SonarQube Code Quality & Security

sonarsource

Analyze code quality and security with SonarQube — search issues and hotspots, check quality gates, read measures, and analyze snippets — via the official SonarQube MCP server.

Installs: 573
Namespace: sonarsource
Version: >=1.0.0 <2.0.0
Last attach: reviewed1 months ago

Add to your mcp.json

{
  "mcpServers": {
    "sonarsource": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>"
      }
    }
  }
}

Open in VS CodeDon't have it? Install FrootAI for VS Code

Attach in a FrootAI play (fai-manifest)

mcp_scope:
  attached:
    - sonarsource

Authentication

api-token

generate a SonarQube user token; for SonarQube Cloud set SONARQUBE_TOKEN + SONARQUBE_ORG, for SonarQube Server set SONARQUBE_TOKEN + SONARQUBE_URL; add SONARQUBE_READ_ONLY=true for analysis-only access.

Required credential: SONARQUBE_TOKEN

Environment variables

Variable	Required	Auth mode	Description
SONARQUBE_TOKEN	yes	api-token	SonarQube user token (USER type for SonarQube Server). Authenticates all requests; pass via env, never inline in args (doctrine #6).
SONARQUBE_ORG	no	any	SonarQube Cloud organization key. Required for SonarQube Cloud; its presence selects Cloud over Server.
SONARQUBE_URL	no	any	SonarQube Server URL (required for Server), or a custom Cloud URL (e.g. https://sonarqube.us for Cloud US).
SONARQUBE_READ_ONLY	no	any	Set to `true` to enable read-only mode, disabling all write operations (e.g. changing issue status).
SONARQUBE_PROJECT_KEY	no	any	Optional default project key; when set, tools that need a project key use it automatically.

Sample tools

sonarsource.search_my_sonarqube_projects
Find SonarQube projects (paginated).
sonarsource.search_sonar_issues_in_projects
Search issues across projects with severity and quality filters.
sonarsource.analyze_code_snippet
Analyze file content with SonarQube analyzers for quality and security issues.
sonarsource.get_project_quality_gate_status
Get the Quality Gate status for a project.
sonarsource.search_security_hotspots
Search for Security Hotspots in a project.
sonarsource.get_component_measures
Get measures (ncloc, coverage, complexity, …) for a component.
sonarsource.list_quality_gates
List all quality gates in the SonarQube instance.

Destructive-action audit

No destructive tools — audited read-only

Destructive-action audit (X2.18): no tool matches destructive name patterns (destructive_tools is empty); write operations are gated behind SONARQUBE_READ_ONLY and the trust policy's allowDestructive:false.

Known limitations

Requires a SonarQube user token (SONARQUBE_TOKEN); for SonarQube Cloud also set SONARQUBE_ORG, for SonarQube Server set SONARQUBE_URL. Without valid credentials the tools return an auth error.
Distributed as a Docker image (sonarsource/sonarqube-mcp) — Docker (or another OCI runtime) must be installed and running; a standalone JAR is also published.
Tool availability depends on the connected edition and entitlements — dependency-risk, advanced-analysis, enterprise, and system tools require specific SonarQube Server/Cloud tiers; mount your project at /app/mcp-workspace to keep file content out of the agent context.
Mutating tools (change_sonar_issue_status, change_security_hotspot_status, create_webhook) exist — set SONARQUBE_READ_ONLY=true to disable all write operations.

Spec contributors

Maintainers who landed commits onmcp-specs/sonarsource.json.

pspsbali

Freshness

When this spec was last reviewed by a maintainer and last machine-validated against the live server.

Spec last reviewed: 1 months ago(2026-06-25)
Auto-validated: never