SonarQube MCP Server

The SonarQube MCP server brings the results of your static code analysis into the AI assistant. Anyone working with SonarQube knows the switch between editor and web interface: the pipeline fails at a quality gate, you open the dashboard, look for the affected issues, and copy them into the chat by hand. With the server the assistant can query this data itself, check the state of a project or pull request, and fix problems in a targeted way. The server is maintained by SonarSource itself; the repository calls it the official SonarQube MCP server for code quality and security in AI agents.

What is the SonarQube MCP server?

The server implements the Model Context Protocol (MCP), an open standard through which AI applications talk to tools. It runs locally, over stdio by default, and according to the README it can also be operated over Streamable HTTP or HTTPS. In HTTP mode it is stateless: every request must carry a bearer token. It connects to SonarQube Cloud (including the US instance), to SonarQube Server from version 2025.1, or to the Community Build from 25.1; it rejects older versions at startup. The repository SonarSource/sonarqube-mcp-server is not archived and was last updated in October 2026.

Which tools the server provides

The README groups the tools into toolsets that can be switched on and off via SONARQUBE_TOOLSETS. Active by default are, among others, analysis, issues, projects, quality gates, rules, duplications, metrics, security hotspots, dependency risks, and test coverage. Concretely, the assistant can search open issues with search_sonar_issues_in_projects, query the quality gate state with get_project_quality_gate_status, have a rule explained with show_rule, and read metrics with get_component_measures. Add search_security_hotspots, search_files_by_coverage and get_file_coverage_details for test coverage, search_duplicated_files, as well as list_pull_requests and list_branches. With analyze_file_list files can be analyzed locally. Optional toolsets cover system information (Server only), webhooks, portfolios, and, in the cloud only, an assessment of how ready a project is for agents. Tools such as change_sonar_issue_status and change_security_hotspot_status write.

Setup

According to the README the recommended route is the container image sonarsource/sonarqube-mcp from Docker Hub; alternatively a standalone JAR runs with Java 21 or newer. The variable SONARQUBE_TOKEN is required; for SonarQube Server use a user token. For Server also set SONARQUBE_URL, for the cloud optionally SONARQUBE_ORG. With SONARQUBE_READ_ONLY the server can be limited to read access. Instructions exist for Claude Code, Codex CLI, Cursor, GitHub Copilot, VS Code, Windsurf, Zed, and further clients.

Security and privacy

Analysis results contain source code snippets, file paths, and hints about vulnerabilities. Everything the assistant retrieves enters the language model's context and thus reaches your client's model provider. Issue tokens with the narrowest possible rights, enable read-only mode for pure evaluation, and review status changes to issues before approving them. According to the README the server sends telemetry that is not supposed to include source code or IP addresses and can be switched off via an environment variable.

License and costs

The server is released under the SONAR Source-Available License v1.0. That is not an OSI-approved open-source license, but the source code is viewable; read the license before using it in a company. According to the vendor the server itself is free. For the connected services SonarSource's pricing page lists a free entry into SonarQube Cloud for private projects up to a certain size, paid Team and Enterprise plans, and for SonarQube Server the free Community Build alongside paid editions. Some tools, such as dependency risks, require a higher edition. Current amounts are on the official pricing page.

Who is the SonarQube MCP server for?

It is worthwhile for teams that already use SonarQube and let AI assistants write or correct code: before committing, the assistant can check whether its proposal passes the quality gate, and after a failed run it can work through the concrete issues. It also helps with reviews, because pull requests can be assessed with metrics and hotspots directly in the conversation. Anyone who does not use SonarQube gains nothing from it. Compared with copying from the dashboard, the advantage is that the assistant can ask targeted follow-up questions, for example about the reasoning behind a rule or the coverage of a specific file.

A SonarQube Cloud account or SonarQube Server 2025.1 or later (Community Build 25.1 or later) with an access token, Docker or Java 21, and an MCP client such as Claude Code, Codex, or Cursor.

The SonarQube MCP server gives your assistant access to issues, quality gates, and metrics from SonarQube. This guide walks through the token, configuration, and the first calls.

Quick start

Register it as a stdio server via container docker run --init --rm -i -e SONARQUBE_TOKEN sonarsource/sonarqube-mcp; for SonarQube Server also set SONARQUBE_URL.

docker run --init --rm -i -e SONARQUBE_TOKEN sonarsource/sonarqube-mcp

Step 1: Prerequisites

You need an account at SonarQube Cloud or a SonarQube Server instance from version 2025.1 (Community Build from 25.1), Docker or Java 21, and an MCP client such as Claude Code, Codex, or Cursor.

Step 2: Create a token

Create an access token in SonarQube. For SonarQube Server it is a user token. The token determines what the assistant may see and change, so issue it for your own user with only the rights you really need.

Step 3: Register it in the client

In Claude Code, add an entry sonarqube of type stdio to the file .mcp.json with the command docker and the arguments run, --init, --rm, -i, -e, SONARQUBE_TOKEN, and sonarsource/sonarqube-mcp, and set the variable SONARQUBE_TOKEN under env. For SonarQube Server also pass SONARQUBE_URL, for the cloud optionally SONARQUBE_ORG. In Cursor the JSON structure is the same; restart Cursor afterwards.

First calls

Ask the assistant to name your projects with search_my_sonarqube_projects and to query the quality gate state with get_project_quality_gate_status. Then have it list open issues with search_sonar_issues_in_projects, explain a rule with show_rule, and fix the affected spot in the code.

Use write permissions deliberately

For pure evaluation set SONARQUBE_READ_ONLY to true. Tools such as change_sonar_issue_status change the state for the team; approve such calls only after your own review and keep the token out of committed files.

SonarQube token via SONARQUBE_TOKEN (a user token for SonarQube Server); in HTTP mode a bearer token per request.

Read projects, issues, hotspots, quality gates, metrics, and source code; change issue and hotspot status and create webhooks if the token allows it.

The server runs locally and queries SonarQube Cloud or Server. Retrieved analysis data enters the AI client context and therefore reaches the model provider. Telemetry according to the README excludes source code and IP address and can be disabled.

Results contain source code and hints about vulnerabilities; status changes to issues and hotspots change the state for the team; tokens in configuration files can leak; the license is not an OSI open-source license.