Name: SonarQube
Author: SonarSource

LABSCO SUMMARY

Findings become work, because the agent can also change their status.

Reading issues is the easy half. Being able to accept one, mark another a false positive, and resolve a security hotspot with the right resolution is what lets a triage session finish inside the conversation.

What it is

The vendor's MCP server for SonarQube, covering both the hosted Cloud and self-run Server, with toolsets that can be switched on and off so only the surface you need is advertised.

What you get

Issues: search_sonar_issues_in_projects and change_sonar_issue_status to accept, mark false positive, or reopen
Security hotspots: search_security_hotspots, show_security_hotspot with rule details, code context, flows and comments, and change_security_hotspot_status where marking as reviewed requires a resolution of FIXED, SAFE or ACKNOWLEDGED
Coverage: search_files_by_coverage sorted worst-first, and get_file_coverage_details giving line-by-line information on exactly which lines are uncovered and which branches are only partly covered
Analysis: analyze_code_snippet runs SonarQube analyzers over a file's content, and with SonarQube for IDE running, analyze_file_list and toggle_automatic_analysis drive the IDE's own analysis
Projects and branches: search_my_sonarqube_projects, list_branches and list_pull_requests, which is how you get the pull request key that other tools take
Quality gates and rules: get_project_quality_gate_status, list_quality_gates and show_rule
Measures, metrics, languages, portfolios, duplications with search_duplicated_files and get_duplications, sources via get_raw_source and get_scm_info, and dependency risks through search_dependency_risks

Requirements

A SonarQube user token in SONARQUBE_TOKEN, plus SONARQUBE_ORG for Cloud or SONARQUBE_URL for Server. The container image sonarsource/sonarqube-mcp is the simplest route, and a configuration generator produces a ready-to-use client config. STORAGE_PATH is mandatory and points at a writable directory, provided automatically when using the container. Mounting your project at /app/mcp-workspace matters more than it sounds: with the mount, snippet analysis reads files from disk by relative path and the file content never passes through the agent's context. SONARQUBE_PROJECT_KEY sets a default project and removes that parameter from every tool schema. Only important toolsets are enabled by default; SONARQUBE_TOOLSETS narrows or widens that, with projects always enabled because other operations need project keys. SONARQUBE_READ_ONLY=true disables write operations such as changing an issue's status. Dependency risks require SonarQube Server 2025.4 Enterprise or higher with Advanced Security enabled, and enterprises are Cloud-only.

Setup effort

One command plus a key — docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

See installation options

USE CASES

Working through a project's issues

Search issues across your organization's projects, then set each one's status — accepted, false positive, or reopened — without switching to the web UI.

search_sonar_issues_in_projectschange_sonar_issue_status

Deciding where to add tests

Find the worst-covered files first, then get line-by-line detail on which lines are uncovered and which branches are only partly covered.

search_files_by_coverageget_file_coverage_details

Reviewing security hotspots properly

Read the rule, the code context, the flows and the comments before deciding, then record the review with an explicit resolution.

search_security_hotspotsshow_security_hotspotchange_security_hotspot_status

Checking code before it is committed

Analyse a file with the real analyzers; with the project mounted into the container, the content is read from disk rather than pushed through the agent's context.

analyze_code_snippetanalyze_file_list

Checking whether a change will pass the gate

Read the quality gate status for the project or a pull request, listing the pull requests first to get the key other tools need.

get_project_quality_gate_statuslist_pull_requestslist_branches

Keeping the tool surface and the permissions narrow

Enable only the toolsets you use, and set read-only mode so an agent can look at everything and change nothing.

48 tools

Listed in project docs. Your client may show a different list.

analyze_code_snippet

analyze_file_list

toggle_automatic_analysis

run_advanced_code_analysis

search_files_by_coverage

get_file_coverage_details

search_dependency_risks

list_enterprises

change_sonar_issue_status

search_sonar_issues_in_projects

search_security_hotspots

show_security_hotspot

change_security_hotspot_status

list_languages

get_component_measures

INSTALLATION

Connect your client

Server setup

TERMINAL

docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

MCP Clients

Antigravity, Cursor

JSON

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_SONARQUBE_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_SONARQUBE_ORG>"
      }
    }
  }
}

Claude Code

CLAUDE CODE · TERMINAL

claude mcp add sonarqube --env SONARQUBE_TOKEN=$SONAR_TOKEN --env SONARQUBE_ORG=$SONAR_ORG -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

The command reads your token and organization key from the shell variables SONAR_TOKEN and SONAR_ORG: set both first.

Codex

CODEX · TOML

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]

[mcp_servers.sonarqube.env]
SONARQUBE_TOKEN = "<YOUR_SONARQUBE_TOKEN>"
SONARQUBE_ORG = "<YOUR_SONARQUBE_ORG>"

Gemini CLI

GEMINI CLI · TERMINAL

gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins

GitHub Copilot

After starting Copilot CLI, run /mcp add to add the SonarQube MCP server

Complete the fields, using Tab to move between them — Server Name: sonarqube; Server Type: Local (press 1); Command: docker; Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_ORG, sonarsource/sonarqube-mcp; Environment Variables: SONARQUBE_TOKEN=<YOUR_SONARQUBE_TOKEN>,SONARQUBE_ORG=<YOUR_SONARQUBE_ORG>; Tools: *

The configuration is saved to ~/.copilot/mcp-config.json

Copilot coding agent

COPILOT CODING AGENT · JSON

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_TOKEN",
        "SONARQUBE_ORG": "COPILOT_MCP_SONARQUBE_ORG"
      },
      "tools": [
        "*"
      ]
    }
  }
}

Kiro

KIRO · JSON

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_SONARQUBE_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_SONARQUBE_ORG>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

VS Code

VS CODE · JSON

{
  "servers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "${input:SONARQUBE_TOKEN}",
        "SONARQUBE_ORG": "${input:SONARQUBE_ORG}"
      }
    }
  },
  "inputs": [
    {
      "id": "SONARQUBE_TOKEN",
      "type": "promptString",
      "description": "SonarQube Cloud Token",
      "password": true
    },
    {
      "id": "SONARQUBE_ORG",
      "type": "promptString",
      "description": "SonarQube Cloud Organization Key",
      "password": false
    }
  ]
}

Windsurf

Open Windsurf Settings > Cascade > MCP Servers and select Open MCP Marketplace

Search for sonarqube on the Cascade MCP Marketplace

Choose the SonarQube MCP Server and select Install

Add the required SonarQube User token. Then add the organization key if you want to connect with SonarQube Cloud, or the SonarQube URL if you want to connect to SonarQube Server or Community Build.

SonarQube

Findings become work, because the agent can also change their status.

What it is

What you get

Requirements

Setup effort

Working through a project's issues

Deciding where to add tests

Reviewing security hotspots properly

Checking code before it is committed

Checking whether a change will pass the gate

Keeping the tool surface and the permissions narrow

48 tools

What to know first

Tools you get

Requires

Optional

Connect your client

Server setup

MCP Clients

Antigravity, Cursor

Claude Code

Codex

Gemini CLI

GitHub Copilot

Copilot coding agent

Kiro

VS Code

Windsurf

SonarQube

Findings become work, because the agent can also change their status.

What it is

What you get

Requirements

Setup effort

Working through a project's issues

Deciding where to add tests

Reviewing security hotspots properly

Checking code before it is committed

Checking whether a change will pass the gate

Keeping the tool surface and the permissions narrow

48 tools

What to know first

Tools you get

Requires

Optional

Connect your client

Server setup

MCP Clients

Antigravity, Cursor

Claude Code

Codex

Gemini CLI

GitHub Copilot

Copilot coding agent

Kiro

VS Code

Windsurf

Same category

Tencent Cloud Code Analysis

VibeShift

Semgrep

MCP Kali Server