Sonarqube MCP Server
UnclaimedOfficial SonarQube MCP Server for code quality and security in AI agents
Install
docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcpSet up this server
More in Security
Browse the full directoryUnclaimed listing
Is this your MCP server?
This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.
Claim this serverSecurity profile
Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works
40 of 40 tools
Documented tools (40)
From project documentation. A server handshake does not verify each tool’s description or behavior.
analyze_code_snippet
Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally filter results to a specific code snippet.
analyze_file_list
Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.
change_security_hotspot_status
Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).
change_sonar_issue_status
Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.
create_webhook
Create a new webhook for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
get_component_measures
Get SonarQube measures for a component (project, directory, file).
get_downstream_call_flow
Trace what functions a given function calls. Useful for impact analysis and understanding execution flow.
get_duplications
Get duplications for a file. Require Browse permission on file's project.
get_file_coverage_details
Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps identify precisely where to add test coverage. Use after identifying files with low coverage via searchfilesbycoverage.
get_project_quality_gate_status
Get the Quality Gate Status for the SonarQube project.
get_raw_source
Get source code as raw text from SonarQube. Require 'See Source Code' permission on file.
get_scm_info
Get SCM information of SonarQube source files. Require See Source Code permission on file's project.
get_source_code
Get complete source code (signature and body) for a code element by its fully qualified name.
get_system_health
Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational).
get_system_info
Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions.
get_system_logs
Get SonarQube Server system logs in plain-text format. Requires system administration permission.
get_system_status
Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DBMIGRATIONNEEDED, DBMIGRATIONRUNNING), version, and id.
get_type_hierarchy
Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees and refactoring.
get_upstream_call_flow
Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes.
list_branches
List analyzed branches for a project.
list_enterprises
List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.
list_languages
List all programming languages supported in this SonarQube instance.
list_portfolios
List enterprise portfolios available in SonarQube with filtering and pagination options.
list_pull_requests
List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull request key/ID which can be used with other tools. For branch-based analysis without pull requests, use listbranches instead.
list_quality_gates
List all quality gates in my SonarQube.
list_webhooks
List all webhooks for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
ping_system
Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text.
run_advanced_code_analysis
Run Vortex analysis on a single file. Organization is inferred from MCP configuration (SonarQube Server uses the nil UUID placeholder).
search_by_body_patterns
Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used.
search_by_signature_patterns
Find code elements (classes, methods, interfaces, ...) by their declaration signatures using regex patterns.
search_dependency_risks
Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.
search_duplicated_files
Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications.
search_files_by_coverage
Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements.
search_metrics
Search for SonarQube metrics.
search_my_sonarqube_projects
Find SonarQube projects. The response is paginated.
search_security_hotspots
Search for Security Hotspots in a SonarQube project.
search_sonar_issues_in_projects
Search for SonarQube issues in my organization's projects.
show_rule
Shows detailed information about a SonarQube rule.
show_security_hotspot
Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.
toggle_automatic_analysis
Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.
Tool change history
FAQ
Questions about Sonarqube MCP Server
- How do I connect Sonarqube MCP Server to Claude?
- The listing records `docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Code, Cursor, Windsurf as compatible clients.
- Is Sonarqube MCP Server free?
- MCPVault has not verified a licence for this server. Check the upstream terms and pricing before use; connected APIs may require a paid account.
- What can Sonarqube MCP Server do?
- Sonarqube MCP Server documents 40 tools to the agent, including analyze_code_snippet, analyze_file_list, change_security_hotspot_status. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.