Mmcp.market

SonarQube MCP Server

by SonarSource·io.github.SonarSource/sonarqube-mcp-server·v1.21.0

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

B75/100grade B
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
Growing

655 stars

Reviews

Write one

Nobody has reviewed SonarQube MCP Server yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

SonarQube MCP Server tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the SonarQube MCP Server repository's README, as published. We do not edit it. Read it on GitHub

SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Quick setup

Security best practices

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

  • Avoid hardcoding tokens in command-line arguments – they get saved in shell history
  • Use environment variables – set tokens in environment variables before running commands

When using configuration files:

  • Never commit tokens to version control
  • Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

Antigravity

SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:

  1. Open the Agent Side Panel
  2. Click the three dots (...) at the top right and select MCP Servers
  3. Search for SonarQube and select Install
  4. Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Alternatively, you can manually configure the server via mcp_config.json:

  • To connect with SonarQube Cloud:

In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

For SonarQube Cloud US, manually add "SONARQUBEURL": "https://sonarqube.us" to the env section and "-e", "SONARQUBEURL" to the args array.

  • To connect with SonarQube Server:
{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

Claude Code

  • To connect with SonarQube Cloud:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

claude mcp add sonarqube-mcp-server -- docker run -i --rm docker.io/sonarsource/sonarqube-mcp
Add to Cursor

SonarQube MCP Server: common questions

Is SonarQube MCP Server safe?
Mostly: it is graded B (75/100). Read the SonarQube MCP Server safety report
How do I install SonarQube MCP Server?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does SonarQube MCP Server need an API key?
Yes. The registry entry asks for SONARQUBE_TOKEN, SONARQUBE_ORG, SONARQUBE_URL.
Is SonarQube MCP Server maintained?
The last commit was 2 days ago (2026-09-25). The latest release is v1.21.0.
What can I use instead of SonarQube MCP Server?
Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, SSH Manager MCP server and Reversecore MCP server. Compare all SonarQube MCP Server alternatives.

Alternatives to SonarQube MCP Server

Same job from other publishers: the closest match first, then the best rated.

All SonarQube MCP Server alternatives →
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • SSH Manager
    SSH server management for agents, with per-server read-only and allowlist security modes
    B
  • Reversecore MCP
    Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
    B
  • Notebooklm Secure
    Security-hardened NotebookLM MCP with post-quantum encryption
    A
  • Niubiz
    MCP server for Niubiz — Peru card acquirer: security token, session, authorize, reverse
    B

More from SonarSource →