SonarQube MCP

Why use it

Key features

• Cloud: SONARQUBE_TOKEN plus SONARQUBE_ORG
• Server: SONARQUBE_TOKEN plus SONARQUBE_URL
• SONARQUBE_READ_ONLY=true disables write operations

Example replay

Illustrative saved transcript; historical tool calls and timings are not current API documentation or a live execution.

What it looks like in practice

Install

Claude Desktop / Cursor: SonarQube Cloud

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

SonarQube Server

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

Use a user token and a running Docker daemon. For Cloud US, also pass SONARQUBE_URL=https://sonarqube.us in env and the Docker -e arguments. Keep tokens out of version control; replace placeholders locally.

Client/version scope: Claude Desktop / Cursor. Other clients: pending verification.

Use Cases

Suggested prompts, not measured outcomes. Installation and listed tools were reviewed; these workflows were not executed.

Batch-fix all issues for a single rule across the codebase

Use sonarqube-mcp. Top 5 rules by open-issue count in project 'foo'.

List every open issue for rule java:S2293 (Use Diamond Operator) — file, line, snippet.

For each, apply the rule's recommended fix. Keep changes minimal; don't reformat.

After my CI runs the next analysis, recheck the issue count for that rule.

Debug why a PR's quality gate is failing

Use sonarqube-mcp. Show quality gate status for PR 1234 — which conditions failed?

For 'New Coverage' below threshold — list new lines added in this PR with no test coverage.

Write tests covering those uncovered lines.

Review and resolve security hotspots

Use sonarqube-mcp. List all unreviewed security hotspots in project 'foo' grouped by category.

For each, summarize the risk in 1 line. Mark which are clearly safe-to-acknowledge vs need-fix.

For need-fix ones, apply the rule's safe pattern. For safe ones, give me the comment to leave on the hotspot review.

Combinations

Integration compatibility: pending verification. Treat these as suggested workflows.

On every PR, comment Sonar's gate result and any new issues it added.

Fix all java:S2293 instances; write the diffs locally for review before commit.

Tools

Selected parameters checked against upstream definitions. Consult the connected server tools/list for your installed version.

• search_sonar_issues_in_projects

  projectKeys?: string[], branch?: string, pullRequest?: string, severities?: string[], issueStatuses?: string[], pageIndex?: integer, pageSize?: integer (1–500)

  Find project findings
• get_project_quality_gate_status

  projectKey?: string, projectId?: string, analysisId?: string, branch?: string, pullRequest?: string

  Inspect a project gate

Cost & Limits

api_quota: pending verification

per_call_tokens: pending verification

monetary: pending verification: see current upstream pricing and hosting requirements.

budget_tip: Limit requested data and inspect actual output before expanding queries.

Security

SONARQUBE_TOKEN is a user token; Cloud also uses SONARQUBE_ORG, Server uses SONARQUBE_URL.

The configured SonarQube service; complete network audit pending review.

Pending verification: project permissions depend on selected tools

Use SONARQUBE_READ_ONLY=true when only reading findings.

CVE status and a full security audit: pending verification.

Troubleshooting

Container or authentication failure

Check Docker, the official image, the user token, and the Cloud organization or Server URL.

Alternatives

Pending verification: alternative projects and tradeoffs have not been rechecked.

Official sources

Documentation checked 2026-10-08. No authenticated service was executed. Unchecked claims are marked pending verification.

• https://github.com/SonarSource/sonarqube-mcp-server — checked 2026-10-08

More

Resources

📖 Read the official README on GitHub

🐙 Browse open issues

🔍 Browse all 400+ MCP servers and Skills