Skip to main content
Watch: I Built an AI App Without Leaving Databricks

CI/CD and testing - official SonarSource server

SonarQube MCP server

Connects AI coding agents to SonarQube Server or SonarQube Cloud code quality and security data: issues, quality gates, security hotspots, coverage, measures, dependency risks and code snippet analysis. Runs locally as a container or JAR (stdio or Streamable HTTP), or as a hosted server embedded in SonarQube Cloud. SonarSource hosts it at https://api.sonarcloud.io/mcp, or you can run docker.io/sonarsource/sonarqube-mcp (oci) locally with API key auth.

Last verified 15 tools8 sources

Install

Claude Code

About Claude Code
Terminal
claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

Codex

About Codex
TOML
[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_USER_TOKEN>", "SONARQUBE_ORG" = "<YOUR_ORG>" }

Generic

JSON
"sonarqube": {
  "type": "http",
  "url": "https://api.sonarcloud.io/mcp",
  "headers": {
    "Authorization": "Bearer <YourSonarQubeUserToken>",
    "SONARQUBE_ORG": "<YourSonarQubeOrganization>"
    // "SONARQUBE_READ_ONLY": "false" // Default value is true.
    // "SONARQUBE_TOOLSETS": "<YourOptionalToolset>" // Using this optional header refines the default toolsets.
  }
}

Tools

analyze_code_snippet
Analyze file content with SonarQube analyzers to identify code quality and security issues (deprecated, to be removed).
analyze_file_list
Analyze files in the current working directory using a running SonarQube for IDE instance.
run_advanced_code_analysis
Run Vortex analysis on a single file (requires workspace mount and Vortex entitlement).
search_sonar_issues_in_projects
Search for SonarQube issues in my organization's projects.
change_sonar_issue_status
Change the status of a SonarQube issue to accept, falsepositive or reopen.
search_security_hotspots
Search for Security Hotspots in a SonarQube project.
change_security_hotspot_status
Review a Security Hotspot by changing its status.
get_project_quality_gate_status
Get the Quality Gate Status for the SonarQube project.
search_files_by_coverage
Search for files in a project sorted by coverage, worst coverage first.
get_file_coverage_details
Get line-by-line coverage information for a specific file.
search_dependency_risks
Search for software composition analysis issues (dependency risks) of a SonarQube project.
get_component_measures
Get SonarQube measures for a component (project, directory, file).
search_my_sonarqube_projects
Find SonarQube projects.
show_rule
Shows detailed information about a SonarQube rule.
search_duplicated_files
Search for files with code duplications in a SonarQube project.

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • Source-available (SSAL), not OSI open source.
  • The hosted remote URL https://api.sonarcloud.io/mcp is for SonarQube Cloud (EU region); US-region organizations use https://api.sonarqube.us/mcp.
  • The Cloud-hosted server exposes a smaller fixed subset of tools, is read-only by default, and has no Sonar Vortex or SonarQube for IDE bridge tools.
  • A SonarQube Server-hosted option exists for SonarQube Server 2026.3+ (Developer, Enterprise, Data Center editions), installed as an extension by an admin.
  • Vortex tools need a Sonar Vortex subscription.
  • Dependency risk tools need SonarQube Server 2025.4 Enterprise+ with Advanced Security.
  • The Claude Code and Codex snippets are the SonarQube Cloud variants; the README also gives SonarQube Server variants that use SONARQUBE_URL.
  • Cursor and VS Code installs are documented only as deeplink buttons, and the VS Code buttons reference the mcp/sonarqube image.
  • Telemetry is on by default (TELEMETRY_DISABLED=true turns it off).
  • Last release 1.29.0.4488.

More MCP servers for CI/CD and testing

Related reading

FAQ

What does the SonarQube MCP server do?

Connects AI coding agents to SonarQube Server or SonarQube Cloud code quality and security data: issues, quality gates, security hotspots, coverage, measures, dependency risks and code snippet analysis. Runs locally as a container or JAR (stdio or Streamable HTTP), or as a hosted server embedded in SonarQube Cloud. The vendor documents 15 tools, including analyze_code_snippet, analyze_file_list, run_advanced_code_analysis and search_sonar_issues_in_projects.

How do I add the SonarQube MCP server to Claude Code?

SonarSource documents a Claude Code config; copy it from the Claude Code section of this page. Snippets for Codex and Generic are there too.

Does the SonarQube MCP server need authentication?

Yes, API key. Transport: stdio, Streamable HTTP. Status: Unlabelled, last checked October 17, 2026.

Sources

Last verified against 8 SonarSource pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.