Sonarqube MCP Server
SonarQube code quality data and security analysis within your AI agent.
Data last scanned yesterday · Reviewed 3 weeks ago
Overview
This server integrates SonarQube Server or SonarQube Cloud data directly into your development workflow. It allows AI agents to pull quality gate status and analysis findings, facilitating a tighter feedback loop between your codebase and your security scanning tools. It also supports analyzing code snippets directly inside the assistant's context.
Our verdict
This server carries a high-risk score of 48/100, primarily because it is community-maintained rather than official vendor software and lacks an editorially reviewed security audit for its authentication mechanisms and read-only operations. Users should exercise caution by strictly following the provided security guidelines, such as using environment variables to handle tokens rather than hardcoding them, to prevent potential exposure of sensitive credentials.
- Zero direct dependencies reduce potential supply-chain vulnerabilities.
- Active development with commits made within the last 24 hours.
- Provides a dedicated configuration generator tool for rapid setup.
- Supports both local SonarQube Server and SonarQube Cloud environments.
- License is currently set to NOASSERTION.
- Authentication methods have not undergone a formal security review.
- Operates as community-maintained code rather than an official product.
Tools
| Tool | Description | Risk |
|---|---|---|
| analyze_code_snippet | Analyze file content with SonarQube analyzers to identify code quality and security issues. | low |
| analyze_file_list | Analyze files in the current working directory using SonarQube for IDE. | low |
| toggle_automatic_analysis | Enable or disable SonarQube for IDE automatic analysis. | medium |
| run_advanced_code_analysis | Run Vortex analysis on SonarQube Cloud for a single file. | low |
| search_files_by_coverage | Search for files in a project sorted by coverage. | low |
| get_file_coverage_details | Get line-by-line coverage information for a specific file. | low |
| search_dependency_risks | Search for software composition analysis issues of a SonarQube project. | low |
| list_enterprises | List the enterprises available in SonarQube Cloud that you have access to. | low |
| change_sonar_issue_status | Change the status of a SonarQube issue to accept, falsepositive or to reopen an issue. | medium |
| search_sonar_issues_in_projects | Search for SonarQube issues in my organization's projects. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What is the recommended way to generate a configuration for this server?
The fastest way to get started is to use the SonarQube MCP Server Configuration Generator, which is an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.
›How should I handle my SonarQube token to ensure security?
You should avoid hardcoding your token in command-line arguments to prevent it from being saved in shell history. Instead, use environment variables for tokens and ensure they are never committed to version control.
›Which container runtimes are compatible with the SonarQube MCP server?
The server is distributed as a container image and is compatible with any OCI-compliant container runtime, such as Docker, Podman, or nerdctl.
›How do I connect the server to SonarQube Cloud US?
You must set the SONARQUBE_URL environment variable to https://sonarqube.us and ensure this variable is passed through the container arguments.
›Can I pin the server to a specific version?
Yes, you can replace the latest image tag with a specific version tag, such as sonarsource/sonarqube-mcp:1.19.0.2785, for reproducible deployments.
Changelog
- Fix1.24.0.3152
2026-08-04
- Fix1.23.0.3101
2026-07-20
- Security1.22.0.3040
2026-07-07
- Fix1.21.0.2975
2026-06-25
- Breaking1.20.0.2929
2026-06-23
- Fix1.19.0.2785
2026-05-28
- Fix1.18.1.2664
2026-05-11
- Fix1.18.0.2645
2026-05-04
- Fix1.17.0.2569
2026-04-27
- Improved1.16.0.2466
2026-04-13
Badge
Maintain this server? Add the live badge to your README.