Which integrations are available for this server?

Supports SonarCloud via the SONARQUBE_ORGANIZATION environment variable, allowing the same SonarQube tools to work with SonarCloud projects. Provides tools to interact with SonarQube, enabling AI agents to search projects, check quality gates, retrieve measures (bugs, smells, coverage, ratings), list issues, view security hotspots, explore rules, and view source code.

How do I use sonarqube-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@sonarqube-mcp list open issues sorted by severity" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

sonarqube-mcp

by metalralf

Overview Schema Source Related Servers Discussions Admin

JavaScript

Remote

sonarqube-mcp

An MCP server that exposes SonarQube data as AI agent tools. 43 tools — the most comprehensive SonarQube MCP implementation available. Covers projects, issues, quality gates, hotspots, coverage, SCM, webhooks, metrics history, worst-metric ranking, project introspection, and composite workflow tools.

Dogfooding: this project is checked via its own tools.

Works with any SonarQube edition — Cloud, Developer, Enterprise, and Community Edition on localhost. No Docker/JVM needed, starts in ~0.1s.

Quick start

Pin to a specific version: ["npx", "-y", "github:metalralf/sonarqube-mcp#1.7.0"]
Omit #1.7.0 for the latest (unstable) development version.

Minimum config (3 required env vars)

Claude Desktop / VS Code MCP / Cursor / any MCP client:

{
  "mcpServers": {
    "sonarqube": {
      "command": "npx",
      "args": ["-y", "github:metalralf/sonarqube-mcp#1.7.0"],
      "env": {
        "SONARQUBE_URL": "http://localhost:9000",
        "SONARQUBE_TOKEN": "squ_...",
        "SONARQUBE_PROJECT": "my_project"
      }
    }
  }
}

opencode (uses mcp key instead of mcpServers):

{
  "mcp": {
    "sonarqube": {
      "type": "local",
      "command": ["npx", "-y", "github:metalralf/sonarqube-mcp#1.7.0"],
      "enabled": true,
      "environment": {
        "SONARQUBE_URL": "http://localhost:9000",
        "SONARQUBE_TOKEN": "squ_...",
        "SONARQUBE_PROJECT": "my_project"
      }
    }
  }
}

Full config (all options)

{
  "mcpServers": {
    "sonarqube": {
      "command": "npx",
      "args": ["-y", "github:metalralf/sonarqube-mcp"],
      "env": {
        "SONARQUBE_URL": "http://localhost:9000",
        "SONARQUBE_TOKEN": "squ_...",
        "SONARQUBE_PROJECT": "my_project",
        "SONARQUBE_TOOLSETS": "issues,quality",
        "SONARQUBE_READ_ONLY": "false",
        "SONARQUBE_TRANSPORT": "stdio",
        "SONARQUBE_AUTH_SCHEME": "basic",
        "SONARQUBE_ORGANIZATION": "",
        "SONARQUBE_HTTP_HOST": "127.0.0.1",
        "SONARQUBE_HTTP_PORT": "8080",
        "SONARQUBE_HTTP_ALLOWED_ORIGINS": "*",
        "SONARQUBE_DISABLE_DOCKER": "false",
        "SONARQUBE_DOCKER_IMAGE": "sonarsource/sonar-scanner-cli",
        "SONARQUBE_DOCKER_FLAGS": "--network=host",
        "SONARQUBE_DOCKER_MOUNT_PATH": "/usr/src",
        "SONARQUBE_SCANNER_TIMEOUT": "300000",
        "SONARQUBE_API_TIMEOUT": "5000",
        "SONARQUBE_SOURCE_CONTEXT": "2"
      }
    }
  }
}

Related MCP server: sonarqube-mcp

Tools (43)

Composite / Workflow (8 tools)

Tool	Purpose
`sonar_project_report`	One-shot: QG + measures + issues + hotspots + worst files + branches
`sonar_analyze_and_report`	Analyze + build + full report in 1 call
`sonar_file_issues`	File-level issues + source context
`sonar_new_issues_since`	New issues since last analysis + project context
`sonar_fix_and_verify`	Fix → rebuild → re-analyze → verify issue resolved
`sonar_file_review`	One-call file review: issues + source + coverage + duplications
`sonar_scan_workflow`	Detect config → run analysis → project report (full happy path)
`sonar_call_multiple`	Batch-execute tools in linear order (capped at 25, consecutive-dedupe)

Discovery & Status (7 tools)

Tool	Purpose
`sonar_search_projects`	Discover all project keys
`sonar_project_details`	Deep-dive: name, description, URL, analysis date
`sonar_projects_create`	Create a new project via MCP
`sonar_analysis_status`	Full lifecycle check (reachable → exists → analyzed)
`sonar_summary`	One-call: QG + metrics + issues + branches
`sonar_ping`	Server health → `pong` + status
`sonar_raw`	Escape hatch with 4xx hints

Quality Gates & Measures (4 tools)

Tool	Purpose
`sonar_quality_gate`	Pass/fail + each failing condition
`sonar_list_quality_gates`	All gates with conditions
`sonar_measures`	Bugs, smells, coverage, ratings, ncloc, dup
`sonar_search_metrics`	Browse all 155 metric definitions

Issues (5 tools)

Tool	Purpose
`sonar_issues`	Full search with `compact`, `statuses`, `include_source`
`sonar_issues_summary`	Aggregated counts by severity/type/effort
`sonar_new_issues`	Zero-tolerance delta since last analysis
`sonar_set_issue_status`	confirm / falsepositive / wontfix / resolve
`sonar_issues_bulk_transition`	Transition many issues at once

Security Hotspots (3 tools)

Tool	Purpose
`sonar_hotspots`	Search with automatic token-type check
`sonar_hotspot_details`	Rule, code context, flows, comments
`sonar_change_hotspot_status`	REVIEWED with FIXED/SAFE/ACKNOWLEDGED

Source & SCM (3 tools)

Tool	Purpose
`sonar_source`	Source lines with optional `highlight_uncovered`
`sonar_scm_info`	Git blame per line (author, date, revision)
`sonar_rule`	Rule explanation with remediation

Branches & Pull Requests (2 tools)

Tool	Purpose
`sonar_list_branches`	Branches with dates and QG status
`sonar_list_pull_requests`	PR listing (requires Developer Edition+)

Coverage (2 tools)

Tool	Purpose
`sonar_coverage_files`	Files below coverage threshold
`sonar_file_coverage_details`	Per-file: line%, condition%, uncovered lines

Duplications (2 tools)

Tool	Purpose
`sonar_search_duplicated_files`	Files above duplication threshold
`sonar_duplications`	Duplicate blocks grouped by file

Analysis & Metrics (3 tools)

Tool	Purpose
`sonar_metrics_history`	Coverage/code-smell trend over time (1-365 days)
`sonar_worst_metrics`	Rank files by worst coverage, dup, complexity
`sonar_search_metrics`	Metric definitions with domain, type, direction

Administration (5 tools)

Tool	Purpose
`sonar_list_webhooks`	Verify CI/CD integration
`sonar_list_languages`	All 27 supported languages
`sonar_detect_project_config`	Inspect project dir → suggest sources/tests/exclusions/coverage/build-tool
`sonar_setup_scanner`	Auto-install sonar-scanner (pnpm/yarn/npm)
`sonar_run_analysis`	Full scan from the agent

Supported Languages

Analysis and detection for all major languages — including C# (which the official SonarQube MCP server's code analysis does not support).

Language	SQ key	Detection	Coverage
JavaScript	`js`	`package.json`, `.js/.jsx/.mjs/.cjs`	`lcov.info`
TypeScript	`ts`	`tsconfig.json`, `.ts/.tsx`	`lcov.info`
Python	`py`	`requirements.txt`, `setup.py`, `pyproject.toml`, `.py`	`coverage.xml`
Java	`java`	`pom.xml`, `build.gradle`, `.java`	`jacoco.xml`
Kotlin	`kotlin`	`pom.xml` (kotlin ref), `.kt/.kts`	`kover/report.xml`
Go	`go`	`go.mod`, `.go`	`coverage.out`
C#	`cs`	`.csproj`, `.sln`, `.cs`	`coverage.cobertura.xml`
PHP	`php`	`.php`	—
Ruby	`ruby`	`.rb`	—
Rust	`rust`	`.rs`	—
Swift	`swift`	`.swift`	—
Scala	`scala`	`.scala`	—
CSS	`css`	`.css/.scss/.less/.sass`	—
HTML	`web`	`.html/.htm`	—
Docker	`docker`	`Dockerfile`	—
Terraform	`terraform`	`.tf`	—
Kubernetes	`kubernetes`	`.yaml/.yml` (k8s)	—
CloudFormation	`cloudformation`	`.json` (CF)	—
XML / YAML / JSON / Shell / SQL	various	`.xml/.yaml/.json/.sh/.sql`	—

Configuration

Environment variables

All configuration is via env vars. None are required at module scope — they're read lazily at call time.

Connection

Env var	Default	Description
`SONARQUBE_URL`	`http://localhost:9000`	SonarQube server base URL
`SONARQUBE_TOKEN`	—	Auth token. Hotspots need `squ_` prefix
`SONARQUBE_PROJECT`	—	Default project key for tools that accept `projectKey`
`SONARQUBE_ORGANIZATION`	—	SonarCloud organization key
`SONARQUBE_AUTH_SCHEME`	`basic`	`basic` (Base64 password) or `bearer` (raw token)

Transport

Env var	Default	Description
`SONARQUBE_TRANSPORT`	`stdio`	`stdio` (MCP stdio) or `http` (REST API)
`SONARQUBE_HTTP_HOST`	`127.0.0.1`	HTTP bind address (transport=http only)
`SONARQUBE_HTTP_PORT`	`8080`	HTTP port (transport=http only)

Scanner

Env var	Default	Description
`SONARQUBE_DISABLE_DOCKER`	`false`	`true` forces local npm/node scanner
`SONARQUBE_DOCKER_IMAGE`	`sonarsource/sonar-scanner-cli`	Scanner Docker image (air-gapped registries)
`SONARQUBE_DOCKER_FLAGS`	`--network=host`	Extra Docker run flags. Set `""` for none
`SONARQUBE_SCANNER_TIMEOUT`	`300000`	Scanner timeout in ms
`SONARQUBE_API_TIMEOUT`	`5000`	Health check fetch timeout in ms
`SONARQUBE_SOURCE_CONTEXT`	`2`	Lines of source context around issues
`SONARQUBE_LOG_LEVEL`	`info`	Log verbosity: `debug`, `info`, `warn`, `error`
`SONARQUBE_DOCKER_MOUNT_PATH`	`/usr/src`	Container mount target for project dir

Toolset

Env var	Default	Description
`SONARQUBE_TOOLSETS`	all	Comma-separated categories: `projects,issues,hotspots,quality,coverage,duplications,history,worst,scm,branches,admin,rules,raw,composite`
`SONARQUBE_READ_ONLY`	`false`	`true` disables `sonar_set_issue_status`, `sonar_change_hotspot_status`, `sonar_run_analysis`, `sonar_setup_scanner`

Toolset filtering

Category	Tools included
`projects`	`search_projects`, `summary`, `analysis_status`, `project_details`, `projects_create`
`issues`	`issues`, `issues_summary`, `new_issues`, `set_issue_status`, `issues_bulk_transition`
`hotspots`	`hotspots`, `hotspot_details`, `change_hotspot_status`
`quality`	`quality_gate`, `list_quality_gates`, `measures`, `search_metrics`
`coverage`	`coverage_files`, `file_coverage_details`
`duplications`	`search_duplicated_files`, `duplications`
`history`	`metrics_history`
`worst`	`worst_metrics`
`scm`	`source`, `scm_info`
`branches`	`list_branches`, `list_pull_requests`
`admin`	`list_webhooks`, `list_languages`, `ping`, `setup_scanner`, `run_analysis`
`rules`	`rule`
`raw`	`raw`
`composite`	`project_report`, `analyze_and_report`, `file_issues`, `new_issues_since`, `fix_and_verify`

"environment": { "SONARQUBE_TOOLSETS": "issues,quality" }

Read-only mode

SONARQUBE_READ_ONLY=true disables: sonar_set_issue_status, sonar_change_hotspot_status, sonar_run_analysis, sonar_setup_scanner.

HTTP transport

Set SONARQUBE_TRANSPORT=http for REST API access:

"environment": { "SONARQUBE_TRANSPORT": "http", "SONARQUBE_HTTP_PORT": "8080" }

Endpoint	Method	Description
`/health`	GET	Health check
`/tools`	GET	List tools
`/tools/:name`	POST	Execute a tool

curl -X POST http://localhost:8080/tools/sonar_ping -H 'Content-Type: application/json' -d '{}'
curl -X POST http://localhost:8080/tools/sonar_issues -H 'Content-Type: application/json' -d '{"projectKey":"my_project","compact":true}'

Deployment

Docker Compose (quick start)

cp .env.example .env
# edit .env with your SonarQube credentials
docker compose up --build

The server runs at http://localhost:8080. Configure SONARQUBE_READ_ONLY=true for team deployments. Set SONARQUBE_HTTP_ALLOWED_ORIGINS for CORS-enabled web clients.

Kubernetes (Helm)

# With inline token
helm install sonarqube-mcp ./charts/sonarqube-mcp \
  --set sonarqubeUrl=http://sonarqube:9000 \
  --set sonarqubeToken=squ_...

# With an existing Secret
kubectl create secret generic sq-token --from-literal=SONARQUBE_TOKEN=squ_...
helm install sonarqube-mcp ./charts/sonarqube-mcp \
  --set sonarqubeUrl=http://sonarqube:9000 \
  --set existingSecret=sq-token

Docker build (manual)

docker build -t sonarqube-mcp .
docker run --rm -e SONARQUBE_URL=http://localhost:9000 -e SONARQUBE_TOKEN=squ_... sonarqube-mcp

Agent usage guidelines

sonar_analysis_status — check project state first
sonar_summary — full picture in one call
sonar_ping — quick health check
sonar_quality_gate — pass/fail + failing conditions
sonar_list_quality_gates — browse available gates
sonar_measures — drill into metrics
sonar_worst_metrics — find problematic files
sonar_list_branches / sonar_list_pull_requests — pick branch/PR
sonar_issues — search with filters, compact mode
sonar_issues_summary — quick counts
sonar_new_issues — delta since last analysis
sonar_metrics_history — coverage/code-smell trends
sonar_rule — explain any rule
sonar_source / sonar_scm_info — source + git blame
sonar_hotspots — security review
sonar_hotspot_details — drill into hotspot
sonar_change_hotspot_status — mark reviewed
sonar_coverage_files — find under-tested files
sonar_file_coverage_details — per-file coverage
sonar_search_duplicated_files / sonar_duplications — find/fix dup
sonar_issues_bulk_transition — batch status changes
sonar_set_issue_status — mark resolved
sonar_run_analysis — confirm fixes

Token types

Type	Prefix	Hotspots?
User token	`squ_`	✅
Project analysis	`sqp_`	❌ 403
Global analysis	`sqa_`	❌ 403

Local development setup

git clone <repo>
cd sonarqube-mcp
pnpm install

# Run from local checkout:
node src/index.mjs

Branch workflow

Branch	Purpose	Version
`main`	Stable releases	Tagged (`1.7.0`)
`develop`	Daily development	`1.x.0-dev`
`feature/*`	New tools/features	—

Version bumps

Change	Bump	Example
1-2 small tools, fixes	`patch`	`1.5.0` → `1.4.3`
3+ new tools, features	`minor`	`1.5.0` → `1.6.0`
Breaking changes	`major`	`1.5.0` → `2.0.0`

Setting up SonarQube locally

docker run -d --name sonarqube -p 9000:9000 sonarqube:community

Open http://localhost:9000, log in with admin/admin, generate a token.

Create sonar-project.properties:

sonar.host.url=http://localhost:9000
sonar.projectKey=my_project
sonar.sources=src
sonar.javascript.lcov.reportPaths=coverage/lcov.info

Run:

pnpm exec sonar-scanner -Dsonar.token=squ_...

Ecosystem Comparison

What makes this project unique

Features no other SonarQube MCP implementation has:

Compact mode — strips verbose fields for LLM token efficiency
Issue delta — sonar_new_issues since last analysis
Metric history / trends — coverage and code-smell trajectory
Worst-metric ranking — find files with worst coverage, highest duplication
Bulk issue transitions — transition many issues at once
Project creation — create SonarQube projects via MCP
Run scanner from agent — sonar_run_analysis without leaving the chat
Source coverage highlights — mark untested lines in source view
Aggregated summary — single-call project health
Array parameter support — pass severities/types as arrays or strings
Zero Docker, zero JVM — Node.js, starts in ~0.1s

vs Official mcp/sonarqube

Aspect	Official (SonarSource)	Ours
Runtime	Java + Docker (~500MB image)	Node.js (~0.1s start, no Docker)
Edition support	Cloud / Developer / Enterprise	All including Community
Distribution	Docker Hub	`npx` / GitHub
Unique to us	—	compact mode, delta issues, trend data, worst-metrics, bulk transitions, project creation, coverage highlights, array params
Unique to official	`analyze_code_snippet`, IDE integration, Context Augmentation	—

Choose official if you need inline code analysis, IDE integration, or run on Cloud/Enterprise. Choose ours if you're on Community Edition, want zero-overhead startup, or need the unique tools above.

Compatibility

Works with all SonarQube editions. sonar_list_pull_requests requires Developer Edition+.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityStale

ResponsivenessUnresponsive

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

mcp-serverOAuth
com.niftypm
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Project Management Communication File Systems
2
Backtest360 A
com.backtest360
MCP server exposing the Backtest360 engine API as tools for AI agents.
Finance Research & Data
202
SmartBear MCPOAuth
com.smartbear
MCP server for AI access to SmartBear tools, including BugSnag, Reflect, Swagger, PactFlow, QTM4J.
Monitoring Testing & QA Tools API Testing
144
Swagger MCPOAuth
com.smartbear
MCP server for AI access to Swagger by SmartBear.
API Testing Documentation Access Developer Tools
144

Related MCP Servers

SonarQube MCP Server
Monitoring Code Analysis Developer Tools
anggakawa
F
license
A
quality
D
maintenance
A read-only MCP server that provides AI assistants with structured access to SonarQube projects, issues, metrics, and rules. It enables safe analysis of code quality and security findings through a set of validated, safety-first tools.
Updated 7 months ago (2026-02-25 01:32 UTC)
6
-
sonarqube-mcp
Monitoring Code Analysis Developer Tools
mshegolev
A
license
A
quality
B
maintenance
An MCP server for SonarQube that enables LLM agents to discover projects, analyze code quality metrics, check Quality Gate status, search issues with filters, and rank projects by worst-performing metrics. It provides read-only, safe access to SonarQube instances with structured outputs and error handling.
Updated a month ago (2026-08-12 15:34 UTC)
5
51 PyPI
MIT
sonarqube-api-mcp
Code Analysis Testing & QA Tools Developer Tools
yasojha
A
license
B
quality
D
maintenance
Read-only MCP server that exposes SonarQube Web API tools for issue retrieval, quality gate status, and source context, enabling coding agents to fix code issues.
Updated 5 months ago (2026-04-27 21:04 UTC)
8
96 npm
1
MIT
sonar-mcp
Code Analysis Testing & QA Tools
wadew
A
license
A
quality
D
maintenance
A Model Context Protocol (MCP) server for interacting with SonarQube code quality platform.
Updated 8 months ago (2026-01-11 00:11 UTC)
3
1
MIT

sonarqube-mcp

Quick start

Minimum config (3 required env vars)

Full config (all options)

Tools (43)

Composite / Workflow (8 tools)

Discovery & Status (7 tools)

Quality Gates & Measures (4 tools)

Issues (5 tools)

Security Hotspots (3 tools)

Source & SCM (3 tools)

Branches & Pull Requests (2 tools)

Coverage (2 tools)

Duplications (2 tools)

Analysis & Metrics (3 tools)

Administration (5 tools)

Supported Languages

Configuration

Environment variables

Connection

Transport

Scanner

Toolset

Toolset filtering

Read-only mode

HTTP transport

Deployment

Docker Compose (quick start)

Kubernetes (Helm)

Docker build (manual)

Agent usage guidelines

Token types

Local development setup

Branch workflow

Version bumps

Setting up SonarQube locally

Ecosystem Comparison

What makes this project unique

vs Official mcp/sonarqube

Compatibility

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

SonarQube MCP Server

sonarqube-mcp

sonarqube-api-mcp

sonar-mcp