SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs, code smells, and security vulnerabilities.
Security checks for apps built with AI: Trivy and Opengrep findings explained in plain English, with a fix request for your coding agent. Hosted scan by default (only files Git would commit, never secret files) or fully local.
5
63 PyPI
MIT
Why this server?
Provides read-only tools for inspecting a SonarQube instance: explains why a project's quality gate is red (listing failing conditions), searches unresolved issues filtered by severity, type, status, branch, pull request or new code, reads measures such as coverage and bugs, fetches source lines around an issue, and lists branches and accessible projects.
Enables read-only exploration of SonarQube projects, explaining why a quality gate is red and searching unresolved issues, reading metrics and source snippets around a finding. All six tools are idempotent and leave the SonarQube instance untouched.
6
MIT
Why this server?
Integrates with SonarQube for static application security testing (SAST), enabling automated code analysis and vulnerability detection.
An MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.
6
MIT
Why this server?
Offers specialized AI agent security analysis that complements traditional code quality tools like SonarQube with AI-specific vulnerability detection.
Security co-pilot for AI agents. Scans for vulnerabilities like prompt injection, infinite loops, and token bombing in AI Agents, audits MCP servers, verifies AGENTS.md governance, and generates EU AI Act compliance reports.
10
120 npm
3
Apache 2.0
Why this server?
Provides read-only tools for interacting with SonarQube instances, enabling discovery of projects, retrieval of quality metrics, Quality Gate status checks, issue search with filtering, and cross-project ranking by worst metric values.
An MCP server for SonarQube that enables LLM agents to discover projects, analyze code quality metrics, check Quality Gate status, search issues with filters, and rank projects by worst-performing metrics. It provides read-only, safe access to SonarQube instances with structured outputs and error handling.
5
201 PyPI
MIT
Why this server?
Provides read-only access to the SonarQube Web API, enabling issue retrieval, quality gate status checks, rule details, component measures, and source code context for project analysis.
Read-only MCP server that exposes SonarQube Web API tools for issue retrieval, quality gate status, and source context, enabling coding agents to fix code issues.
8
111 npm
1
MIT
Why this server?
Provides tools for interacting with SonarQube to list projects, retrieve project metrics, manage code quality issues, analyze security vulnerabilities, check quality gates, and view historical analysis trends.
