Provides seamless integration with SonarQube Server or Cloud, and enables analysis of code snippets directly within the agent context
Provides seamless integration with SonarQube Server or Cloud, and enables analysis of code snippets directly within the agent context.
The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| analyze_code_snippet | Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally f |
| projectKey | Optional project key to list project-specific webhooks - _String_ |
| filePath | Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). - _Required String_ |
| fileContent | Complete file content as a string. Required when workspace is not mounted - _String_ |
| codeSnippet | Code snippet to filter issues (must match content in fileContent) - _String_ |
| language | Language of the code (e.g., 'java', 'python', 'js', 'ts', 'tsx', 'jsx') - _String_ |
| scope | Scope of the file: MAIN or TEST (default: MAIN) - _String_ |
| analyze_file_list | Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analy |
| file_absolute_paths | List of absolute file paths to analyze - _Required String[]_ |
| toggle_automatic_analysis | Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working dir |
| enabled | Enable or disable the automatic analysis - _Required Boolean_ |
| run_advanced_code_analysis | Run Vortex analysis on a single file. Organization is inferred from MCP configuration (SonarQube Server uses the nil UUID placeholder). |
| branch | Optional branch name for branch-based analysis. Use list_branches to discover valid names - _String_ |
| fileScope | Defines in which scope the file originates from: 'MAIN' or 'TEST' (default: MAIN) - _String_ |
| search_files_by_coverage | Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements. |
| pullRequest | Optional pull request key/ID. Use list_pull_requests to discover valid keys - _String_ |
| maxCoverage | Maximum coverage threshold (0-100). Only return files with coverage <= this value - _Number_ |
| pageIndex | Optional page number for manual pagination (starts at 1). If not specified, auto-fetches all duplicated files - _Integer_ |
| pageSize | Optional number of results per page for manual pagination (max: 500). If not specified, auto-fetches all duplicated files - _Integer_ |
| get_file_coverage_details | Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps |
| key | File key - _Required String_ |
| from | First line to return. Starts at 1 - _Number_ |
| to | Last line to return (inclusive) - _Number_ |
| search_dependency_risks | Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application |
| list_enterprises | List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools. |
| enterpriseKey | Optional enterprise key to filter results - _String_ |
| change_sonar_issue_status | Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue. |
| status | New status - _Required Enum {"TO_REVIEW", "REVIEWED"}_ |
| comment | Optional review comment - _String_ |
| search_sonar_issues_in_projects | Search for SonarQube issues in my organization's projects. |
| projectKeys | Optional list of SonarQube project keys - _String[]_ |
| severities | Optional list of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER - _String[]_ |
| impactSoftwareQualities | Optional list of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY - _String[]_ |
| issueStatuses | Optional list of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED, IN_SANDBOX - _String[]_ |
| tags | Optional list of issue tags to filter by. Tags are lowercase - _String[]_ |
| inNewCodePeriod | Only return issues in the new code period. Requires exactly one entry across projectKeys and files - _Boolean_ |
| issueKey | Optional issue key to fetch a specific issue - _String_ |
| search_security_hotspots | Search for Security Hotspots in a SonarQube project. |
| hotspotKeys | Comma-separated list of specific Security Hotspot keys to retrieve - _String[]_ |
| files | Optional list of file paths to filter - _String[]_ |
| resolution | Resolution when status is REVIEWED - _Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}_ |
| sinceLeakPeriod | Filter hotspots created since the leak period (new code) - _Boolean_ |
| onlyMine | Show only hotspots assigned to me - _Boolean_ |
| show_security_hotspot | Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments. |
| hotspotKey | Security Hotspot key - _Required String_ |
| change_security_hotspot_status | Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED). |
| list_languages | List all programming languages supported in this SonarQube instance. |
| get_component_measures | Get SonarQube measures for a component (project, directory, file). |
| metricKeys | Optional metric keys to retrieve (e.g. ncloc, complexity, violations, coverage) - _String[]_ |
| search_metrics | Search for SonarQube metrics. |
| list_portfolios | List enterprise portfolios available in SonarQube with filtering and pagination options. |
| favorite | Required to be true if 'enterpriseId' parameter is omitted. If true, only returns portfolios favorited by the logged-in user. Cannot be true when 'draft' is tru |
| enterpriseId | Enterprise uuid. Can be omitted only if 'favorite' parameter is supplied with value true - _String_ |
| draft | If true, only returns drafts created by the logged-in user. Cannot be true when 'favorite' is true - _Boolean_ |
| search_my_sonarqube_projects | Find SonarQube projects. The response is paginated. |
| list_branches | List analyzed branches for a project. |
| branchTypes | _(SonarQube Cloud only)_ Optional filter: ALL (default), LONG, or SHORT - _Enum {"ALL", "LONG", "SHORT"}_ |
| list_pull_requests | List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull reque |
| get_project_quality_gate_status | Get the Quality Gate Status for the SonarQube project. |
| analysisId | Optional analysis ID - _String_ |
| projectId | Optional project ID - _String_ |
| list_quality_gates | List all quality gates in my SonarQube. |
| show_rule | Shows detailed information about a SonarQube rule. |
| search_duplicated_files | Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max) |
| get_duplications | Get duplications for a file. Require Browse permission on file's project. |
| get_raw_source | Get source code as raw text from SonarQube. Require 'See Source Code' permission on file. |
| get_scm_info | Get SCM information of SonarQube source files. Require See Source Code permission on file's project. |
| commits_by_line | Group lines by SCM commit if value is false, else display commits for each line - _String_ |
| get_system_health | Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational). |
| get_system_info | Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissi |
| get_system_logs | Get SonarQube Server system logs in plain-text format. Requires system administration permission. |
| ping_system | Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text. |
| get_system_status | Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DB_MIGRATION_NEEDED, DB_MIGRATION_RUNNING), version, and id. |
| create_webhook | Create a new webhook for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission. |
| url | Webhook URL - _Required String_ |
| secret | Optional webhook secret for securing the webhook payload - _String_ |
| list_webhooks | List all webhooks for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission. |
| search_by_signature_patterns | Find code elements (classes, methods, interfaces, ...) by their declaration signatures using regex patterns. |
| include_code_regex_list | List of regex patterns to match in code bodies - _Required String[]_ |
| exclude_code_regex_list | List of regex patterns to exclude from results - _String[]_ |
| include_glob | File filter glob pattern - _String_ |
| exclude_glob | File exclusion glob pattern - _String_ |
| fields | Comma-separated list of fields to include in the response - _String_ |
| limit | Maximum number of results to return (default: 10) - _Integer_ |
| regex_lists_operator | How to combine multiple patterns: OR (default) or AND - _String_ |
| search_by_body_patterns | Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used. |
| get_upstream_call_flow | Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes. |
| fqn | Fully qualified name of the class or module - _Required String_ |
| depth | Hierarchy depth (0=root only, 1=root + children, etc.) - _Required Integer_ |
| get_downstream_call_flow | Trace what functions a given function calls. Useful for impact analysis and understanding execution flow. |
| get_source_code | Get complete source code (signature and body) for a code element by its fully qualified name. |
| get_type_hierarchy | Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees |
| get_references | Get direct inbound and outbound code references for a class or module. Returns only direct (non-transitive) references. |
| get_current_architecture | Get a hierarchical architecture graph filtered by path prefix and depth. Useful for exploring module structure and high-level dependencies. |
| path_prefix | Optional path prefix to filter nodes (e.g., com.example.service) - _String_ |
| ecosystem | Optional ecosystem to filter by (java, cs, py, js, ts) - _String_ |
| get_intended_architecture | Get user-defined architectural constraints specifying which modules are allowed to depend on others. |
| get_guidelines | Get coding guidelines based on SonarQube project issues, catalog categories, or a combination of both. |
| categories | List of category names (required for category_based and combined modes) - _String[]_ |
| languages | List of target languages in SonarQube repository key format (required when categories is provided) - _String[]_ |
| file_paths | Optional list of file paths to filter guidelines by - _String[]_ |
| check_dependency | Check a third-party dependency for security vulnerabilities, supply-chain malware, and license compliance before adding or updating it. |
| purl | Package URL (purl) with version, per purl-spec. Format: pkg: / / @ (e.g. pkg:npm/lodash@4.17.21, pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1, pkg:pypi/ |
| Variable | Description |
| SONARQUBE_URL | SonarQube Cloud URL |
| SONARQUBE_TOKEN | Authentication token |
| SONARQUBE_ORG | Organization key on SonarQube Cloud |
| SONARQUBE_PROJECT_KEY | Project key on SonarQube Cloud |
| SONAR_SQ_BRANCH | Explicit SonarQube branch override |
| SONARQUBE_DEBUG_ENABLED | Activate debug logging (for troubleshooting) |
| SONAR_LOG_LEVEL | Logging verbosity (TRACE, DEBUG, INFO, WARNING, ERROR) |
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "YOUR_SONARQUBE_TOKEN",
"SONARQUBE_ORG": "<YOUR_ORG>"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
| Variable | Description | Required |
|---|---|---|
| SONARQUBE_TOKEN | Declared in the maintainer’s client configuration. | Check documentation |
| SONARQUBE_ORG | Declared in the maintainer’s client configuration. | Check documentation |
Read, search and edit files inside allowed directories with the Model Context Protocol reference Filesystem server.
Retrieve version-aware library documentation and code examples with Context7 MCP, using resolve-library-id and query-docs.
Use Microsoft’s Playwright MCP server to navigate pages, inspect accessibility snapshots, fill forms and capture browser screenshots.
Connect GitHub MCP to repositories, issues and pull requests with GitHub’s hosted service or a locally run server.
Use the Supabase MCP server to inspect database schemas, query project data and retrieve docs through a project-scoped connection.
Search Linear issues and projects, inspect work context and manage updates through Linear’s hosted MCP server with OAuth.