SonarQube

Why use it

Key features

• Cloud: SONARQUBE_TOKEN plus SONARQUBE_ORG
• Server: SONARQUBE_TOKEN plus SONARQUBE_URL
• SONARQUBE_READ_ONLY=true disables write operations

Example replay

Illustrative saved transcript; historical tool calls and timings are not current API documentation or a live execution.

What it looks like in practice

Install

Claude Desktop / Cursor: SonarQube Cloud

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

SonarQube Server

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

Use a user token and a running Docker daemon. For Cloud US, also pass SONARQUBE_URL=https://sonarqube.us in env and the Docker -e arguments. Keep tokens out of version control; replace placeholders locally.

Client/version scope: Claude Desktop / Cursor. Other clients: pending verification.

Use Cases

Suggested prompts, not measured outcomes. Installation and listed tools were reviewed; these workflows were not executed.

Triage new SonarQube issues on a PR before review

List issues for project <key>, branch <pr-branch>, sinceLeakPeriod=true. Group by severity.

For each BLOCKER/CRITICAL, show the file:line and rule. Mark which look like real bugs vs noise.

For the real bugs, fetch the source snippet via the filesystem MCP and propose a minimal patch for each.

Generate a weekly quality-trend report across projects

List all projects with quality gate status. Flag any project that went from PASS to FAIL this week.

For each failing project, pull open security hotspots and new bugs from the last 7 days. Top 3 per project.

Produce a markdown report: section per project, table of new bugs/hotspots, coverage delta.

Review and triage security hotspots with context

List hotspots with status TO_REVIEW for project <key>. Group by rule (e.g. sql-injection, xss).

For each hotspot, fetch the source snippet (±10 lines). Judge whether it's a real risk or safe-by-context.

For 'safe' hotspots, propose a resolution comment. I'll review batches of 5 and approve; then we'll apply.

Pre-flight check: will this PR fail the quality gate?

Remind me to run `sonar-scanner` with branch=<pr-branch> locally. After it completes, I'll come back.

Get quality gate status for branch <pr-branch> in project <key>. Show each condition + actual vs threshold.

For each failing condition, list the top 5 contributing issues/files. Suggest one change per item.

Build a prioritized tech-debt backlog from Sonar data

For project <key>, pull open issues with effort (minutes) and severity. Exclude MINOR/INFO.

Group issues by (file, rule). Sum effort per group. Rank top 20 groups — these are the fix-once-fix-many opportunities.

For each of the top 10, create a Linear issue titled 'Refactor <file> to resolve N× <rule>' with estimated hours.

Combinations

Integration compatibility: pending verification. Treat these as suggested workflows.

For PR #342, pull Sonar new-code issues for that branch, summarize critical ones, post as a PR review comment.

Any project that flipped gate to FAIL today: create a P2 Linear issue assigned to the project lead.

Run the multi-project weekly quality digest; create a Notion page in 'Engineering / Quality / Weekly'.

Tools

Selected parameters checked against upstream definitions. Consult the connected server tools/list for your installed version.

• search_sonar_issues_in_projects

  projectKeys?: string[], branch?: string, pullRequest?: string, severities?: string[], issueStatuses?: string[], pageIndex?: integer, pageSize?: integer (1–500)

  Find project findings
• get_project_quality_gate_status

  projectKey?: string, projectId?: string, analysisId?: string, branch?: string, pullRequest?: string

  Inspect a project gate

Cost & Limits

api_quota: pending verification

per_call_tokens: pending verification

monetary: pending verification: see current upstream pricing and hosting requirements.

budget_tip: Limit requested data and inspect actual output before expanding queries.

Security

SONARQUBE_TOKEN is a user token; Cloud also uses SONARQUBE_ORG, Server uses SONARQUBE_URL.

The configured SonarQube service; complete network audit pending review.

Pending verification: project permissions depend on selected tools

Use SONARQUBE_READ_ONLY=true when only reading findings.

CVE status and a full security audit: pending verification.

Troubleshooting

Container or authentication failure

Check Docker, the official image, the user token, and the Cloud organization or Server URL.

Alternatives

Pending verification: alternative projects and tradeoffs have not been rechecked.

Official sources

Documentation checked 2026-10-08. No authenticated service was executed. Unchecked claims are marked pending verification.

• https://github.com/SonarSource/sonarqube-mcp-server — checked 2026-10-08

More

Resources

📖 Read the official README on GitHub

🐙 Browse open issues

🔍 Browse all 400+ MCP servers and Skills