "-e", "SONARQUBE_TOKEN",
      "-e", "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "JAVA_OPTS": "-Djavax.net.ssl.keyStore=/etc/ssl/mcp/client.p12 -Djavax.net.ssl.keyStoreType=PKCS12 -Djavax.net.ssl.keyStorePassword=<passphrase>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Using a PKCS12 keystore with a standalone JAR

When running the server from a JAR, pass the keystore properties as JVM arguments before -jar:

java \
  -Djavax.net.ssl.keyStore=/path/to/client.p12 \
  -Djavax.net.ssl.keyStoreType=PKCS12 \
  -Djavax.net.ssl.keyStorePassword=<passphrase> \
  -jar <path_to_sonarqube_mcp_server_jar>

Omit -Djavax.net.ssl.keyStorePassword if the keystore has no passphrase.

MCP Configuration with a Client Certificate (JAR)

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-Djavax.net.ssl.keyStore=/path/to/client.p12",
      "-Djavax.net.ssl.keyStoreType=PKCS12",
      "-Djavax.net.ssl.keyStorePassword=<passphrase>",
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Note: PEM certificate and key files (separate .crt/.key files) must be converted to PKCS12 format first. Use openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 to convert them.

Loading optional publisher installation details…

Capability

What it does

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Security & TestingCybersecuritySoftware & Technology

Representative uses

Code-quality and application-security investigation with optional controlled project operations.

Important limits

Teams outside the publisher ecosystem or without least-privilege credentials

Tools47 toolsView tools

Code Analysis, Issues & Security11 tools
Analyze code and work through the issues SonarQube finds. Prefer analyze_file_list or the current advanced analysis path; analyze_code_snippet is deprecated. Search or update issues and security hotspots, inspect dependency risks and duplication, and review evidence behind findings.
Coverage, Metrics & Quality Gates6 tools
Measure whether a project meets the team's quality expectations. Explore coverage, component measures, and available metrics, then inspect quality-gate status or definitions to understand why a build passes or fails.
Code Navigation & Architecture11 tools
Trace how code is structured and how changes propagate through it. Search by signature or body, inspect call flows, source, references and type hierarchies, and compare current architecture with intended rules or dependency guidance.
Projects, Branches & Source Context8 tools
Understand the project and source-control context around analysis results. Inspect languages, portfolios, projects, branches, pull requests, rules, raw source, and SCM metadata when a finding needs repository-level context.
System Administration & Webhooks8 tools
Operate the SonarQube instance itself and keep integrations healthy. Check system health, status, logs and configuration, toggle automatic analysis, and manage webhooks that connect SonarQube to external workflows.
Agentic Readiness3 tools
Assess whether a codebase is prepared for agent-assisted development workflows. Start readiness assessments, retrieve their results, and compare multiple assessments as the project improves.

View tool names (47)

analyze_code_snippet
analyze_file_list
run_advanced_code_analysis
search_dependency_risks
change_sonar_issue_status
search_sonar_issues_in_projects
search_security_hotspots
show_security_hotspot
change_security_hotspot_status
search_duplicated_files
get_duplications
search_files_by_coverage
get_file_coverage_details
get_component_measures
search_metrics
get_project_quality_gate_status
list_quality_gates
search_by_signature_patterns
search_by_body_patterns
get_upstream_call_flow
get_downstream_call_flow
get_source_code
get_type_hierarchy
get_references
get_current_architecture
get_intended_architecture
get_guidelines
check_dependency
list_languages
list_portfolios
search_my_sonarqube_projects
list_branches
list_pull_requests
show_rule
get_raw_source
get_scm_info
toggle_automatic_analysis
get_system_health
get_system_info
get_system_logs
ping_system
get_system_status
create_webhook
list_webhooks
start_agentic_readiness_assessment
get_agentic_readiness_assessment
list_agentic_readiness_assessments

Context Footprint

~9.4K estimated schema tokens

Context impact: High

Estimated token footprint of the MCP tool schemas exposed to the agent.

Approx. estimate

Whole-profile rough estimate only. Do not synthesize per-tool token values from this heuristic.

Read publisher documentation

Publisher documentation

Publisher README

Original product, capability, tool, and usage documentation from the MCP publisher. Installation sections appear under Install & Agents.

View original README ↗

SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Start with the quick setup, or learn more about the SonarQube product family.

Quick setup

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

Avoid hardcoding tokens in command-line arguments – they get saved in shell history
Use environment variables – set tokens in environment variables before running commands

When using configuration files:

Never commit tokens to version control
Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Some releases are also tagged with the SonarQube Server version they are aligned with, in the form <SQS major>.<SQS minor>.<patch> (e.g., sonarsource/sonarqube-mcp:2026.5.0), where the patch number is incremented for each MCP release targeting that SonarQube Server version. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:

Open the Agent Side Panel
Click the three dots (...) at the top right and select MCP Servers
Search for SonarQube and select Install
Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Alternatively, you can manually configure the server via mcp_config.json:

To connect with SonarQube Cloud:

In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

To connect with SonarQube Cloud:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

For SonarQube Cloud US, add --env SONARQUBE_URL=https://sonarqube.us to the command.

To connect with SonarQube Server:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcp

Manually edit the configuration file at ~/.codex/config.toml and add the following configuration:

To connect with SonarQube Cloud:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_USER_TOKEN>", "SONARQUBE_ORG" = "<YOUR_ORG>" }

For SonarQube Cloud US, add "SONARQUBE_URL" = "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

To connect with SonarQube Server:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_TOKEN>", "SONARQUBE_URL" = "<YOUR_SERVER_URL>" }

To connect with SonarQube Cloud:

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

To connect with SonarQube Server:

Note: The Gemini CLI extension has moved to the sonarqube-agent-plugins repository. Please install it from there going forward.

You can install our MCP server extension by using the following command:

gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins

You will need to set the required environment variables before starting Gemini:

Environment Variables Required:

For SonarQube Cloud:
- SONARQUBE_TOKEN - Your SonarQube Cloud token
- SONARQUBE_ORG - Your organization key
- SONARQUBE_URL - (Optional) Set to https://sonarqube.us for SonarQube Cloud US
For SonarQube Server:
- SONARQUBE_TOKEN - Your SonarQube Server USER token
- SONARQUBE_URL - Your SonarQube Server URL

Once installed, the extension will be installed under <home>/.gemini/extensions/sonarqube/gemini-extension.json.

After starting Copilot CLI, run the following command to add the SonarQube MCP server:

/mcp add

You will have to provide different information about the MCP server, you can use tab to navigate between fields.

To connect with SonarQube Cloud:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_ORG, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_TOKEN>,SONARQUBE_ORG=<YOUR_ORG>
Tools: *

For SonarQube Cloud US, add -e, SONARQUBE_URL to Arguments and SONARQUBE_URL=https://sonarqube.us to Environment Variables.

To connect with SonarQube Server:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_URL, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_USER_TOKEN>,SONARQUBE_URL=<YOUR_SERVER_URL>
Tools: *

The configuration file is located at ~/.copilot/mcp-config.json.

GitHub Copilot coding agent can leverage the SonarQube MCP server directly in your CI/CD.

To add the secrets to your Copilot environment, follow the Copilot documentation. Only secrets with names prefixed with COPILOT_MCP_ will be available to your MCP configuration.

In your GitHub repository, navigate under Settings -> Copilot -> Coding agent, and add the following configuration in the MCP configuration section:

To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_TOKEN",
        "SONARQUBE_ORG": "COPILOT_MCP_SONARQUBE_ORG"
      },
      "tools": ["*"]
    }
  }
}

For SonarQube Cloud US, add "-e", "SONARQUBE_URL" to the args array and "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL" to the env section, then set the secret COPILOT_MCP_SONARQUBE_URL=https://sonarqube.us.

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_USER_TOKEN",
        "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL"
      },
      "tools": ["*"]
    }
  }
}

Create a .kiro/settings/mcp.json file in your workspace directory (or edit if it already exists), add the following configuration:

To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

For SonarQube Cloud US, add "-e", "SONARQUBE_URL" to the args array and "SONARQUBE_URL": "https://sonarqube.us" to the env section.

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

You can use the following buttons to simplify the installation process within VS Code.

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

SonarQube MCP Server is available as a Windsurf plugin. Follow these instructions:

Open Windsurf Settings > Cascade > MCP Servers and select Open MCP Marketplace
Search for sonarqube on the Cascade MCP Marketplace
Choose the SonarQube MCP Server and select Install
Add the required SonarQube User token. Optionally add a default organization key for SonarQube Cloud, or add the SonarQube URL for SonarQube Server or Community Build.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Navigate to the Extensions view in Zed and search for SonarQube MCP Server. When installing the extension, you will be prompted to provide the necessary environment variables:

When using SonarQube Cloud:

{
  "sonarqube_token": "YOUR_SONARQUBE_TOKEN",
  "sonarqube_org": "SONARQUBE_ORGANIZATION_KEY",
  "docker_path": "DOCKER_PATH"
}

For SonarQube Cloud US, add "sonarqube_url": "https://sonarqube.us" to the configuration.

When using SonarQube Server:

{
  "sonarqube_token": "YOUR_SONARQUBE_USER_TOKEN",
  "sonarqube_url": "YOUR_SONARQUBE_SERVER_URL",
  "docker_path": "DOCKER_PATH"
}

The docker_path is the path to a docker executable. Examples:

Linux/macOS: /usr/bin/docker or /usr/local/bin/docker

Windows: C:\Program Files\Docker\Docker\resources\bin\docker.exe

💡 Tip: We recommend pulling the latest image regularly or before reporting issues to ensure you have the most up-to-date features and fixes.

Manual installation

You can manually install the SonarQube MCP server by copying the following snippet in the MCP servers configuration file:

To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Integration with SonarQube for IDE

The SonarQube MCP Server can integrate with SonarQube for IDE to further enhance your development workflow, providing better code analysis and insights directly within your IDE.

When using SonarQube for IDE, the SONARQUBE_IDE_PORT environment variable should be set with the correct port number. SonarQube for VS Code includes a Quick Install button, which automatically sets the correct port configuration.

For example, with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "-e",
      "SONARQUBE_IDE_PORT",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>",
      "SONARQUBE_IDE_PORT": "<64120-64130>"
    }
  }
}

When running the MCP server in a container on Linux, the container cannot access the SonarQube for IDE embedded server running on localhost. To allow the container to connect to the SonarQube for IDE server, add the --network=host option to your container run command.

Tools

Analysis

analyze_code_snippet - Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally filter results to a specific code snippet.

Deprecated: analyze_code_snippet will be removed in a future release. Connect SonarQube for IDE to use analyze_file_list, or enable Vortex analysis for your organization to use run_advanced_code_analysis (see below).

Usage:
- With workspace mounted (recommended): pass filePath (project-relative) — the server reads the file directly, keeping file content out of the agent context window
- Without workspace mount: pass complete fileContent for full file analysis (reports all issues)
- Add optional codeSnippet to filter results - only issues within the snippet will be reported (snippet location auto-detected)
Parameters:
- projectKey - The SonarQube project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). Used when the workspace is mounted at /app/mcp-workspace - String
- fileContent - Complete file content as a string. Required when workspace is not mounted - String
- codeSnippet - Code snippet to filter issues (must match content in fileContent) - String
- language - Language of the code (e.g., 'java', 'python', 'js', 'ts', 'tsx', 'jsx') - String
- scope - Scope of the file: MAIN or TEST (default: MAIN) - String
Supported Languages: Java, Kotlin, Python, Ruby, Go, JavaScript (js, jsx), TypeScript (ts, tsx), JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, Azure Resource Manager, Ansible, Docker, Secrets detection

When integration with SonarQube for IDE is enabled: (these two tools are tagged under both the analysis and ide toolsets)

analyze_file_list - Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.
- file_absolute_paths - List of absolute file paths to analyze - Required String[]
toggle_automatic_analysis - Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.
- enabled - Enable or disable the automatic analysis - Required Boolean

On SonarQube Server, stdio lists Vortex context tools and run_advanced_code_analysis when both the CAG and A3S hubs are entitled.

When Vortex analysis is available:

Requires having the workspace mounted at /app/mcp-workspace

run_advanced_code_analysis - Run Vortex analysis on a single file. On Cloud, use the optional organization argument when no organization is fixed by SONARQUBE_ORG; use list_organizations if ambiguous. SonarQube Server uses the nil UUID placeholder.
- organization - Cloud organization key; defaults to the configured or uniquely detected startup organization - Optional String
- projectKey - The key of the project - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Branch name used to retrieve the latest analysis context - Required String
- filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). - Required String
- fileScope - Defines in which scope the file originates from: 'MAIN' or 'TEST' (default: MAIN) - String

Coverage

search_files_by_coverage - Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements.
- projectKey - The project key to search in - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- maxCoverage - Maximum coverage threshold (0-100). Only return files with coverage <= this value - Number
- pageIndex - Page index (1-based, default: 1) - Number
- pageSize - Page size (default: 100, max: 500) - Number
get_file_coverage_details - Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps identify precisely where to add test coverage. Use after identifying files with low coverage via search_files_by_coverage.
- key - File key (e.g. my_project:src/foo/Bar.java) - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- from - First line to analyze (1-based, default: 1) - Number
- to - Last line to analyze (inclusive). If not specified, all lines are returned - Number

Dependency Risks

Note: Dependency risks are only available when connecting to SonarQube Server 2025.4 Enterprise or higher with SonarQube Advanced Security enabled.

search_dependency_risks - Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.
- projectKey - Project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- pageIndex - Optional page index (1-based, default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Enterprises

Note: Enterprises are only available when connecting to SonarQube Cloud.

list_enterprises - List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.
- enterpriseKey - Optional enterprise key to filter results - String

Issues

change_sonar_issue_status - Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.
- key - Issue key - Required String
- status - New issue's status - Required Enum {"accept", "falsepositive", "reopen"}
- comment - Optional comment explaining the status change - String
search_sonar_issues_in_projects - Search for SonarQube issues in my organization's projects.
- projectKeys - Optional list of SonarQube project keys - String[]
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- severities - Optional list of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER - String[]
- impactSoftwareQualities - Optional list of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY - String[]
- issueStatuses - Optional list of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED, IN_SANDBOX - String[]
- tags - Optional list of issue tags to filter by. Tags are lowercase - String[]
- inNewCodePeriod - Only return issues in the new code period. Requires exactly one entry across projectKeys and files - Boolean
- issueKey - Optional issue key to fetch a specific issue - String
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Security Hotspots

search_security_hotspots - Search for Security Hotspots in a SonarQube project.
- projectKey - Project or application key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- hotspotKeys - Comma-separated list of specific Security Hotspot keys to retrieve - String[]
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- files - Optional list of file paths to filter - String[]
- status - Optional status filter: TO_REVIEW, REVIEWED - String
- resolution - Optional resolution filter: FIXED, SAFE, ACKNOWLEDGED - String
- sinceLeakPeriod - Filter hotspots created since the leak period (new code) - Boolean
- onlyMine - Show only hotspots assigned to me - Boolean
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer
show_security_hotspot - Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.
- hotspotKey - Security Hotspot key - Required String
change_security_hotspot_status - Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).
- hotspotKey - Security Hotspot key - Required String
- status - New status - Required Enum {"TO_REVIEW", "REVIEWED"}
- resolution - Resolution when status is REVIEWED - Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}
- comment - Optional review comment - String

Languages

list_languages - List all programming languages supported in this SonarQube instance.
- q - Optional pattern to match language keys/names against - String

Measures

get_component_measures - Get SonarQube measures for a component (project, directory, file).
- projectKey - The project key - Required String when SONARQUBE_PROJECT_KEY is not configured
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- metricKeys - Optional metric keys to retrieve (e.g. ncloc, complexity, violations, coverage) - String[]
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String

Metrics

search_metrics - Search for SonarQube metrics.
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Portfolios

list_portfolios - List enterprise portfolios available in SonarQube with filtering and pagination options.

For SonarQube Server:
- q - Optional search query to filter portfolios by name or key - String
- favorite - If true, only returns favorite portfolios - Boolean
- pageIndex - Optional 1-based page number (default: 1) - Integer
- pageSize - Optional page size, max 500 (default: 100) - Integer
For SonarQube Cloud:
- enterpriseId - Enterprise uuid. Can be omitted only if 'favorite' parameter is supplied with value true - String
- q - Optional search query to filter portfolios by name - String
- favorite - Required to be true if 'enterpriseId' parameter is omitted. If true, only returns portfolios favorited by the logged-in user. Cannot be true when 'draft' is true - Boolean
- draft - If true, only returns drafts created by the logged-in user. Cannot be true when 'favorite' is true - Boolean
- pageIndex - Optional index of the page to fetch (default: 1) - Integer
- pageSize - Optional size of the page to fetch (default: 50) - Integer

Projects

list_organizations - List SonarQube Cloud organizations that a user is a member of, including keys, names, IDs, and UUIDs. Use a returned key as organization on subsequent tools.
search_my_sonarqube_projects - Find SonarQube projects. The response is paginated.
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 500) - Integer
- q - Optional search query to filter projects by name (partial match) or key (exact match) - String
list_branches - List analyzed branches for a project.
- SonarQube Cloud: returns long-lived (LONG) and short-lived (SHORT) branches with type and mergeBranch fields. Optional branchTypes filter: ALL (default), LONG, or SHORT.
- SonarQube Server: returns all analyzed branches (name, quality gate, analysis date). No type, mergeBranch, or branchTypes filter.
- Use returned branch names as the branch parameter on other tools. For pull request analysis, use list_pull_requests instead.
- projectKey - Project key (e.g. my_project) - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branchTypes - (SonarQube Cloud only) Optional filter: ALL (default), LONG, or SHORT - Enum {"ALL", "LONG", "SHORT"}
list_pull_requests - List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull request key/ID which can be used with other tools. For branch-based analysis without pull requests, use list_branches instead.
- projectKey - Project key (e.g. my_project) - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)

Quality Gates

get_project_quality_gate_status - Get the Quality Gate Status for the SonarQube project.
- analysisId - Optional analysis ID - String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- projectId - Optional project ID - String
- projectKey - Optional project key - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
list_quality_gates - List all quality gates in my SonarQube.

Rules

show_rule - Shows detailed information about a SonarQube rule.
- key - Rule key - Required String

Duplications

search_duplicated_files - Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications.
- projectKey - Project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- pageSize - Optional number of results per page for manual pagination (max: 500). If not specified, auto-fetches all duplicated files - Integer
- pageIndex - Optional page number for manual pagination (starts at 1). If not specified, auto-fetches all duplicated files - Integer
get_duplications - Get duplications for a file. Require Browse permission on file's project.
- key - File key - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String

Sources

get_raw_source - Get source code as raw text from SonarQube. Require 'See Source Code' permission on file.
- key - File key - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
get_scm_info - Get SCM information of SonarQube source files. Require See Source Code permission on file's project.
- key - File key - Required String
- commits_by_line - Group lines by SCM commit if value is false, else display commits for each line - String
- from - First line to return. Starts at 1 - Number
- to - Last line to return (inclusive) - Number

System

Note: System tools are only available when connecting to SonarQube Server.

get_system_health - Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational).
get_system_info - Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions.
get_system_logs - Get SonarQube Server system logs in plain-text format. Requires system administration permission.
- name - Optional name of the logs to get. Possible values: access, app, ce, deprecation, es, web. Default: app - String
ping_system - Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text.
get_system_status - Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DB_MIGRATION_NEEDED, DB_MIGRATION_RUNNING), version, and id.

Webhooks

create_webhook - Create a new webhook for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
- name - Webhook name - Required String
- url - Webhook URL - Required String
- projectKey - Optional project key for project-specific webhook - String
- secret - Optional webhook secret for securing the webhook payload - String
list_webhooks - List all webhooks for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
- projectKey - Optional project key to list project-specific webhooks - String

Context Augmentation

search_by_signature_patterns - Find code elements (classes, methods, interfaces, ...) by their declaration signatures using regex patterns.
- include_code_regex_list - List of regex patterns to match against signatures - Required String[]
- exclude_code_regex_list - List of regex patterns to exclude from results - String[]
- include_glob - File filter glob pattern (e.g., *.java) - String
- exclude_glob - File exclusion glob pattern - String
- fields - Comma-separated list of fields to include in the response - String
- limit - Maximum number of results to return (default: 10) - Integer
- regex_lists_operator - How to combine multiple patterns: OR (default) or AND - String
search_by_body_patterns - Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used.
- include_code_regex_list - List of regex patterns to match in code bodies - Required String[]
- exclude_code_regex_list - List of regex patterns to exclude from results - String[]
- include_glob - File filter glob pattern - String
- exclude_glob - File exclusion glob pattern - String
- fields - Comma-separated list of fields to include in the response - String
- limit - Maximum number of results to return (default: 10) - Integer
- regex_lists_operator - How to combine multiple patterns: OR (default) or AND - String
get_upstream_call_flow - Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes.
- fqn - Fully qualified name of the function - Required String
- depth - Call chain depth (0=function only, 1=direct callers, etc.) - Integer
- fields - Comma-separated list of fields to include in the response - String
get_downstream_call_flow - Trace what functions a given function calls. Useful for impact analysis and understanding execution flow.
- fqn - Fully qualified name of the function - Required String
- depth - Call chain depth (0=function only, 1=direct callees, etc.) - Integer
- fields - Comma-separated list of fields to include in the response - String
get_source_code - Get complete source code (signature and body) for a code element by its fully qualified name.
- fqn - Fully qualified name of the element - Required String
- fields - Comma-separated list of fields to include in the response - String
get_type_hierarchy - Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees and refactoring.
- fqn - Fully qualified name of the class-like structure - Required String
- fields - Comma-separated list of fields to include in the response - String
get_references - Get direct inbound and outbound code references for a class or module. Returns only direct (non-transitive) references.
- fqn - Fully qualified name of the class or module - Required String
- fields - Comma-separated list of fields to include in the response - String
get_current_architecture - Get a hierarchical architecture graph filtered by path prefix and depth. Useful for exploring module structure and high-level dependencies.
- depth - Hierarchy depth (0=root only, 1=root + children, etc.) - Required Integer
- path_prefix - Optional path prefix to filter nodes (e.g., com.example.service) - String
- ecosystem - Optional ecosystem to filter by (java, cs, py, js, ts) - String
get_intended_architecture - Get user-defined architectural constraints specifying which modules are allowed to depend on others.

get_guidelines - Get coding guidelines based on SonarQube project issues, catalog categories, or a combination of both.
- mode - Guidelines retrieval mode: project_based, category_based, or combined - Required String
- categories - List of category names (required for category_based and combined modes) - String[]
- languages - List of target languages in SonarQube repository key format (required when categories is provided) - String[]
- file_paths - Optional list of file paths to filter guidelines by - String[]

check_dependency - Check a third-party dependency for security vulnerabilities, supply-chain malware, and license compliance before adding or updating it.
- purl - Package URL (purl) with version, per purl-spec. Format: pkg:<type>/<namespace>/<name>@<version> (e.g. pkg:npm/lodash@4.17.21, pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1, pkg:pypi/django@3.2.0) - Required String

Variable	Description	Required	Default
`SONARQUBE_URL`	SonarQube Cloud URL	Yes	`https://sonarcloud.io`
`SONARQUBE_TOKEN`	Authentication token	Yes	None
`SONARQUBE_ORG`	Cloud organization; passed to the proxy from startup configuration or unique detection	No	None
`SONARQUBE_PROJECT_KEY`	Project key on SonarQube Cloud	Yes	None
`SONAR_SQ_BRANCH`	Explicit SonarQube branch override *	No	None
`SONARQUBE_DEBUG_ENABLED`	Activate debug logging (for troubleshooting)	No	False
`SONAR_LOG_LEVEL`	Logging verbosity (`TRACE`, `DEBUG`, `INFO`, `WARNING`, `ERROR`)	No	`INFO`

To be provided when not using git, or when the git branch name doesn't match the branch name in SonarQube.

First, export the SONARQUBE_TOKEN environment variable with a valid Personal Access Token (PAT) for your project.

# macOS/Linux (Bash/Zsh)
export SONARQUBE_TOKEN="{<YourUserToken>}"

Then, mount the project workspace to give the Context Augmentation server direct access to your source files:

{
  "mcpServers": {
    "sonarqube-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--pull=always",
        "-e", "SONARQUBE_URL",
        "-e", "SONARQUBE_TOKEN",
        "-e", "SONARQUBE_ORG",
        "-e", "SONARQUBE_PROJECT_KEY",
        "-e", "SONARQUBE_TOOLSETS",
        "-v", "/ABSOLUTE/PATH/TO/YOUR/PROJECT:/app/mcp-workspace:rw",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_URL": "https://sonarcloud.io",
        "SONARQUBE_ORG": "<YourOrganizationKey>",
        "SONARQUBE_PROJECT_KEY": "<YourProjectKey>",
        "SONARQUBE_TOOLSETS": "cag"
      }
    }
  }
}

Important: In a project-scoped config, do not put SONARQUBE_TOKEN in the env block. Export it as an environment variable (export SONARQUBE_TOKEN=...). Docker will forward it into the container via -e SONARQUBE_TOKEN.

Agentic Readiness

Note: Agentic Readiness tools are only available on SonarQube Cloud and require the feature to be enabled for your organization.

start_agentic_readiness_assessment - Start an agentic readiness assessment for a project. Returns immediately with status PENDING and an assessmentId. Use get_agentic_readiness_assessment to poll for results.
- projectKey - The project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Branch to assess. Omit to use the project's default branch - String
get_agentic_readiness_assessment - Retrieve the result of an assessment. Re-call with the same assessmentId until status is COMPLETED, FAILED, or INTERRUPTED. When completed, returns the overall level and a per-pillar breakdown with recommended actions and evidence.
- assessmentId - The assessment ID returned by start_agentic_readiness_assessment - Required String
list_agentic_readiness_assessments - List all assessments for a project, newest first. Use get_agentic_readiness_assessment for full pillar-level results.
- projectKey - The project key to list assessments for - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Filter assessments by branch name. Omit to list assessments for all branches - String
- pageIndex - 1-based page index (default: 1) - Number
- pageSize - Number of items per page, max 100 (default: 50) - Number

Example Prompts

Once you've set up the SonarQube MCP Server, here are some example prompts for common real-world scenarios:

My quality gate is failing for my project. Can you help me understand why and fix the most critical issues?

The quality gate on my feature branch is red. What do I need to fix to get it passing before I can merge to main?

I'm about to merge my pull request <#247> for the <web-app> project. Can you check if there are any quality issues I should address first?

We're deploying to production tomorrow. Can you check the quality gate status and alert me to any critical issues in this branch?

I want to reduce technical debt in my project. What are the top issues I should prioritize?

Our code coverage dropped below 70%. Can you identify which files have the lowest coverage and help me improve it?

I have 15 new code smells in my latest commit. Can you explain what they are and help me fix them?

SonarQube flagged a critical security vulnerability in <AuthController.java>. What's the issue and how do I fix it?

We need to pass a security audit. Can you check all our projects for security vulnerabilities and create a prioritized list of what needs to be fixed?

Are there any known vulnerabilities in our dependencies? Check this project for dependency risks.

I just wrote this authentication function. Can you analyze it for security issues and code quality problems before I commit?

Review the changes in <src/database/migrations> for any potential bugs or security issues.

Give me a health report for my project: quality gate status, number of bugs, Security Hotspots, and code coverage.

Compare code quality between our main branch and the develop branch. Are we introducing new issues?

What are the most common rule violations across all our projects? We might need to update our coding standards.

Show me all the issues that were marked as false positives in the last month. Are we seeing patterns that suggest our rules need adjustment?

Build

Prefer the sonarsource/sonarqube-mcp container image.

To run the server as a standalone JAR without Docker, download a pre-built release from the SonarSource binaries repository. Every released version is published there as sonarqube-mcp-server-<version>.jar (for example, sonarqube-mcp-server-1.19.0.2785.jar).

Download the JAR for the version you want from the binaries repository, then configure your MCP client to run it with Java 21 or later:

To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "STORAGE_PATH": "<path_to_your_mcp_storage>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "STORAGE_PATH": "<path_to_your_mcp_storage>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

SonarQube MCP Server requires a Java Development Kit (JDK) version 21 or later to build.

Run the following Gradle command to clean the project and build the application:

./gradlew clean build -x test

The JAR file will be created in build/libs/.

After adding or updating dependencies, regenerate the lock files:

./gradlew :dependencies --write-locks
./gradlew :its:dependencies --write-locks

Use the Run from JAR configuration above, pointing <path_to_sonarqube_mcp_server_jar> to the JAR in build/libs/.

Troubleshooting

Application logs are written to the STORAGE_PATH/logs/mcp.log file by default. To disable file logging entirely, set SONARQUBE_LOG_TO_FILE_DISABLED=true.

Common Issues

"SonarQube server version is not supported"

The MCP server checks the connected SonarQube Server version during startup. If the instance is older than 2025.1 (SQS) or 25.1 (SQCB), startup fails with:

SonarQube server version is not supported, minimal version is SQS 2025.1 or SQCB 25.1

Solution: Upgrade SonarQube Server to a supported release. This check applies only when connecting to SonarQube Server (SONARQUBE_URL without SONARQUBE_ORG), not to SonarQube Cloud.

"Feature is not working" or "Missing tools/functionality"

You may be running an outdated Docker image. Docker caches images locally, so you won't automatically receive updates.

Solution: Update to the latest version:

docker pull sonarsource/sonarqube-mcp

After pulling the latest image, restart your MCP client to use the updated version.

Optionally, add the --pull=always flag to your docker run command to always check for and pull the latest version:

docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

"I want to pin to a specific version"

Browse available tags at sonarsource/sonarqube-mcp and reference the version you want:

docker pull sonarsource/sonarqube-mcp:1.19.0.2785

docker run --init -i --rm \
  -e SONARQUBE_TOKEN -e SONARQUBE_ORG \
  sonarsource/sonarqube-mcp:1.19.0.2785

In your MCP client config, use sonarsource/sonarqube-mcp:<version> instead of sonarsource/sonarqube-mcp and remove --pull=always so Docker does not silently upgrade the image.

Data and telemetry

This server collects anonymous usage data and sends it to SonarSource to help improve the product. No source code or IP address is collected, and SonarSource does not share the data with anyone else. Collection of telemetry can be disabled with the following system property or environment variable: TELEMETRY_DISABLED=true. Click here to see a sample of the data that are collected.

License

Licensed under the SONAR Source-Available License v1.0. Using the SonarQube MCP Server in compliance with this documentation is a Non-Competitive Purpose and so is allowed under the SSAL.

Your use of SonarQube via MCP is governed by the SonarQube Cloud Terms of Service or SonarQube Server Terms and Conditions, including use of the Results Data solely for your internal software development purposes.

Loading optional publisher documentation…

FAQ

What can SonarQube MCP do?

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Can SonarQube MCP inspect issues, quality gates, and security findings?

Yes. The reviewed SonarQube MCP surface includes issue, quality-gate, and security-related inspection for projects visible to the connected SonarQube account.

Does SonarQube MCP work with Codex?

Yes. MCP100 reviewed an evidence-backed setup for Codex, but has not independently verified it with a live runtime test.

How does SonarQube MCP authenticate?

The server uses publisher-documented Sonar tokens or managed HTTP authentication.

What project or source-analysis data can an AI agent access?

Authorized service data and tool results pass through the MCP server to the connected AI client. Review the publisher and client data policies before using sensitive security & testing information.

Is this an official MCP?

ecosystem:sonarqube is listed as First-party MCP in MCP100’s current evidence.

Current official resources:

Publisher documentation ↗

SonarQube MCP Server

Start with the quick setup, or learn more about the SonarQube product family.

Quick setup

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

Avoid hardcoding tokens in command-line arguments – they get saved in shell history
Use environment variables – set tokens in environment variables before running commands

When using configuration files:

Never commit tokens to version control
Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:

Open the Agent Side Panel
Click the three dots (...) at the top right and select MCP Servers
Search for SonarQube and select Install
Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Alternatively, you can manually configure the server via mcp_config.json:

To connect with SonarQube Cloud:

In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

To connect with SonarQube Cloud:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

For SonarQube Cloud US, add --env SONARQUBE_URL=https://sonarqube.us to the command.

To connect with SonarQube Server:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcp

Manually edit the configuration file at ~/.codex/config.toml and add the following configuration:

To connect with SonarQube Cloud:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_USER_TOKEN>", "SONARQUBE_ORG" = "<YOUR_ORG>" }

For SonarQube Cloud US, add "SONARQUBE_URL" = "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

To connect with SonarQube Server:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_TOKEN>", "SONARQUBE_URL" = "<YOUR_SERVER_URL>" }

To connect with SonarQube Cloud:

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

To connect with SonarQube Server:

Note: The Gemini CLI extension has moved to the sonarqube-agent-plugins repository. Please install it from there going forward.

You can install our MCP server extension by using the following command:

gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins

You will need to set the required environment variables before starting Gemini:

Environment Variables Required:

For SonarQube Cloud:
- SONARQUBE_TOKEN - Your SonarQube Cloud token
- SONARQUBE_ORG - Your organization key
- SONARQUBE_URL - (Optional) Set to https://sonarqube.us for SonarQube Cloud US
For SonarQube Server:
- SONARQUBE_TOKEN - Your SonarQube Server USER token
- SONARQUBE_URL - Your SonarQube Server URL

Once installed, the extension will be installed under <home>/.gemini/extensions/sonarqube/gemini-extension.json.

After starting Copilot CLI, run the following command to add the SonarQube MCP server:

/mcp add

You will have to provide different information about the MCP server, you can use tab to navigate between fields.

To connect with SonarQube Cloud:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_ORG, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_TOKEN>,SONARQUBE_ORG=<YOUR_ORG>
Tools: *

For SonarQube Cloud US, add -e, SONARQUBE_URL to Arguments and SONARQUBE_URL=https://sonarqube.us to Environment Variables.

To connect with SonarQube Server:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_URL, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_USER_TOKEN>,SONARQUBE_URL=<YOUR_SERVER_URL>
Tools: *

The configuration file is located at ~/.copilot/mcp-config.json.

GitHub Copilot coding agent can leverage the SonarQube MCP server directly in your CI/CD.

To add the secrets to your Copilot environment, follow the Copilot documentation. Only secrets with names prefixed with COPILOT_MCP_ will be available to your MCP configuration.

In your GitHub repository, navigate under Settings -> Copilot -> Coding agent, and add the following configuration in the MCP configuration section:

To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_TOKEN",
        "SONARQUBE_ORG": "COPILOT_MCP_SONARQUBE_ORG"
      },
      "tools": ["*"]
    }
  }
}

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_USER_TOKEN",
        "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL"
      },
      "tools": ["*"]
    }
  }
}

Create a .kiro/settings/mcp.json file in your workspace directory (or edit if it already exists), add the following configuration:

To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

For SonarQube Cloud US, add "-e", "SONARQUBE_URL" to the args array and "SONARQUBE_URL": "https://sonarqube.us" to the env section.

To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

You can use the following buttons to simplify the installation process within VS Code.

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

SonarQube MCP Server is available as a Windsurf plugin. Follow these instructions:

Open Windsurf Settings > Cascade > MCP Servers and select Open MCP Marketplace
Search for sonarqube on the Cascade MCP Marketplace
Choose the SonarQube MCP Server and select Install
Add the required SonarQube User token. Optionally add a default organization key for SonarQube Cloud, or add the SonarQube URL for SonarQube Server or Community Build.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Navigate to the Extensions view in Zed and search for SonarQube MCP Server. When installing the extension, you will be prompted to provide the necessary environment variables:

When using SonarQube Cloud:

{
  "sonarqube_token": "YOUR_SONARQUBE_TOKEN",
  "sonarqube_org": "SONARQUBE_ORGANIZATION_KEY",
  "docker_path": "DOCKER_PATH"
}

For SonarQube Cloud US, add "sonarqube_url": "https://sonarqube.us" to the configuration.

When using SonarQube Server:

{
  "sonarqube_token": "YOUR_SONARQUBE_USER_TOKEN",
  "sonarqube_url": "YOUR_SONARQUBE_SERVER_URL",
  "docker_path": "DOCKER_PATH"
}

The docker_path is the path to a docker executable. Examples:

Linux/macOS: /usr/bin/docker or /usr/local/bin/docker

Windows: C:\Program Files\Docker\Docker\resources\bin\docker.exe

💡 Tip: We recommend pulling the latest image regularly or before reporting issues to ensure you have the most up-to-date features and fixes.

Manual installation

You can manually install the SonarQube MCP server by copying the following snippet in the MCP servers configuration file:

To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Integration with SonarQube for IDE

The SonarQube MCP Server can integrate with SonarQube for IDE to further enhance your development workflow, providing better code analysis and insights directly within your IDE.

For example, with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "-e",
      "SONARQUBE_IDE_PORT",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>",
      "SONARQUBE_IDE_PORT": "<64120-64130>"
    }
  }
}

When running the MCP server in a container on Linux, the container cannot access the SonarQube for IDE embedded server running on localhost. To allow the container to connect to the SonarQube for IDE server, add the --network=host option to your container run command.

Tools

Analysis

analyze_code_snippet - Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally filter results to a specific code snippet.

Deprecated: analyze_code_snippet will be removed in a future release. Connect SonarQube for IDE to use analyze_file_list, or enable Vortex analysis for your organization to use run_advanced_code_analysis (see below).

Usage:
- With workspace mounted (recommended): pass filePath (project-relative) — the server reads the file directly, keeping file content out of the agent context window
- Without workspace mount: pass complete fileContent for full file analysis (reports all issues)
- Add optional codeSnippet to filter results - only issues within the snippet will be reported (snippet location auto-detected)
Parameters:
- projectKey - The SonarQube project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). Used when the workspace is mounted at /app/mcp-workspace - String
- fileContent - Complete file content as a string. Required when workspace is not mounted - String
- codeSnippet - Code snippet to filter issues (must match content in fileContent) - String
- language - Language of the code (e.g., 'java', 'python', 'js', 'ts', 'tsx', 'jsx') - String
- scope - Scope of the file: MAIN or TEST (default: MAIN) - String
Supported Languages: Java, Kotlin, Python, Ruby, Go, JavaScript (js, jsx), TypeScript (ts, tsx), JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, Azure Resource Manager, Ansible, Docker, Secrets detection

When integration with SonarQube for IDE is enabled: (these two tools are tagged under both the analysis and ide toolsets)

analyze_file_list - Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.
- file_absolute_paths - List of absolute file paths to analyze - Required String[]
toggle_automatic_analysis - Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.
- enabled - Enable or disable the automatic analysis - Required Boolean

On SonarQube Server, stdio lists Vortex context tools and run_advanced_code_analysis when both the CAG and A3S hubs are entitled.

When Vortex analysis is available:

Requires having the workspace mounted at /app/mcp-workspace

run_advanced_code_analysis - Run Vortex analysis on a single file. On Cloud, use the optional organization argument when no organization is fixed by SONARQUBE_ORG; use list_organizations if ambiguous. SonarQube Server uses the nil UUID placeholder.
- organization - Cloud organization key; defaults to the configured or uniquely detected startup organization - Optional String
- projectKey - The key of the project - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Branch name used to retrieve the latest analysis context - Required String
- filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). - Required String
- fileScope - Defines in which scope the file originates from: 'MAIN' or 'TEST' (default: MAIN) - String

Coverage

search_files_by_coverage - Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements.
- projectKey - The project key to search in - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- maxCoverage - Maximum coverage threshold (0-100). Only return files with coverage <= this value - Number
- pageIndex - Page index (1-based, default: 1) - Number
- pageSize - Page size (default: 100, max: 500) - Number
get_file_coverage_details - Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps identify precisely where to add test coverage. Use after identifying files with low coverage via search_files_by_coverage.
- key - File key (e.g. my_project:src/foo/Bar.java) - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- from - First line to analyze (1-based, default: 1) - Number
- to - Last line to analyze (inclusive). If not specified, all lines are returned - Number

Dependency Risks

Note: Dependency risks are only available when connecting to SonarQube Server 2025.4 Enterprise or higher with SonarQube Advanced Security enabled.

search_dependency_risks - Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.
- projectKey - Project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- pageIndex - Optional page index (1-based, default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Enterprises

Note: Enterprises are only available when connecting to SonarQube Cloud.

list_enterprises - List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.
- enterpriseKey - Optional enterprise key to filter results - String

Issues

change_sonar_issue_status - Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.
- key - Issue key - Required String
- status - New issue's status - Required Enum {"accept", "falsepositive", "reopen"}
- comment - Optional comment explaining the status change - String
search_sonar_issues_in_projects - Search for SonarQube issues in my organization's projects.
- projectKeys - Optional list of SonarQube project keys - String[]
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- severities - Optional list of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER - String[]
- impactSoftwareQualities - Optional list of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY - String[]
- issueStatuses - Optional list of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED, IN_SANDBOX - String[]
- tags - Optional list of issue tags to filter by. Tags are lowercase - String[]
- inNewCodePeriod - Only return issues in the new code period. Requires exactly one entry across projectKeys and files - Boolean
- issueKey - Optional issue key to fetch a specific issue - String
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Security Hotspots

search_security_hotspots - Search for Security Hotspots in a SonarQube project.
- projectKey - Project or application key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- hotspotKeys - Comma-separated list of specific Security Hotspot keys to retrieve - String[]
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- files - Optional list of file paths to filter - String[]
- status - Optional status filter: TO_REVIEW, REVIEWED - String
- resolution - Optional resolution filter: FIXED, SAFE, ACKNOWLEDGED - String
- sinceLeakPeriod - Filter hotspots created since the leak period (new code) - Boolean
- onlyMine - Show only hotspots assigned to me - Boolean
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer
show_security_hotspot - Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.
- hotspotKey - Security Hotspot key - Required String
change_security_hotspot_status - Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).
- hotspotKey - Security Hotspot key - Required String
- status - New status - Required Enum {"TO_REVIEW", "REVIEWED"}
- resolution - Resolution when status is REVIEWED - Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}
- comment - Optional review comment - String

Languages

list_languages - List all programming languages supported in this SonarQube instance.
- q - Optional pattern to match language keys/names against - String

Measures

get_component_measures - Get SonarQube measures for a component (project, directory, file).
- projectKey - The project key - Required String when SONARQUBE_PROJECT_KEY is not configured
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- metricKeys - Optional metric keys to retrieve (e.g. ncloc, complexity, violations, coverage) - String[]
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String

Metrics

search_metrics - Search for SonarQube metrics.
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Portfolios

list_portfolios - List enterprise portfolios available in SonarQube with filtering and pagination options.

For SonarQube Server:
- q - Optional search query to filter portfolios by name or key - String
- favorite - If true, only returns favorite portfolios - Boolean
- pageIndex - Optional 1-based page number (default: 1) - Integer
- pageSize - Optional page size, max 500 (default: 100) - Integer
For SonarQube Cloud:
- enterpriseId - Enterprise uuid. Can be omitted only if 'favorite' parameter is supplied with value true - String
- q - Optional search query to filter portfolios by name - String
- favorite - Required to be true if 'enterpriseId' parameter is omitted. If true, only returns portfolios favorited by the logged-in user. Cannot be true when 'draft' is true - Boolean
- draft - If true, only returns drafts created by the logged-in user. Cannot be true when 'favorite' is true - Boolean
- pageIndex - Optional index of the page to fetch (default: 1) - Integer
- pageSize - Optional size of the page to fetch (default: 50) - Integer

Projects

list_organizations - List SonarQube Cloud organizations that a user is a member of, including keys, names, IDs, and UUIDs. Use a returned key as organization on subsequent tools.
search_my_sonarqube_projects - Find SonarQube projects. The response is paginated.
- pageIndex - Optional 1-based page index (default: 1) - Integer
- pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 500) - Integer
- q - Optional search query to filter projects by name (partial match) or key (exact match) - String
list_branches - List analyzed branches for a project.
- SonarQube Cloud: returns long-lived (LONG) and short-lived (SHORT) branches with type and mergeBranch fields. Optional branchTypes filter: ALL (default), LONG, or SHORT.
- SonarQube Server: returns all analyzed branches (name, quality gate, analysis date). No type, mergeBranch, or branchTypes filter.
- Use returned branch names as the branch parameter on other tools. For pull request analysis, use list_pull_requests instead.
- projectKey - Project key (e.g. my_project) - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branchTypes - (SonarQube Cloud only) Optional filter: ALL (default), LONG, or SHORT - Enum {"ALL", "LONG", "SHORT"}
list_pull_requests - List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull request key/ID which can be used with other tools. For branch-based analysis without pull requests, use list_branches instead.
- projectKey - Project key (e.g. my_project) - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)

Quality Gates

get_project_quality_gate_status - Get the Quality Gate Status for the SonarQube project.
- analysisId - Optional analysis ID - String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- projectId - Optional project ID - String
- projectKey - Optional project key - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
list_quality_gates - List all quality gates in my SonarQube.

Rules

show_rule - Shows detailed information about a SonarQube rule.
- key - Rule key - Required String

Duplications

search_duplicated_files - Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications.
- projectKey - Project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
- pageSize - Optional number of results per page for manual pagination (max: 500). If not specified, auto-fetches all duplicated files - Integer
- pageIndex - Optional page number for manual pagination (starts at 1). If not specified, auto-fetches all duplicated files - Integer
get_duplications - Get duplications for a file. Require Browse permission on file's project.
- key - File key - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String

Sources

get_raw_source - Get source code as raw text from SonarQube. Require 'See Source Code' permission on file.
- key - File key - Required String
- branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
- pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
get_scm_info - Get SCM information of SonarQube source files. Require See Source Code permission on file's project.
- key - File key - Required String
- commits_by_line - Group lines by SCM commit if value is false, else display commits for each line - String
- from - First line to return. Starts at 1 - Number
- to - Last line to return (inclusive) - Number

System

Note: System tools are only available when connecting to SonarQube Server.

get_system_health - Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational).
get_system_info - Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions.
get_system_logs - Get SonarQube Server system logs in plain-text format. Requires system administration permission.
- name - Optional name of the logs to get. Possible values: access, app, ce, deprecation, es, web. Default: app - String
ping_system - Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text.
get_system_status - Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DB_MIGRATION_NEEDED, DB_MIGRATION_RUNNING), version, and id.

Webhooks

create_webhook - Create a new webhook for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
- name - Webhook name - Required String
- url - Webhook URL - Required String
- projectKey - Optional project key for project-specific webhook - String
- secret - Optional webhook secret for securing the webhook payload - String
list_webhooks - List all webhooks for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
- projectKey - Optional project key to list project-specific webhooks - String

Context Augmentation

search_by_signature_patterns - Find code elements (classes, methods, interfaces, ...) by their declaration signatures using regex patterns.
- include_code_regex_list - List of regex patterns to match against signatures - Required String[]
- exclude_code_regex_list - List of regex patterns to exclude from results - String[]
- include_glob - File filter glob pattern (e.g., *.java) - String
- exclude_glob - File exclusion glob pattern - String
- fields - Comma-separated list of fields to include in the response - String
- limit - Maximum number of results to return (default: 10) - Integer
- regex_lists_operator - How to combine multiple patterns: OR (default) or AND - String
search_by_body_patterns - Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used.
- include_code_regex_list - List of regex patterns to match in code bodies - Required String[]
- exclude_code_regex_list - List of regex patterns to exclude from results - String[]
- include_glob - File filter glob pattern - String
- exclude_glob - File exclusion glob pattern - String
- fields - Comma-separated list of fields to include in the response - String
- limit - Maximum number of results to return (default: 10) - Integer
- regex_lists_operator - How to combine multiple patterns: OR (default) or AND - String
get_upstream_call_flow - Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes.
- fqn - Fully qualified name of the function - Required String
- depth - Call chain depth (0=function only, 1=direct callers, etc.) - Integer
- fields - Comma-separated list of fields to include in the response - String
get_downstream_call_flow - Trace what functions a given function calls. Useful for impact analysis and understanding execution flow.
- fqn - Fully qualified name of the function - Required String
- depth - Call chain depth (0=function only, 1=direct callees, etc.) - Integer
- fields - Comma-separated list of fields to include in the response - String
get_source_code - Get complete source code (signature and body) for a code element by its fully qualified name.
- fqn - Fully qualified name of the element - Required String
- fields - Comma-separated list of fields to include in the response - String
get_type_hierarchy - Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees and refactoring.
- fqn - Fully qualified name of the class-like structure - Required String
- fields - Comma-separated list of fields to include in the response - String
get_references - Get direct inbound and outbound code references for a class or module. Returns only direct (non-transitive) references.
- fqn - Fully qualified name of the class or module - Required String
- fields - Comma-separated list of fields to include in the response - String
get_current_architecture - Get a hierarchical architecture graph filtered by path prefix and depth. Useful for exploring module structure and high-level dependencies.
- depth - Hierarchy depth (0=root only, 1=root + children, etc.) - Required Integer
- path_prefix - Optional path prefix to filter nodes (e.g., com.example.service) - String
- ecosystem - Optional ecosystem to filter by (java, cs, py, js, ts) - String
get_intended_architecture - Get user-defined architectural constraints specifying which modules are allowed to depend on others.

get_guidelines - Get coding guidelines based on SonarQube project issues, catalog categories, or a combination of both.
- mode - Guidelines retrieval mode: project_based, category_based, or combined - Required String
- categories - List of category names (required for category_based and combined modes) - String[]
- languages - List of target languages in SonarQube repository key format (required when categories is provided) - String[]
- file_paths - Optional list of file paths to filter guidelines by - String[]

check_dependency - Check a third-party dependency for security vulnerabilities, supply-chain malware, and license compliance before adding or updating it.
- purl - Package URL (purl) with version, per purl-spec. Format: pkg:<type>/<namespace>/<name>@<version> (e.g. pkg:npm/lodash@4.17.21, pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1, pkg:pypi/django@3.2.0) - Required String

Variable	Description	Required	Default
`SONARQUBE_URL`	SonarQube Cloud URL	Yes	`https://sonarcloud.io`
`SONARQUBE_TOKEN`	Authentication token	Yes	None
`SONARQUBE_ORG`	Cloud organization; passed to the proxy from startup configuration or unique detection	No	None
`SONARQUBE_PROJECT_KEY`	Project key on SonarQube Cloud	Yes	None
`SONAR_SQ_BRANCH`	Explicit SonarQube branch override *	No	None
`SONARQUBE_DEBUG_ENABLED`	Activate debug logging (for troubleshooting)	No	False
`SONAR_LOG_LEVEL`	Logging verbosity (`TRACE`, `DEBUG`, `INFO`, `WARNING`, `ERROR`)	No	`INFO`

To be provided when not using git, or when the git branch name doesn't match the branch name in SonarQube.

First, export the SONARQUBE_TOKEN environment variable with a valid Personal Access Token (PAT) for your project.

# macOS/Linux (Bash/Zsh)
export SONARQUBE_TOKEN="{<YourUserToken>}"

Then, mount the project workspace to give the Context Augmentation server direct access to your source files:

{
  "mcpServers": {
    "sonarqube-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--pull=always",
        "-e", "SONARQUBE_URL",
        "-e", "SONARQUBE_TOKEN",
        "-e", "SONARQUBE_ORG",
        "-e", "SONARQUBE_PROJECT_KEY",
        "-e", "SONARQUBE_TOOLSETS",
        "-v", "/ABSOLUTE/PATH/TO/YOUR/PROJECT:/app/mcp-workspace:rw",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_URL": "https://sonarcloud.io",
        "SONARQUBE_ORG": "<YourOrganizationKey>",
        "SONARQUBE_PROJECT_KEY": "<YourProjectKey>",
        "SONARQUBE_TOOLSETS": "cag"
      }
    }
  }
}

Agentic Readiness

Note: Agentic Readiness tools are only available on SonarQube Cloud and require the feature to be enabled for your organization.

start_agentic_readiness_assessment - Start an agentic readiness assessment for a project. Returns immediately with status PENDING and an assessmentId. Use get_agentic_readiness_assessment to poll for results.
- projectKey - The project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Branch to assess. Omit to use the project's default branch - String
get_agentic_readiness_assessment - Retrieve the result of an assessment. Re-call with the same assessmentId until status is COMPLETED, FAILED, or INTERRUPTED. When completed, returns the overall level and a per-pillar breakdown with recommended actions and evidence.
- assessmentId - The assessment ID returned by start_agentic_readiness_assessment - Required String
list_agentic_readiness_assessments - List all assessments for a project, newest first. Use get_agentic_readiness_assessment for full pillar-level results.
- projectKey - The project key to list assessments for - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
- branch - Filter assessments by branch name. Omit to list assessments for all branches - String
- pageIndex - 1-based page index (default: 1) - Number
- pageSize - Number of items per page, max 100 (default: 50) - Number

Example Prompts

Once you've set up the SonarQube MCP Server, here are some example prompts for common real-world scenarios:

My quality gate is failing for my project. Can you help me understand why and fix the most critical issues?

The quality gate on my feature branch is red. What do I need to fix to get it passing before I can merge to main?

I'm about to merge my pull request <#247> for the <web-app> project. Can you check if there are any quality issues I should address first?

We're deploying to production tomorrow. Can you check the quality gate status and alert me to any critical issues in this branch?

I want to reduce technical debt in my project. What are the top issues I should prioritize?

Our code coverage dropped below 70%. Can you identify which files have the lowest coverage and help me improve it?

I have 15 new code smells in my latest commit. Can you explain what they are and help me fix them?

SonarQube flagged a critical security vulnerability in <AuthController.java>. What's the issue and how do I fix it?

We need to pass a security audit. Can you check all our projects for security vulnerabilities and create a prioritized list of what needs to be fixed?

Are there any known vulnerabilities in our dependencies? Check this project for dependency risks.

I just wrote this authentication function. Can you analyze it for security issues and code quality problems before I commit?

Review the changes in <src/database/migrations> for any potential bugs or security issues.

Give me a health report for my project: quality gate status, number of bugs, Security Hotspots, and code coverage.

Compare code quality between our main branch and the develop branch. Are we introducing new issues?

What are the most common rule violations across all our projects? We might need to update our coding standards.

Show me all the issues that were marked as false positives in the last month. Are we seeing patterns that suggest our rules need adjustment?

Build

Prefer the sonarsource/sonarqube-mcp container image.

Download the JAR for the version you want from the binaries repository, then configure your MCP client to run it with Java 21 or later:

To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "STORAGE_PATH": "<path_to_your_mcp_storage>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "STORAGE_PATH": "<path_to_your_mcp_storage>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

SonarQube MCP Server requires a Java Development Kit (JDK) version 21 or later to build.

Run the following Gradle command to clean the project and build the application:

./gradlew clean build -x test

The JAR file will be created in build/libs/.

After adding or updating dependencies, regenerate the lock files:

./gradlew :dependencies --write-locks
./gradlew :its:dependencies --write-locks

Use the Run from JAR configuration above, pointing <path_to_sonarqube_mcp_server_jar> to the JAR in build/libs/.

Troubleshooting

Application logs are written to the STORAGE_PATH/logs/mcp.log file by default. To disable file logging entirely, set SONARQUBE_LOG_TO_FILE_DISABLED=true.

Common Issues

"SonarQube server version is not supported"

The MCP server checks the connected SonarQube Server version during startup. If the instance is older than 2025.1 (SQS) or 25.1 (SQCB), startup fails with:

SonarQube server version is not supported, minimal version is SQS 2025.1 or SQCB 25.1

Solution: Upgrade SonarQube Server to a supported release. This check applies only when connecting to SonarQube Server (SONARQUBE_URL without SONARQUBE_ORG), not to SonarQube Cloud.

"Feature is not working" or "Missing tools/functionality"

You may be running an outdated Docker image. Docker caches images locally, so you won't automatically receive updates.

Solution: Update to the latest version:

docker pull sonarsource/sonarqube-mcp

After pulling the latest image, restart your MCP client to use the updated version.

Optionally, add the --pull=always flag to your docker run command to always check for and pull the latest version:

docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

"I want to pin to a specific version"

Browse available tags at sonarsource/sonarqube-mcp and reference the version you want:

docker pull sonarsource/sonarqube-mcp:1.19.0.2785

docker run --init -i --rm \
  -e SONARQUBE_TOKEN -e SONARQUBE_ORG \
  sonarsource/sonarqube-mcp:1.19.0.2785

In your MCP client config, use sonarsource/sonarqube-mcp:<version> instead of sonarsource/sonarqube-mcp and remove --pull=always so Docker does not silently upgrade the image.

Data and telemetry

License

Licensed under the SONAR Source-Available License v1.0. Using the SonarQube MCP Server in compliance with this documentation is a Non-Competitive Purpose and so is allowed under the SSAL.

Recommended for supervised code-quality investigation when project access is scoped and suggested remediations are validated through normal engineering review and CI.

Best for

Not ideal for

Avoid if

Trade-offs

Evidence

Popularity

Maintenance

Trust review

Sources

Install & Agents

Claude Code

Publisher installation details

Configuration

Base

Workspace Mount (Reducing Context Bloat)

Selective Tool Enablement

Examples

SonarQube Cloud

SonarQube Server

Transport Modes

1. Stdio (Default - Recommended for Local Development)

2. HTTP (Streamable HTTP)

3. HTTPS (Streamable HTTP over TLS) (Recommended for Multi-User Production Deployments)

Hosted SonarQube Cloud OAuth

Service Endpoints

Custom Certificates

Using Volume Mount

Supported Certificate Formats

MCP Configuration with Certificates

Proxy

HTTP/HTTPS Proxy

SOCKS5 Proxy

Client Certificate (Mutual TLS)

Using a PKCS12 keystore

MCP Configuration with a Client Certificate

Using a PKCS12 keystore with a standalone JAR

MCP Configuration with a Client Certificate (JAR)

What it does

Representative uses

Important limits

Context Footprint

Access & risk

Other options

semgrep

Sentry MCP

Cypress Cloud MCP

Publisher README

SonarQube MCP Server

Quick setup

🚀 Generate your configuration

Manual setup

Manual installation

Integration with SonarQube for IDE

Tools

Analysis

Coverage

Dependency Risks

Enterprises

Issues

Security Hotspots

Languages

Measures

Metrics

Portfolios

Projects

Quality Gates

Rules

Duplications

Sources

System

Webhooks

Context Augmentation

Agentic Readiness

Example Prompts

Build

Troubleshooting

Common Issues

"SonarQube server version is not supported"

"Feature is not working" or "Missing tools/functionality"