SonarQube agent plugins
A SonarQube plugin for agents: quality gate, issues and secrets scanning inside the edit loop of Claude Code, Codex and Cursor
- 114 ★ on the repository
- Last commit
Extended access
Why this level
- Hooks run on the agent's edits, scan for secrets and send analysis results to SonarQube.
- The `sonar integrate` command changes the agent configuration: the MCP server and hooks, and for Codex it is `~/.codex/config.toml`.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/sonarqube-agent-pluginsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Hooks run on the agent's edits, scan for secrets and send analysis results to SonarQube.
- The `sonar integrate` command changes the agent configuration: the MCP server and hooks, and for Codex it is `~/.codex/config.toml`.
This is third-party code. Review the repository files before installing.
What it does
The SonarQube plugin from Sonar gives an agent ten skills and a `sonarqube-reviewer` agent, while the MCP server and hooks come from the `sonar integrate <agent>` command of SonarQube CLI. Skills run as commands like `/sonarqube:sonar-quality-gate`, `/sonarqube:sonar-list-issues` and `/sonarqube:sonar-fix-issue java:S1481 src/main/java/MyClass.java`: they show projects, issues, test coverage, duplication and dependency risks. Hooks scan for secrets inside the edit loop. If Vortex analysis is enabled in the SonarQube Cloud organization, a check runs after every edit with no manual call. The reviewer folds the skills into one diff review and never edits the code itself.
Who it is for. Teams on SonarQube Cloud, Server or Community Build where agents write code and quality rules have to apply before CI.
Good fit when
- The agent's edit is done, and `/sonarqube:sonar-analyze src/auth/login.py` runs before the commit.
- A pull request is open, and the reviewer builds one report on the diff.
- A `python:S2077` issue hangs in the project, and the agent fixes it with `/sonarqube:sonar-fix-issue`.
- Secrets must not reach a commit, so hooks scan for them as edits happen.
- New vulnerabilities appeared in dependencies, and `/sonarqube:sonar-triage-dependency-risks` walks through them.
Not a fit when
- There is no SonarQube account: the plugin works with SonarQube Cloud, Server or Community Build.
- Docker, Podman and Nerdctl are not installed: the MCP server image runs in a container.
- The agent runs in Factory Droid: it has no secrets scanning or Vortex analysis hooks.
- You want analysis after every edit without configuring the organization: Vortex depends on its settings in SonarQube Cloud.
Example request
Check the quality gate status of my-project on the main branch and show the critical issues.Limitations
A SonarQube account, SonarQube CLI (`sonar`) and a container runtime for the MCP server image are required. Sign-in runs through `sonar auth login`, and credentials stay in the operating system keychain. Vortex analysis depends on the organization's settings in SonarQube Cloud. Claude Code also needs Node.js, which runs the SessionStart hook. The repository ships under the SSAL-1.0 license, and not every agent gets the full set of hooks.
How to disable. Remove the `sonarqube` plugin with the agent's own tools; in Claude Code that is the `/plugin` manager. Delete the hooks and MCP configuration created by `sonar integrate` from the agent settings by hand.
FAQ
How do I install the SonarQube plugin in Claude Code?
Run `/plugin install sonarqube@claude-plugins-official`, then `/sonarqube:sonar-integrate` to install the CLI, sign in and set up hooks. Sign-in runs through `sonar auth login`.
How do I connect the plugin to Codex?
Run `codex plugin marketplace add SonarSource/sonarqube-agent-plugins` and `codex plugin add sonarqube@sonar`, then `sonar auth login` and `sonar integrate codex`. The last command writes the MCP entry to `~/.codex/config.toml`.
What does the sonarqube-reviewer agent do?
It builds a diff or pull request review: quality gate, issues, dependency vulnerabilities, duplication and coverage. It does not edit code. Available in Claude Code, GitHub Copilot CLI and Cursor.
Which agents are supported?
Claude Code, GitHub Copilot CLI, Cursor, Codex, Antigravity, Devin, Pi, OpenCode, Kiro and Factory Droid. Not all of them get secrets hooks: Factory Droid has none.
What else is needed besides the plugin?
A SonarQube account, SonarQube CLI (`sonar`) and Docker, Podman or Nerdctl for the MCP server image. Sign-in runs through `sonar auth login`.
Discussion
No questions or reviews yet.
Related
PluginsSonarSource's official MCP server: quality and security issues, quality gates and code analysis from SonarQube Server and Cloud
A Claude Code and OpenCode plugin that will not let a session end until 1C edits pass standards, architecture and XML checks
A Claude Code plugin set: Figma visual regression, test and code review, project lore and session analysis as an HTML report
QA Agent for the GigaCode CLI: 14 roles and 6 skills for testing
QaAgentGigacodeCli
Requirements-based testing in GigaCode: from analysis and autotest review to a conclusion, with duplicate search before a bug is filed in Jira
CLI installs a verify-by-running harness into Claude Code and Codex: build and tests, diff review and a separate QA agent.
A Claude Code plugin that makes an agent check the code around a change and prove the work with a test and independent review
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| SonarQube agent plugins (this card) | no | 114 | ||
| SonarQube MCP Server | yes | API key | 686 | gives an agent MCP tools for SonarQube; the plugin adds skills, a reviewer and secrets-scanning hooks and wires in the same MCP server |
| Snyk CLI | yes | OAuth | 5,709 | checks code and dependencies with Snyk tooling; SonarQube agent plugins work with SonarQube projects and rules |
README in short
The project describes plugin installation for each of ten agents, sign-in setup through `sonar auth login` and `sonar integrate`, a skill list with example commands and the reviewer's role.