Skip to content
SonarQube MCP Server

SonarQube MCP Server

by SonarSource
SONAR Source-Available License v1.0
Repository Docs
Developer Tools
code-qualitystatic-analysissecuritysonarqubeofficial

Summary

Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.

Features

  • List and filter code-quality issues on a project or branch
  • Read the full rule description and remediation guidance behind a finding
  • Check quality-gate status for branches and pull requests
  • Inspect security hotspots and their review state
  • Works with SonarQube Cloud, Server and Community Build
  • Runs as a self-contained Docker image over stdio

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it, filling in the environment variables with your own values.
  3. Restart the agent — the "SonarQube MCP Server" tools will be available.
{
  "mcpServers": {
    "sonarqube-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

Description

SonarQube's MCP server puts static-analysis results where an agent can act on them. Once connected, an assistant can list the open issues on a project, read the rule behind each one, check whether a branch or pull request passes its quality gate, and inspect security hotspots — without a human copying findings out of the SonarQube UI into a chat window.

The interesting use is the loop it closes. A coding agent that has just written a change can ask SonarQube what the analysis says about it, read the rule description explaining why the pattern is flagged, and fix the finding in the same turn. Rule metadata matters here: SonarQube rules carry remediation guidance, so the agent gets the reasoning rather than just an error code.

It runs as a container (sonarsource/sonarqube-mcp) over stdio and works against SonarQube Cloud (including the US region), SonarQube Server, and SonarQube Community Build. Authentication is a SONARQUBE_TOKEN; Cloud additionally needs SONARQUBE_ORG, and self-hosted Server needs SONARQUBE_URL.

Worth knowing before you adopt it: the server is published by SonarSource under the SONAR Source-Available License v1.0, not a standard OSI open-source licence, so read the terms if you intend to redistribute or embed it. Docker is a hard prerequisite for the documented install path.

Related MCP Servers

MCP: Serena

by Oraios AI

New

Semantic code toolkit for coding agents — symbol-level search, editing and refactoring backed by language servers or the JetBrains platform.

Developer Tools

MCP: Hugging Face

by Hugging Face

New

Official Hugging Face MCP server: search models, datasets, Spaces and papers on the Hub, read repository files, and call Gradio apps as agent tools.

Developer ToolsWeb & Search

MCP: GitLab MCP Server

by GitLab

New

GitLab's own MCP server — issues, merge requests, CI/CD pipelines, job logs, wikis and semantic code search over an OAuth-authorised HTTP endpoint.

Developer Tools

MCP: Mobile MCP

by Mobile Next

New

Platform-agnostic MCP server that drives iOS and Android apps on simulators, emulators and real devices through the accessibility tree rather than screenshots.

Developer Tools
Browse all MCP servers →