SonarQube MCP Server
Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.
655 stars
Reviews
Write oneNobody has reviewed SonarQube MCP Server yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
SonarQube MCP Server tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it
- –Code scanpackage could not be scannedn/a
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 1 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
What the publisher says
From the SonarQube MCP Server repository's README, as published. We do not edit it. Read it on GitHub
SonarQube MCP Server
The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.
Quick setup
Security best practices
🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:
When using CLI commands:
- Avoid hardcoding tokens in command-line arguments – they get saved in shell history
- Use environment variables – set tokens in environment variables before running commands
When using configuration files:
- Never commit tokens to version control
- Use environment variable substitution in config files when possible
🚀 Generate your configuration
The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.
Manual setup
If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Read below if you want to build it locally.
Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.
Antigravity
SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:
- Open the Agent Side Panel
- Click the three dots (...) at the top right and select MCP Servers
- Search for SonarQube and select Install
- Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.
For SonarQube Cloud US, set the URL to https://sonarqube.us.
Alternatively, you can manually configure the server via mcp_config.json:
- To connect with SonarQube Cloud:
In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
"env": {
"SONARQUBE_TOKEN": "<YOUR_TOKEN>",
"SONARQUBE_ORG": "<YOUR_ORG>"
}
}
}
}For SonarQube Cloud US, manually add "SONARQUBEURL": "https://sonarqube.us" to the env section and "-e", "SONARQUBEURL" to the args array.
- To connect with SonarQube Server:
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
"env": {
"SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
"SONARQUBE_URL": "<YOUR_SERVER_URL>"
}
}
}
}Claude Code
- To connect with SonarQube Cloud:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Install directly
claude mcp add sonarqube-mcp-server -- docker run -i --rm docker.io/sonarsource/sonarqube-mcp
SonarQube MCP Server: common questions
- Is SonarQube MCP Server safe?
- Mostly: it is graded B (75/100). Read the SonarQube MCP Server safety report
- How do I install SonarQube MCP Server?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does SonarQube MCP Server need an API key?
- Yes. The registry entry asks for
SONARQUBE_TOKEN,SONARQUBE_ORG,SONARQUBE_URL. - Is SonarQube MCP Server maintained?
- The last commit was 2 days ago (2026-09-25). The latest release is v1.21.0.
- What can I use instead of SonarQube MCP Server?
- Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, SSH Manager MCP server and Reversecore MCP server. Compare all SonarQube MCP Server alternatives.
Alternatives to SonarQube MCP Server
Same job from other publishers: the closest match first, then the best rated.
- CrowdStrike Falcon MCP ServerConnects AI agents with CrowdStrike Falcon for security analysis and automation.not reviewedEstablishedA
- SSH ManagerSSH server management for agents, with per-server read-only and allowlist security modesnot reviewedEstablishedB
- Reversecore MCPSecurity-first MCP server for reverse engineering, malware analysis, forensics, and SAST.not reviewedEstablishedB
- Notebooklm SecureSecurity-hardened NotebookLM MCP with post-quantum encryptionnot reviewedGrowingA
- NiubizMCP server for Niubiz — Peru card acquirer: security token, session, authorize, reversenot reviewedGrowingB