SonarQube MCP Server
SonarSource's official MCP server: quality and security issues, quality gates and code analysis from SonarQube Server and Cloud
- 675 ★ on the repository
- Last commit
Extended access
Why this level
- Uses a SonarQube token
- Can change issue statuses unless read-only mode is on
Install
- Works in
Manual install
claude mcp add sonarqube \
--env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
--env SONARQUBE_URL=$SONAR_URL \
-- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcpFor SonarQube Server. For Cloud pass SONARQUBE_ORG instead of SONARQUBE_URL.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Uses a SonarQube token
- Can change issue statuses unless read-only mode is on
This is third-party code. Review the repository files before installing.
What it does
The server connects an agent to SonarQube Server or SonarQube Cloud. The agent searches issues and changes their status, reviews security hotspots, checks quality gate status for projects and branches, and reads coverage, duplications, metrics and dependency risks. Code can be checked with Sonar analyzers straight from the agent context, and with SonarQube for IDE it can analyze project files. The check_dependency tool vets a third-party dependency for vulnerabilities, malware and license issues before you add it. Toolsets are configurable and there is a read-only mode.
Who it is for. For teams whose code quality already runs through SonarQube, and their developers who work with agents.
Good fit when
- You want the agent to fix issues SonarQube found in a branch or pull request
- You need to know whether a project passes its quality gate
- You need to vet a dependency before adding it
Not a fit when
- Your team has no SonarQube Server or SonarQube Cloud account
- You want a free open analyzer without a service token
Example request
Show the critical SonarQube issues in my pull request and fix themMCP
- Transport
- stdio, http
- Authentication
- API key
Environment variables
SONARQUBE_TOKENrequired, secret- SonarQube Cloud token or SonarQube Server user token
SONARQUBE_ORG- Organization key, required for SonarQube Cloud
SONARQUBE_URL- SonarQube Server URL, required for Server
SONARQUBE_TOOLSETS- Comma-separated list of enabled toolsets
SONARQUBE_READ_ONLY- true disables write operations
Limitations
Requires a SonarQube token: for Cloud with an organization key, for Server a user token and the server URL. Docker is the recommended way to run it. Some tools (Vortex, advanced analysis) need separate organization entitlements. Licensed under SSAL, which is source-available rather than open source. A self-hosted SonarQube Server needs no external services; SonarQube Cloud availability from Russia is unverified.
How to disable. Run claude mcp remove sonarqube or remove the sonarqube block from your client config, then revoke the token in SonarQube.
FAQ
How does the server tell Cloud from Server?
In stdio mode by SONARQUBE_ORG: if it is set, SonarQube Cloud is used; otherwise SonarQube Server at SONARQUBE_URL.
Can I stop the agent from changing issue statuses?
Yes, SONARQUBE_READ_ONLY=true disables all write operations, and SONARQUBE_TOOLSETS keeps only the tool groups you need.
Discussion
No questions or reviews yet.
Related
MCP serversThe official MCP server debugger: web UI, automation CLI and terminal UI in one package
Postman's official MCP server: workspaces, collections, specs and environments straight from your agent
METR
METR (MCP 1C:Enterprise Test Runner)
An MCP server that lets an agent update a 1C infobase, run YaXUnit tests and check syntax
An MCP server and manager for native 1C TestClient QA automation: BDD scenarios, managed-form checks, without a Vanessa Automation runtime
An MCP server that checks whether the agent is really done: drives the real app and returns pass, fail or couldn't tell with the file and line
An MCP server that spins up several browser agents to test a site for broken links, UI bugs and accessibility issues
README in short
The README opens with a config generator and ready setups for Claude Code, Codex, Cursor, GitHub Copilot, VS Code and other clients, all using the sonarsource/sonarqube-mcp Docker image. It then covers environment variables, toolset selection, read-only mode and stdio, HTTP and HTTPS transports for multi-user deployments. A large section lists tools by group, from analysis and issues to webhooks and portfolios.