Sonarqube MCP Server
未认领Official SonarQube MCP Server for code quality and security in AI agents
安装
docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp更多Security服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
40 个工具中显示 40 个
文档中列出的工具 (40)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
analyze_code_snippet
Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for accuracy. Optionally filter results to a specific code snippet.
analyze_file_list
Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.
change_security_hotspot_status
Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).
change_sonar_issue_status
Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.
create_webhook
Create a new webhook for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
get_component_measures
Get SonarQube measures for a component (project, directory, file).
get_downstream_call_flow
Trace what functions a given function calls. Useful for impact analysis and understanding execution flow.
get_duplications
Get duplications for a file. Require Browse permission on file's project.
get_file_coverage_details
Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. This tool helps identify precisely where to add test coverage. Use after identifying files with low coverage via searchfilesbycoverage.
get_project_quality_gate_status
Get the Quality Gate Status for the SonarQube project.
get_raw_source
Get source code as raw text from SonarQube. Require 'See Source Code' permission on file.
get_scm_info
Get SCM information of SonarQube source files. Require See Source Code permission on file's project.
get_source_code
Get complete source code (signature and body) for a code element by its fully qualified name.
get_system_health
Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational).
get_system_info
Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions.
get_system_logs
Get SonarQube Server system logs in plain-text format. Requires system administration permission.
get_system_status
Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DBMIGRATIONNEEDED, DBMIGRATIONRUNNING), version, and id.
get_type_hierarchy
Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees and refactoring.
get_upstream_call_flow
Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes.
list_branches
List analyzed branches for a project.
list_enterprises
List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.
list_languages
List all programming languages supported in this SonarQube instance.
list_portfolios
List enterprise portfolios available in SonarQube with filtering and pagination options.
list_pull_requests
List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull request key/ID which can be used with other tools. For branch-based analysis without pull requests, use listbranches instead.
list_quality_gates
List all quality gates in my SonarQube.
list_webhooks
List all webhooks for the SonarQube organization or project. Requires 'Administer' permission on the specified project, or global 'Administer' permission.
ping_system
Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text.
run_advanced_code_analysis
Run Vortex analysis on a single file. Organization is inferred from MCP configuration (SonarQube Server uses the nil UUID placeholder).
search_by_body_patterns
Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used.
search_by_signature_patterns
Find code elements (classes, methods, interfaces, ...) by their declaration signatures using regex patterns.
search_dependency_risks
Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.
search_duplicated_files
Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications.
search_files_by_coverage
Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage improvements.
search_metrics
Search for SonarQube metrics.
search_my_sonarqube_projects
Find SonarQube projects. The response is paginated.
search_security_hotspots
Search for Security Hotspots in a SonarQube project.
search_sonar_issues_in_projects
Search for SonarQube issues in my organization's projects.
show_rule
Shows detailed information about a SonarQube rule.
show_security_hotspot
Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.
toggle_automatic_analysis
Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.