SonarQube MCP Server is a Model Context Protocol (MCP) server that connects a coding agent to SonarQube Server or SonarQube Cloud. The agent can search issues, security hotspots, coverage, duplications, measures, and quality-gate status for analyzed projects, and it can analyze a file or snippet with SonarQube analyzers from inside the conversation. Supported languages for local analysis include Java, Kotlin, Python, Ruby, Go, JavaScript, TypeScript, JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, Azure Resource Manager, Ansible, Docker, and secrets detection.
The server ships as a container image (any OCI runtime works) or a standalone JAR, with a hosted configuration generator that produces a config for the chosen client. Documented clients include Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI and coding agent, VS Code, Windsurf, and Zed. It speaks both MCP transports: stdio for local clients that launch it as a subprocess, and Streamable HTTP or HTTPS for remote, multi-user deployments, where the server is stateless and each request carries the user's own SonarQube token as a bearer header. Proxy, custom certificate, and mutual TLS settings cover corporate networks.
Tools are grouped into toolsets that can be enabled selectively to keep the agent's context small, and a read-only mode disables every write operation (such as changing an issue status). Mounting the project workspace lets the server read files directly instead of receiving their content through the agent, and unlocks Vortex analysis where the organization is entitled to it. A bridge to SonarQube for IDE adds file-list analysis and an automatic-analysis toggle.
Beyond analysis, a Context Augmentation toolset exposes code-graph queries (signature and body search, upstream and downstream call flow, type hierarchy, references, current and intended architecture), coding guidelines derived from a project's issues or a rule catalog, and a dependency check for vulnerabilities, supply-chain malware, and license compliance by package URL. On SonarQube Cloud, Agentic Readiness tools start and poll an assessment that returns an overall level with a per-pillar breakdown. The server collects anonymous usage telemetry, which can be disabled.
Features
- Code analysis in the agent loop: analyses a file or snippet with SonarQube analyzers across Java, Kotlin, Python, Ruby, Go, JavaScript, TypeScript, PHP, infrastructure-as-code formats, and secrets detection
- Issues and security hotspots: searches by project, branch, pull request, severity, software quality, status, and tag, and changes issue or hotspot status with a comment
- Quality signals: quality-gate status, component measures and metrics, files ranked by worst coverage with line-level detail, and duplicated files and blocks
- Project navigation: projects, branches, pull requests, portfolios, enterprises, raw source, SCM blame, languages, and rule details
- Context Augmentation: regex search over signatures and bodies, call-flow tracing in both directions, type hierarchies, references, and architecture graphs with user-defined dependency constraints
- Guidelines and dependency checks: coding guidelines from project issues or catalog categories, and a package-URL check for vulnerabilities, supply-chain malware, and license compliance
- Agentic Readiness (Cloud): starts, polls, and lists assessments that return an overall level with a per-pillar breakdown
- Two transports: stdio for local clients, Streamable HTTP or HTTPS (stateless, per-request bearer tokens) for remote and multi-user deployments, plus proxy, custom certificate, and mutual TLS support
- Toolsets and read-only mode: enable only the toolsets a session needs, and disable all write operations server-side or per request
- Workspace mount: the server reads project files directly so file content stays out of the agent context, and enables Vortex analysis for entitled organizations
- SonarQube for IDE bridge: analyses file lists through a running SonarQube for IDE instance and toggles its automatic analysis
- Wide client coverage: Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI and coding agent, VS Code, Windsurf, and Zed, with a hosted configuration generator
