Reading issues is the easy half. Being able to accept one, mark another a false positive, and resolve a security hotspot with the right resolution is what lets a triage session finish inside the conversation.
The vendor's MCP server for SonarQube, covering both the hosted Cloud and self-run Server, with toolsets that can be switched on and off so only the surface you need is advertised.
- Issues: `search_sonar_issues_in_projects` and `change_sonar_issue_status` to accept, mark false positive, or reopen
- Security hotspots: `search_security_hotspots`, `show_security_hotspot` with rule details, code context, flows and comments, and `change_security_hotspot_status` where marking as reviewed requires a resolution of FIXED, SAFE or ACKNOWLEDGED
- Coverage: `search_files_by_coverage` sorted worst-first, and `get_file_coverage_details` giving line-by-line information on exactly which lines are uncovered and which branches are only partly covered
- Analysis: `analyze_code_snippet` runs SonarQube analyzers over a file's content, and with SonarQube for IDE running, `analyze_file_list` and `toggle_automatic_analysis` drive the IDE's own analysis
- Projects and branches: `search_my_sonarqube_projects`, `list_branches` and `list_pull_requests`, which is how you get the pull request key that other tools take
- Quality gates and rules: `get_project_quality_gate_status`, `list_quality_gates` and `show_rule`
- Measures, metrics, languages, portfolios, duplications with `search_duplicated_files` and `get_duplications`, sources via `get_raw_source` and `get_scm_info`, and dependency risks through `search_dependency_risks`
A SonarQube user token in `SONARQUBE_TOKEN`, plus `SONARQUBE_ORG` for Cloud or `SONARQUBE_URL` for Server. The container image `sonarsource/sonarqube-mcp` is the simplest route, and a configuration generator produces a ready-to-use client config. `STORAGE_PATH` is mandatory and points at a writable directory, provided automatically when using the container. Mounting your project at `/app/mcp-workspace` matters more than it sounds: with the mount, snippet analysis reads files from disk by relative path and the file content never passes through the agent's context. `SONARQUBE_PROJECT_KEY` sets a default project and removes that parameter from every tool schema. Only important toolsets are enabled by default; `SONARQUBE_TOOLSETS` narrows or widens that, with `projects` always enabled because other operations need project keys. `SONARQUBE_READ_ONLY=true` disables write operations such as changing an issue's status. Dependency risks require SonarQube Server 2025.4 Enterprise or higher with Advanced Security enabled, and enterprises are Cloud-only.
One command plus a key — docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp, then supply credentials