sonarqube-mcp-server MCP server

Official SonarQube MCP Server for code quality and security in AI agents

What sonarqube-mcp-server does

Summarised from the project README; check the repository for the latest details.

Tools exposed (20+)

• Analysis
• analyze_code_snippet – Analyze file content with SonarQube analyzers to identify code quality and security issues. Always analyzes the complete file content for ac
• analyze_file_list – Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perfor
• toggle_automatic_analysis – Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modifie
• run_advanced_code_analysis – Run Vortex analysis on a single file. Organization is inferred from MCP configuration (SonarQube Server uses the nil UUID placeholder).
• Coverage
• search_files_by_coverage – Search for files in a project sorted by coverage (ascending - worst coverage first). This tool helps identify files that need test coverage
• get_file_coverage_details – Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branch
• search_dependency_risks – Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed
• Enterprises
• list_enterprises – List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with ot
• Issues
• change_sonar_issue_status – Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.
• search_sonar_issues_in_projects – Search for SonarQube issues in my organization's projects.
• search_security_hotspots – Search for Security Hotspots in a SonarQube project.
• show_security_hotspot – Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.
• change_security_hotspot_status – Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).
• Languages
• list_languages – List all programming languages supported in this SonarQube instance.
• Measures

Requirements

• Docker
• Environment variables: SONARQUBE_TOKEN

How to install sonarqube-mcp-server MCP in Claude Desktop, Cursor and VS Code

claude mcp add --env 'SONARQUBE_TOKEN=<YOUR_TOKEN>' --env 'SONARQUBE_ORG=<YOUR_ORG>' --transport stdio sonarqube -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

{
  "servers": {
    "sonarqube": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

Add to config generator – combine it with other servers, or get the Windsurf format.

Featured in: Best MCP servers for security research

Listed on Socketlist – add this badge to your README:

Badge markdown[](https://socketlist.pages.dev/s/sonarsource-sonarqube-mcp-server/)

Maintain this project? Get it featured for free during launch →

Compare with ida-pro-mcp →

Related Security MCP servers