Skip to content
SonarQube MCP Server

SonarQube MCP Server

by SonarSource
Added to Onei
SONAR Source-Available License v1.0
Repository Docs
Developer Tools

Summary

Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.

Features

  • List and filter code-quality issues on a project or branch
  • Read the full rule description and remediation guidance behind a finding
  • Check quality-gate status for branches and pull requests
  • Inspect security hotspots and their review state
  • Works with SonarQube Cloud, Server and Community Build
  • Runs as a self-contained Docker image over stdio

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it, filling in the environment variables with your own values.
  3. Restart the agent — the "SonarQube MCP Server" tools will be available.
{
  "mcpServers": {
    "sonarqube-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

Description

SonarQube's MCP server puts static-analysis results where an agent can act on them. Once connected, an assistant can list the open issues on a project, read the rule behind each one, check whether a branch or pull request passes its quality gate, and inspect security hotspots — without a human copying findings out of the SonarQube UI into a chat window.

The interesting use is the loop it closes. A coding agent that has just written a change can ask SonarQube what the analysis says about it, read the rule description explaining why the pattern is flagged, and fix the finding in the same turn. Rule metadata matters here: SonarQube rules carry remediation guidance, so the agent gets the reasoning rather than just an error code.

It runs as a container (sonarsource/sonarqube-mcp) over stdio and works against SonarQube Cloud (including the US region), SonarQube Server, and SonarQube Community Build. Authentication is a SONARQUBE_TOKEN; Cloud additionally needs SONARQUBE_ORG, and self-hosted Server needs SONARQUBE_URL.

Worth knowing before you adopt it: the server is published by SonarSource under the SONAR Source-Available License v1.0, not a standard OSI open-source licence, so read the terms if you intend to redistribute or embed it. Docker is a hard prerequisite for the documented install path.

Related MCP Servers

MCP: Semgrep MCP

by Semgrep

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Developer Tools

MCP: JFrog MCP Server

by JFrog

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

Developer Tools
Browse all MCP servers →