SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Start with the quick setup, or learn more about the SonarQube product family.

Quick setup

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Some releases are also tagged with the SonarQube Server version they are aligned with, in the form <SQS major>.<SQS minor>.<patch> (e.g., sonarsource/sonarqube-mcp:2026.5.0), where the patch number is incremented for each MCP release targeting that SonarQube Server version. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcp

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_USER_TOKEN>", "SONARQUBE_ORG" = "<YOUR_ORG>" }

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_TOKEN>", "SONARQUBE_URL" = "<YOUR_SERVER_URL>" }

gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins

/mcp add

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_ORG, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_TOKEN>,SONARQUBE_ORG=<YOUR_ORG>
Tools: *

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_URL, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_USER_TOKEN>,SONARQUBE_URL=<YOUR_SERVER_URL>
Tools: *

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_TOKEN",
        "SONARQUBE_ORG": "COPILOT_MCP_SONARQUBE_ORG"
      },
      "tools": ["*"]
    }
  }
}

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_USER_TOKEN",
        "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL"
      },
      "tools": ["*"]
    }
  }
}

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

{
  "sonarqube_token": "YOUR_SONARQUBE_TOKEN",
  "sonarqube_org": "SONARQUBE_ORGANIZATION_KEY",
  "docker_path": "DOCKER_PATH"
}

{
  "sonarqube_token": "YOUR_SONARQUBE_USER_TOKEN",
  "sonarqube_url": "YOUR_SONARQUBE_SERVER_URL",
  "docker_path": "DOCKER_PATH"
}

💡 Tip: We recommend pulling the latest image regularly or before reporting issues to ensure you have the most up-to-date features and fixes.

Manual installation

You can manually install the SonarQube MCP server by copying the following snippet in the MCP servers configuration file:

• To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

• To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Integration with SonarQube for IDE

The SonarQube MCP Server can integrate with SonarQube for IDE to further enhance your development workflow, providing better code analysis and insights directly within your IDE.

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "-e",
      "SONARQUBE_IDE_PORT",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>",
      "SONARQUBE_IDE_PORT": "<64120-64130>"
    }
  }
}

Configuration

Depending on your environment, you should provide specific environment variables.

Base

You should add the following variable when running the MCP Server:

Workspace Mount (Reducing Context Bloat)

By default, analysis tool analyze_code_snippet requires the agent to pass the full file content as a fileContent argument. For large files or when analyzing many files in a session, this significantly increases context window usage and cost.

Solution: mount your project directory into the container at /app/mcp-workspace. When this mount is detected, the server reads files directly from disk using the project-relative filePath argument — file content never passes through the agent context.

{
  "args": [
    "run", "-i", "--rm", "--init", "--pull=always",
    "-e", "SONARQUBE_TOKEN",
    "-e", "SONARQUBE_ORG",
    "-v", "/path/to/your/project:/app/mcp-workspace",
    "sonarsource/sonarqube-mcp"
  ]
}

With a mount, analysis tools read files directly using filePath; fileContent is not needed.

Over stdio, analysis is selected at startup (subject to enabled toolsets):

• SonarQube Cloud: Vortex analysis (run_advanced_code_analysis) with a workspace mount and at least one entitled organization; local analysis otherwise. Vortex analysis only accepts entitled organizations.
• SonarQube Server: Vortex analysis for entitled instances (requires a workspace mount); local analysis for instances without Vortex.

Local analysis uses SonarQube for IDE if connected or analyze_code_snippet. Without a mount, snippet analysis requires fileContent.

On Cloud, SONARQUBE_ORG limits the entitlement check to that organization. To use snippets for all organizations, set SONARQUBE_FORCE_LOCAL_ANALYSIS=true, enable the analysis toolset, and restart. This setting has no effect on Server.

Over HTTP/HTTPS, Server supports snippet analysis with a startup SONARQUBE_TOKEN; Cloud exposes no analysis tools.

Selective Tool Enablement

MCP clients load every enabled tool — its name, description, and input schema — into the agent's context on every conversation. Limiting that list with SONARQUBE_TOOLSETS cuts context usage and the token cost of each session.

By default, only important toolsets are enabled. Enable additional toolsets only when you need them.

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_TOOLSETS="analysis,issues,quality-gates" \
  sonarsource/sonarqube-mcp

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_READ_ONLY="true" \
  sonarsource/sonarqube-mcp

SonarQube Cloud

For stdio, configure the following environment variables:

Examples:

• SonarQube Cloud: Only SONARQUBE_TOKEN is required. SONARQUBE_ORG fixes the organization when set.
• SonarQube Cloud US: Set SONARQUBE_TOKEN and SONARQUBE_URL=https://sonarqube.us; SONARQUBE_ORG is optional.

SonarQube Server

Version requirement: SonarQube Server 2025.1 (SQS) or 25.1 (SonarQube Community Build) or later is required. At startup, the MCP server reads the connected instance version and exits with an error if it is too old (for example, legacy 9.x/10.x Server releases and Community Build 24.x are not supported). SonarQube Cloud is not subject to this check.

⚠️ Connection to SonarQube Server requires a token of type USER and will not function properly if project tokens or global tokens are used.

💡 Configuration Tip (stdio mode): A token without a URL defaults to SonarQube Cloud. Set SONARQUBE_URL for SonarQube Server or a different Cloud region. SONARQUBE_ORG fixes the Cloud organization when set.

In stdio, setting SONARQUBE_ORG fixes the Cloud organization. Tool organization arguments are omitted from schemas and rejected, like projectKey when SONARQUBE_PROJECT_KEY is set.

With SONARQUBE_ORG unset, agents can call list_organizations to discover organization keys, names, IDs, and UUIDs accessible to your user account, then pass a key as the optional organization argument on organization-aware tools. Stdio retains a uniquely detected organization as its default; zero or multiple organizations leave it unresolved. A tool argument applies only to that call and never changes the detected default. Snippet profile and rule lookups use the organization selected for that call.

For HTTP/HTTPS token requests, server-level SONARQUBE_ORG remains supported for compatibility but is deprecated and logs a startup warning. It fixes the organization for every request and rejects client organization headers and tool organization arguments. When no server organization is configured, an optional client SONARQUBE_ORG header fixes the organization for that request and disallows tool organization arguments. Without the header, use the tool argument. Tools that require an organization report discovery guidance when all are missing. Organization discovery and tools whose APIs consume only resource identifiers do not require an organization argument. Organization-aware issue search and dependency-risk entitlement checks use the selected organization. When OAuth is configured, server-level SONARQUBE_ORG is rejected. OAuth requests also reject organization headers; select organizations through tool arguments.

Vortex context tools use the configured or uniquely detected startup organization. Runtime organization arguments do not reconfigure the proxied context engine; unresolved startup organizations skip that proxy. The built-in run_advanced_code_analysis tool checks combined Vortex entitlement for the organization selected on each invocation.

Transport Modes

The MCP specification defines two transport mechanisms: Stdio and Streamable HTTP. The SonarQube MCP Server supports both:

Note: Streamable HTTP is the current MCP network transport. The older SSE-only HTTP transport from earlier MCP versions is deprecated and not supported.

1. Stdio (Default - Recommended for Local Development)

The recommended mode for local development and single-user setups, used by most MCP clients.

Example - Docker with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

2. HTTP (Streamable HTTP)

Unencrypted Streamable HTTP transport. Use HTTPS instead for multi-user deployments.

⚠️ Not Recommended: Use Stdio for local development or HTTPS (Streamable HTTP) for multi-user production deployments.

Note: HTTP/HTTPS accepts the user's SonarQube token through Authorization: Bearer <token>. Sonar's hosted Cloud service also supports OAuth. For SonarQube Cloud token requests, the organization is resolved as follows:

• SONARQUBE_ORG is an optional request header that fixes the organization for that request. Deprecated server-level configuration fixes it for all requests and rejects client organization headers and tool organization arguments.
• Organization-aware tools accept an optional organization argument when neither server configuration nor the request header fixes the organization. Supplying the argument when the organization is fixed is rejected.
• Without a default, agents can call list_organizations using only their token, then pass the chosen key to subsequent tools.

Clients can also narrow the visible tools per-request by supplying SONARQUBE_TOOLSETS and/or SONARQUBE_READ_ONLY headers; these apply additional filtering on top of the server-level configuration — they can only reduce the scope, never expand it. No session state is maintained between requests.

Deprecated: For SonarQube tokens, the SONARQUBE_TOKEN request header is still accepted for backward compatibility but will be removed in a future version. Migrate to Authorization: Bearer <token>.

3. HTTPS (Streamable HTTP over TLS) (Recommended for Multi-User Production Deployments)

Secure Streamable HTTP transport with TLS encryption. Requires SSL certificates.

✅ Recommended for Production: Use HTTPS when deploying the MCP server for multiple users over Streamable HTTP. The server binds to 127.0.0.1 (localhost) by default for security.

SSL Certificate Configuration (Optional):

Example - Docker with SonarQube Cloud:

Note: When running in a container, set SONARQUBE_HTTP_HOST=0.0.0.0 so the container listens on all interfaces and the runtime's port mapping works, and set SONARQUBE_MCP_IN_CONTAINER=true to tell the server it is inside a container. The official Docker image sets the latter automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.). The host-side port flag controls who can reach the server from outside the container. SONARQUBE_HTTP_HOST=0.0.0.0 only controls where the server listens inside the container — browser CORS still allows localhost origins by default.

For a server running locally on your machine (accessible only from localhost):

docker run --init --pull=always -p 127.0.0.1:8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  sonarsource/sonarqube-mcp

For a server accessible from the network (remote deployments):

docker run --init --pull=always -p 8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  sonarsource/sonarqube-mcp

Client Configuration (SonarQube Cloud):

For SonarQube token requests, optionally set SONARQUBE_ORG in client headers to fix the request organization, or omit it to select organizations through tool arguments.

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Client Configuration (SonarQube Server):

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Note: SONARQUBE_TOOLSETS and SONARQUBE_READ_ONLY are optional per-request headers that narrow the server-level tool set for that specific request. They can only reduce scope — they cannot enable toolsets or lift restrictions beyond what the server was launched with.

Note: For local development, use Stdio transport instead (the default). HTTPS Streamable HTTP is intended for multi-user production deployments with proper SSL certificates.

Hosted SonarQube Cloud OAuth

OAuth support targets Sonar's hosted SonarQube Cloud MCP service. Use an OAuth-capable MCP client and sign in when prompted; no OAuth server settings are needed in your client configuration. Existing SonarQube token clients remain supported.

The mcp:tools:read and mcp:tools:write scopes independently control access to read and write tools, subject to your Cloud permissions. Use list_organizations and tool organization arguments to select an organization.

Self-hosted deployments continue to use SonarQube tokens; OAuth for SonarQube Server is not supported yet.

Service Endpoints

When running in Streamable HTTP mode (http or https), the server exposes a few unauthenticated service endpoints in addition to the MCP endpoint at /mcp. These are intended for service-to-service use (monitoring, orchestration, client compatibility checks) and do not require an Authorization header.

These endpoints are not available when running with the Stdio transport.

Custom Certificates

If your SonarQube Server uses a self-signed certificate or a certificate from a private Certificate Authority (CA), you can add custom certificates to the container that will automatically be installed.

docker run --init --pull=always -i --rm \
  -v /path/to/your/certificates/:/usr/local/share/ca-certificates/:ro \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_URL="<url>" \
  sonarsource/sonarqube-mcp

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-v",
      "/path/to/your/certificates/:/usr/local/share/ca-certificates/:ro",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Proxy

The SonarQube MCP Server supports HTTP and SOCKS5 proxies through standard Java proxy system properties.

Client Certificate (Mutual TLS)

If your SonarQube Server requires clients to present a certificate during the TLS handshake (mutual TLS), you can provide a PKCS12 keystore by mounting it into the container and passing its location via JAVA_OPTS.

docker run --init --pull=always -i --rm \
  -v /path/to/client.p12:/etc/ssl/mcp/client.p12:ro \
  -e JAVA_OPTS="-Djavax.net.ssl.keyStore=/etc/ssl/mcp/client.p12 -Djavax.net.ssl.keyStoreType=PKCS12 -Djavax.net.ssl.keyStorePassword=<passphrase>" \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_URL="<url>" \
  sonarsource/sonarqube-mcp

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run", "--init", "--pull=always", "-i", "--rm",
      "-v", "/path/to/client.p12:/etc/ssl/mcp/client.p12:ro",
      "-e", "JAVA_OPTS",
      "-e", "SONARQUBE_TOKEN",
      "-e", "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "JAVA_OPTS": "-Djavax.net.ssl.keyStore=/etc/ssl/mcp/client.p12 -Djavax.net.ssl.keyStoreType=PKCS12 -Djavax.net.ssl.keyStorePassword=<passphrase>",
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

java \
  -Djavax.net.ssl.keyStore=/path/to/client.p12 \
  -Djavax.net.ssl.keyStoreType=PKCS12 \
  -Djavax.net.ssl.keyStorePassword=<passphrase> \
  -jar <path_to_sonarqube_mcp_server_jar>

{
  "sonarqube": {
    "command": "java",
    "args": [
      "-Djavax.net.ssl.keyStore=/path/to/client.p12",
      "-Djavax.net.ssl.keyStoreType=PKCS12",
      "-Djavax.net.ssl.keyStorePassword=<passphrase>",
      "-jar",
      "<path_to_sonarqube_mcp_server_jar>"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Tools

Analysis

• analyze_code_snippet - Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally filter results to a specific code snippet.

  Deprecated: analyze_code_snippet will be removed in a future release. Connect SonarQube for IDE to use analyze_file_list, or enable Vortex analysis for your organization to use run_advanced_code_analysis (see below).

  Usage:

  • With workspace mounted (recommended): pass filePath (project-relative) — the server reads the file directly, keeping file content out of the agent context window
  • Without workspace mount: pass complete fileContent for full file analysis (reports all issues)
  • Add optional codeSnippet to filter results - only issues within the snippet will be reported (snippet location auto-detected)

  Parameters:

  • projectKey - The SonarQube project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
  • filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). Used when the workspace is mounted at /app/mcp-workspace - String
  • fileContent - Complete file content as a string. Required when workspace is not mounted - String
  • codeSnippet - Code snippet to filter issues (must match content in fileContent) - String
  • language - Language of the code (e.g., 'java', 'python', 'js', 'ts', 'tsx', 'jsx') - String
  • scope - Scope of the file: MAIN or TEST (default: MAIN) - String

  Supported Languages: Java, Kotlin, Python, Ruby, Go, JavaScript (js, jsx), TypeScript (ts, tsx), JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, Azure Resource Manager, Ansible, Docker, Secrets detection

When integration with SonarQube for IDE is enabled: (these two tools are tagged under both the analysis and ide toolsets)

• analyze_file_list - Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.

  • file_absolute_paths - List of absolute file paths to analyze - Required String[]

• toggle_automatic_analysis - Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.

  • enabled - Enable or disable the automatic analysis - Required Boolean

On SonarQube Server, stdio lists Vortex context tools and run_advanced_code_analysis when both the CAG and A3S hubs are entitled.

When Vortex analysis is available:

Requires having the workspace mounted at /app/mcp-workspace

• run_advanced_code_analysis - Run Vortex analysis on a single file. On Cloud, use the optional organization argument when no organization is fixed by SONARQUBE_ORG; use list_organizations if ambiguous. SonarQube Server uses the nil UUID placeholder.
  • organization - Cloud organization key; defaults to the configured or uniquely detected startup organization - Optional String
  • projectKey - The key of the project - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
  • branch - Branch name used to retrieve the latest analysis context - Required String
  • filePath - Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java). - Required String
  • fileScope - Defines in which scope the file originates from: 'MAIN' or 'TEST' (default: MAIN) - String

Coverage

• search_files_by_coverage - Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements.

  • projectKey - The project key to search in - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
  • branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
  • pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
  • maxCoverage - Maximum coverage threshold (0-100). Only return files with coverage <= this value - Number
  • pageIndex - Page index (1-based, default: 1) - Number
  • pageSize - Page size (default: 100, max: 500) - Number

• get_file_coverage_details - Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps identify precisely where to add test coverage. Use after identifying files with low coverage via search_files_by_coverage.

  • key - File key (e.g. my_project:src/foo/Bar.java) - Required String
  • branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
  • pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
  • from - First line to analyze (1-based, default: 1) - Number
  • to - Last line to analyze (inclusive). If not specified, all lines are returned - Number

Dependency Risks

Note: Dependency risks are only available when connecting to SonarQube Server 2025.4 Enterprise or higher with SonarQube Advanced Security enabled.

• search_dependency_risks - Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.
  • projectKey - Project key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
  • branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
  • pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
  • pageIndex - Optional page index (1-based, default: 1) - Integer
  • pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Enterprises

Note: Enterprises are only available when connecting to SonarQube Cloud.

• list_enterprises - List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.
  • enterpriseKey - Optional enterprise key to filter results - String

Issues

• change_sonar_issue_status - Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.

  • key - Issue key - Required String
  • status - New issue's status - Required Enum {"accept", "falsepositive", "reopen"}
  • comment - Optional comment explaining the status change - String

• search_sonar_issues_in_projects - Search for SonarQube issues in my organization's projects.

  • projectKeys - Optional list of SonarQube project keys - String[]
  • branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
  • pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
  • severities - Optional list of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER - String[]
  • impactSoftwareQualities - Optional list of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY - String[]
  • issueStatuses - Optional list of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED, IN_SANDBOX - String[]
  • tags - Optional list of issue tags to filter by. Tags are lowercase - String[]
  • inNewCodePeriod - Only return issues in the new code period. Requires exactly one entry across projectKeys and files - Boolean
  • issueKey - Optional issue key to fetch a specific issue - String
  • pageIndex - Optional 1-based page index (default: 1) - Integer
  • pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

Security Hotspots

• search_security_hotspots - Search for Security Hotspots in a SonarQube project.

  • projectKey - Project or application key - Required String (Ignored when SONARQUBE_PROJECT_KEY is defined)
  • hotspotKeys - Comma-separated list of specific Security Hotspot keys to retrieve - String[]
  • branch - Optional branch name for branch-based analysis. Use list_branches to discover valid names - String
  • pullRequest - Optional pull request key/ID. Use list_pull_requests to discover valid keys - String
  • files - Optional list of file paths to filter - String[]
  • status - Optional status filter: TO_REVIEW, REVIEWED - String
  • resolution - Optional resolution filter: FIXED, SAFE, ACKNOWLEDGED - String
  • sinceLeakPeriod - Filter hotspots created since the leak period (new code) - Boolean
  • onlyMine - Show only hotspots assigned to me - Boolean
  • pageIndex - Optional 1-based page index (default: 1) - Integer
  • pageSize - Optional page size. Must be greater than 0 and less than or equal to 500 (default: 100) - Integer

• show_security_hotspot - Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.

  • hotspotKey - Security Hotspot key - Required String

• change_security_hotspot_status - Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).

  • hotspotKey - Security Hotspot key - Required String
  • status - New status - Required Enum {"TO_REVIEW", "REVIEWED"}
  • resolution - Resolution when status is REVIEWED - Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}
  • comment - Optional review comment - String

Languages

• list_languages - List all programming languages supported in this SonarQube instance.
  • q - Optional pattern to match language keys/names against - String

Measures

• get_component_measures - Get SonarQube measures for a compo