MCP.Market

SonarQube MCP Server

by SonarSource·io.github.SonarSource/sonarqube-mcp-server·v1.32.0·680 stars

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

B75/100grade B
What users say
No reviews yet
Be the first
Safety scan
B75/100

not scanned yet

Adoption
Growing

680 stars

Reviews

Write one

Nobody has reviewed SonarQube MCP Server yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

SonarQube MCP Server tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How SonarQube MCP Server compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 40% of 917 Security servers
GitHub stars
680
more than 99% of 589 Security servers

Release history: 4 versions in the registry since 2026-06-25, latest 2026-11-10, typically one every 10 days.

Install SonarQube MCP Server in Claude Code, Cursor or VS Code

claude mcp add sonarqube-mcp-server -- docker run -i --rm docker.io/sonarsource/sonarqube-mcp
Add to Cursor

What the publisher says

From the SonarQube MCP Server repository's README, as published. We do not edit it. Read it on GitHub

SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Quick setup

Security best practices

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

  • Avoid hardcoding tokens in command-line arguments – they get saved in shell history
  • Use environment variables – set tokens in environment variables before running commands

When using configuration files:

  • Never commit tokens to version control
  • Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

Antigravity

SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:

  1. Open the Agent Side Panel
  2. Click the three dots (...) at the top right and select MCP Servers
  3. Search for SonarQube and select Install
  4. Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Alternatively, you can manually configure the server via mcp_config.json:

  • To connect with SonarQube Cloud:

In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

For SonarQube Cloud US, manually add "SONARQUBEURL": "https://sonarqube.us" to the env section and "-e", "SONARQUBEURL" to the args array.

  • To connect with SonarQube Server:
{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

Claude Code

  • To connect with SonarQube Cloud:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

SonarQube MCP Server: common questions

Is SonarQube MCP Server safe?
Mostly: it is graded B (75/100). Read the SonarQube MCP Server safety report
How do I install SonarQube MCP Server?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does SonarQube MCP Server need an API key?
Yes. The registry entry asks for SONARQUBE_TOKEN, SONARQUBE_ORG, SONARQUBE_URL.
Is SonarQube MCP Server maintained?
The last commit was 9 days ago (2026-11-06). The latest release is v1.32.0.
What can I use instead of SonarQube MCP Server?
Servers from other publishers that do the same job: Skylos MCP server, Snyk MCP server and CrowdStrike Falcon MCP Server.
How does SonarQube MCP Server compare with other Security MCP servers?
safety score 75/100 (higher than 40% of 917 Security servers); github stars 680 (more than 99% of 589 Security servers). Full comparison.

Alternatives to SonarQube MCP Server

Same job from other publishers: the closest match first, then the best rated.

  • Skylos
    Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
    C
  • Snyk
    Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
    B
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A
  • Virustotal
    MCP server for querying VirusTotal API with comprehensive security analysis tools.
    B