MCP.Market

Sonar MCP Server

by igorolv·io.github.igorolv/sonar-mcp-server·v0.1.0
No reviews yet

Read-only SonarQube Community Build access for AI agents: issues, hotspots, rules, code snippets

B73/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B73/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Sonar MCP Server yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sonar MCP Server tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 14 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 73/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Sonar MCP Server compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
73/100
higher than 39% of 48,255 servers

Install Sonar MCP Server in Claude Code, Cursor or VS Code

claude mcp add sonar-mcp-server -- docker run -i --rm ghcr.io/igorolv/sonar-mcp-server:0.1.0
Add to Cursor

What the publisher says

From the Sonar MCP Server repository's README, as published. We do not edit it. Read it on GitHub

Sonar MCP Server

A local MCP server providing read-only access to a SonarQube Community Build (26.4+) instance via its web-api. It lets AI agents (Claude Code, Cursor, VS Code Copilot, etc.) fetch a project's issue list, the files and locations where they occur, rule descriptions, source-code snippets around issues, and Security Hotspots.

Typical scenario: "find and fix Sonar issues in such-and-such project" — the LLM calls listIssues, optionally getRule and getIssueSnippets, and edits files locally.

Why this server

There is an official SonarSource MCP server, but it targets SonarQube 10+ (and SonarCloud) and assumes a cloud-style deployment. This server is built for self-hosted SonarQube Community Build 26.4+ installations that expose the classic /api/ web-api. It supports both Standard Experience and MQR mode, handling per-software-quality impacts when the instance runs in MQR mode.

It is also intentionally narrower in scope:

  • Read-only by design. The server never creates, updates, or deletes anything in SonarQube — no marking issues as false-positive, no editing comments, no admin endpoints. The token's write permissions in SonarQube are irrelevant because the server never calls those endpoints.
  • Curated tool set. Instead of mirroring the SonarQube API surface, the server exposes a small, focused set of tools (13 in total) chosen for a single workflow: let an AI agent read Sonar's findings and fix the code based on them. Listing components, issues and hotspots, drilling into a single finding, fetching the rule explanation, and pulling the source-code snippet around the location — and that's it. Anything outside this "diagnose -> fix the code locally" loop is deliberately left out to keep the tool list small and the agent's choices unambiguous.

In short: a focused, read-only bridge from a self-hosted SonarQube Community Build to an AI coding agent.

Quick start

or build it yourself: ./gradlew bootJar (see Build). A Docker image is published as well.

  1. Install JDK 25+.
  2. Download sonar-mcp-server.jar from the latest release,
  1. Get your SonarQube URL and user token (see Configuration).
  2. Add the JAR to your client's MCP configuration (see Connecting to an AI client).

For Claude Code that is one command:

claude mcp add --scope user -e SONAR_URL=https://sonar.example.com -e SONAR_TOKEN=your_token -- sonar java -jar /path/to/sonar-mcp-server.jar

Architecture

The server only supports the stdio transport.

┌─────────────┐     stdio      ┌──────────────────┐    web-api     ┌──────────┐
│  AI agent   │ <------------> │  sonar-mcp-      │ -------------> │ SonarQube│
│ (Claude Code│   stdin/stdout │  server (Java)   │  HTTP + Bearer  │  CB 26.4+│
│  Cursor...) │                │                  │  auth (token)   │          │
└─────────────┘                └──────────────────┘                └──────────┘

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Sonar MCP Server: common questions

Is Sonar MCP Server safe?
Mostly: it is graded B (73/100). Read the Sonar MCP Server safety report
How do I install Sonar MCP Server?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sonar MCP Server need an API key?
Yes. The registry entry asks for SONAR_TOKEN.
Is Sonar MCP Server maintained?
The last commit was 47 days ago (2026-09-18). The latest release is v0.1.0.

More from igorolv →