Skip to main content
Glama

sonar_run_scan

Scans a codebase with sonar-scanner, uploads results to SonarQube, and waits for analysis to finish; optionally uses npx when the scanner is not installed.

Instructions

用 sonar-scanner 扫描并上传到 SonarQube,等待分析完成。没装扫描器可 use_npx=true(首次会下载)。

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "path": "<path>"
    },
    "name": "sonar_run_scan"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathYes
use_npxNo
project_keyNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.2.0

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=false, so the write/network profile is covered. The description usefully adds that the call blocks until analysis completes and that npx mode downloads on first run, but it omits the authentication requirement and what happens on scan failure or timeout.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and followed by the one practical caveat. No padding, though the mixed-language phrasing is terse to the point of dropping needed detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and three undocumented parameters, the description should explain the required path meaning and what the call returns or blocks on. It covers the npx fallback and waiting behavior but leaves authentication, parameter roles, and failure behavior unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It only explains use_npx; the required 'path' parameter (presumably the directory to scan) and 'project_key' (which SonarQube project to upload to) are never clarified, leaving the required parameter's semantics implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource chain: run sonar-scanner, upload results to SonarQube, and wait for analysis. This is clearly distinct from siblings like sonar_check_connection or sonar_issues, though it does not explicitly contrast itself with code_quality_scan or full_quality_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives one conditional hint — use use_npx=true when the scanner is not installed, with first-use download noted. It does not say when to prefer this over code_quality_scan or full_quality_report, nor what prerequisites (server URL, token) must already exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.