20 SonarQube MCP Server alternatives
SonarQube MCP Server: Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent. 20 MCP servers do similar work, most sharing Security, Official and Static Analysis, ranked by how much they have in common with SonarQube MCP Server.
-
by Semgrep
Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.
Also: Security, Static Analysis
-
by JFrog
JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.
-
by PortSwigger
PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.
-
by Doppler
Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.
-
by OpenAI
OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.
-
by HashiCorp
HashiCorp's official MCP server for Vault: manage secret engine mounts, read and write KV secrets, and drive the PKI engine — issuers, roles and certificates — from an agent.
-
by Bitwarden
Bitwarden's official MCP server — unlock the vault, read and edit items, generate passwords and TOTP codes, and run organisation administration. Local use only.
-
by Splunk
Splunk's own MCP server, hosted inside your Splunk deployment, letting agents write SPL from natural language and run searches under existing RBAC.
-
by Automox
Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.
-
by ESLint
The official ESLint MCP server, shipped inside the ESLint CLI - lets an editor agent lint files, read rule violations and apply fixes using your project's own configuration.
Also: Code Quality
-
by Red Hat
Red Hat's zero-dependency C++23 code-context engine — ranked call graphs and blast-radius analysis, indexing a repo in under half a second with no server and no database.
Also: Static Analysis
-
by HackerOne
Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.
Also: Security
-
by E2B
Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.
Also: Security
-
by duty1g
A native x64dbg plugin exposing 84 debugging tools and 22 event callbacks over HTTP, so an AI assistant can drive breakpoints, memory and disassembly directly.
Also: Security
-
by Aikido Security
Runs Aikido's code and secrets scan as a tool inside your coding agent, returning machine-readable findings the agent can triage, fix or ignore in place.
Also: Security
-
by mukul975
Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.
Also: Security
-
by Cloudsmith
Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.
Also: Security
-
by 1Password
1Password's official local MCP server for dev secrets: the agent manages Environments and .env mounts by name, and never sees a secret value.
Also: Security
-
by Okta
Okta's official open-source MCP server: manage users, groups, apps, policies and branding in your Okta org from an AI agent, with scope-gated tools and confirmation on destructive actions.
Also: Security
-
by Snyk
Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.
Also: Security
