SonarQube MCP Server
SonarSource's official MCP server: quality and security issues, quality gates and code analysis from SonarQube Server and Cloud
Install
claude mcp add sonarqube \
--env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
--env SONARQUBE_URL=$SONAR_URL \
-- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcpFor SonarQube Server. For Cloud pass SONARQUBE_ORG instead of SONARQUBE_URL.
This is third-party code. Review the repository files before installing.
What it does
The server connects an agent to SonarQube Server or SonarQube Cloud. The agent searches issues and changes their status, reviews security hotspots, checks quality gate status for projects and branches, and reads coverage, duplications, metrics and dependency risks. Code can be checked with Sonar analyzers straight from the agent context, and with SonarQube for IDE it can analyze project files. The check_dependency tool vets a third-party dependency for vulnerabilities, malware and license issues before you add it. Toolsets are configurable and there is a read-only mode.
Who it is for. For teams whose code quality already runs through SonarQube, and their developers who work with agents.
Good fit when
- You want the agent to fix issues SonarQube found in a branch or pull request
- You need to know whether a project passes its quality gate
- You need to vet a dependency before adding it
Not a fit when
- Your team has no SonarQube Server or SonarQube Cloud account
- You want a free open analyzer without a service token
Example request
Show the critical SonarQube issues in my pull request and fix themLimitations
Requires a SonarQube token: for Cloud with an organization key, for Server a user token and the server URL. Docker is the recommended way to run it. Some tools (Vortex, advanced analysis) need separate organization entitlements. Licensed under SSAL, which is source-available rather than open source. A self-hosted SonarQube Server needs no external services; SonarQube Cloud availability from Russia is unverified.
How to disable. Run claude mcp remove sonarqube or remove the sonarqube block from your client config, then revoke the token in SonarQube.
MCP
- Transport
- stdio, http
- Authentication
- API key
| Environment variables | |
|---|---|
| SONARQUBE_TOKEN required, secret | SonarQube Cloud token or SonarQube Server user token |
| SONARQUBE_ORG | Organization key, required for SonarQube Cloud |
| SONARQUBE_URL | SonarQube Server URL, required for Server |
| SONARQUBE_TOOLSETS | Comma-separated list of enabled toolsets |
| SONARQUBE_READ_ONLY | true disables write operations |
Security check
- Uses a SonarQube token
- Can change issue statuses unless read-only mode is on
README in short
The README opens with a config generator and ready setups for Claude Code, Codex, Cursor, GitHub Copilot, VS Code and other clients, all using the sonarsource/sonarqube-mcp Docker image. It then covers environment variables, toolset selection, read-only mode and stdio, HTTP and HTTPS transports for multi-user deployments. A large section lists tools by group, from analysis and issues to webhooks and portfolios.
FAQ
How does the server tell Cloud from Server?
In stdio mode by SONARQUBE_ORG: if it is set, SonarQube Cloud is used; otherwise SonarQube Server at SONARQUBE_URL.
Can I stop the agent from changing issue statuses?
Yes, SONARQUBE_READ_ONLY=true disables all write operations, and SONARQUBE_TOOLSETS keeps only the tool groups you need.
Related
Playwright CLI
playwright-cli
Microsoft's official Playwright CLI with an agent skill: drive a browser through short commands without heavy MCP schemas
The official MCP server debugger: web UI, automation CLI and terminal UI in one package
Open-source AI agent for pull request review: descriptions, feedback and improvement suggestions on GitHub, GitLab and more
A community Playwright MCP server: browser automation, screenshots, device emulation and test code generation