Skip to main content
hc
Submit
mcpSource-backed
SonarQube MCP Server logo

SonarQube MCP Server

Official SonarSource MCP server that connects Claude to SonarQube Server or SonarQube Cloud for code quality, security issues, hotspots, measures, quality gates, branches, pull requests, snippets, and system context.

by SonarSource · submitted by oktofeesh1·added 2026-06-06·
Claude CodeClaude Desktop
HarnessClaude CodeClaude Desktop
Review first — review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL
https://heyclau.de/entry/mcp/sonarqube-mcp-server
Source URLs
https://github.com/SonarSource/sonarqube-mcp-server/blob/master/README.md, https://github.com/SonarSource/sonarqube-mcp-server
Brand
SonarQube MCP Server
Brand domain
sonarsource.com
Brand asset source
brandfetch
Safety notes
SonarQube MCP Server uses the permissions of the provided SonarQube token and can expose project, issue, hotspot, measure, branch, pull request, rule, source, and system information., Source code snippets, raw source, SCM details, coverage information, security findings, dependency risks, duplicated files, system logs, and health data can be sensitive., The source tree includes tools for changing issue status, changing security hotspot status, toggling automatic analysis, and creating webhooks; require human approval for actions that mutate SonarQube state., Use least-privilege tokens and separate development, staging, and production SonarQube contexts where possible., Container execution pulls and runs `mcp/sonarqube`; pin image versions or use reviewed container controls if your environment requires reproducible artifacts.
Privacy notes
SonarQube tokens, organization keys, server URLs, project keys, branch names, pull request identifiers, source snippets, issue messages, hotspot details, logs, and system metadata may appear in MCP client logs, model transcripts, and tool outputs., The repository includes telemetry sample documentation; review SonarSource telemetry, product, and data-processing policies before enabling the server in regulated environments., Do not paste SonarQube tokens, private server URLs, raw source, or security findings into public prompts, issues, screenshots, or repository files., Security issue and hotspot data can reveal exploitable weaknesses before fixes are released; limit model and user access accordingly.
Author
SonarSource
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

—

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done

  • Source provenance statusRequired

    Marked as source-backed.

    Done

  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done

  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done

  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done

  • Package verification flag

    No package verification flag provided.

    Pending

  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending

  • Baseline comparison available

    No baseline peer selected yet.

    Pending

  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

20 minutes

Install command

Provided

Config snippet

Provided

Copy snippet

Provided

Prerequisites

5 to clear

Platforms

2 listed

Install type

CLI install

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done

  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending

  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done

  • Review privacy notesRequired

    Privacy notes are present.

    Done

  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending

  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending

  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

5 prerequisites to line up before setup. Have accounts and credentials ready first. Includes a review or approval gate.

0/5 ready
Account & credentials1Install & runtime1Review & approval1General220 minutes

Safety & privacy surface

Safety & privacy surface

5 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, network access.

5 areas
  • SafetyCredentials & tokensSonarQube MCP Server uses the permissions of the provided SonarQube token and can expose project, issue, hotspot, measure, branch, pull request, rule, source, and system information.
  • SafetyLocal filesSource code snippets, raw source, SCM details, coverage information, security findings, dependency risks, duplicated files, system logs, and health data can be sensitive.
  • SafetyNetwork accessThe source tree includes tools for changing issue status, changing security hotspot status, toggling automatic analysis, and creating webhooks; require human approval for actions that mutate SonarQube state.
  • SafetyCredentials & tokensUse least-privilege tokens and separate development, staging, and production SonarQube contexts where possible.
  • SafetyExecution & processesContainer execution pulls and runs `mcp/sonarqube`; pin image versions or use reviewed container controls if your environment requires reproducible artifacts.
  • PrivacyCredentials & tokensSonarQube tokens, organization keys, server URLs, project keys, branch names, pull request identifiers, source snippets, issue messages, hotspot details, logs, and system metadata may appear in MCP client logs, model transcripts, and tool outputs.
  • PrivacyExecution & processesThe repository includes telemetry sample documentation; review SonarSource telemetry, product, and data-processing policies before enabling the server in regulated environments.
  • PrivacyCredentials & tokensDo not paste SonarQube tokens, private server URLs, raw source, or security findings into public prompts, issues, screenshots, or repository files.
  • PrivacyGeneralSecurity issue and hotspot data can reveal exploitable weaknesses before fixes are released; limit model and user access accordingly.

Disclosure: Official SonarSource MCP server for SonarQube Server and SonarQube Cloud. The repository is source-available under SonarSource licensing, and use of SonarQube products, cloud services, container images, and telemetry may be subject to SonarSource terms and policies.

Safety notes

  • SonarQube MCP Server uses the permissions of the provided SonarQube token and can expose project, issue, hotspot, measure, branch, pull request, rule, source, and system information.
  • Source code snippets, raw source, SCM details, coverage information, security findings, dependency risks, duplicated files, system logs, and health data can be sensitive.
  • The source tree includes tools for changing issue status, changing security hotspot status, toggling automatic analysis, and creating webhooks; require human approval for actions that mutate SonarQube state.
  • Use least-privilege tokens and separate development, staging, and production SonarQube contexts where possible.
  • Container execution pulls and runs `mcp/sonarqube`; pin image versions or use reviewed container controls if your environment requires reproducible artifacts.

Privacy notes

  • SonarQube tokens, organization keys, server URLs, project keys, branch names, pull request identifiers, source snippets, issue messages, hotspot details, logs, and system metadata may appear in MCP client logs, model transcripts, and tool outputs.
  • The repository includes telemetry sample documentation; review SonarSource telemetry, product, and data-processing policies before enabling the server in regulated environments.
  • Do not paste SonarQube tokens, private server URLs, raw source, or security findings into public prompts, issues, screenshots, or repository files.
  • Security issue and hotspot data can reveal exploitable weaknesses before fixes are released; limit model and user access accordingly.

Prerequisites

  • Docker or another OCI-compatible container runtime.
  • SonarQube Cloud organization key or SonarQube Server URL.
  • SonarQube user token scoped to the projects and actions Claude should access.
  • Organization policy for whether an agent may inspect source snippets, issues, hotspots, measures, quality gates, pull requests, server logs, or system data.
  • Approval process before allowing issue status changes, hotspot status changes, automatic-analysis changes, webhooks, or server-level actions.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
20 minutes
Difficulty
advanced
Tool listing metadata
Disclosure
Official SonarSource MCP server for SonarQube Server and SonarQube Cloud. The repository is source-available under SonarSource licensing, and use of SonarQube products, cloud services, container images, and telemetry may be subject to SonarSource terms and policies.
Full copyable content
{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "mcp/sonarqube"
      ],
      "env": {
        "SONARQUBE_TOKEN": "YOUR_TOKEN",
        "SONARQUBE_ORG": "YOUR_ORG"
      }
    }
  }
}

About this resource

Content

SonarQube MCP Server is the official SonarSource MCP server for connecting Claude-compatible clients to SonarQube Server or SonarQube Cloud. It lets an agent work with code quality and security context such as projects, issues, security hotspots, measures, quality gates, branches, pull requests, rules, source snippets, duplications, dependency risks, and selected system information.

Use it when Claude needs SonarQube-backed evidence while reviewing code, triaging findings, explaining quality gate failures, summarizing security hotspots, or preparing remediation plans. Because the server can also expose source and change selected SonarQube state, it should be configured with least-privilege tokens and human approval for write actions.

Source Review

These sources were reviewed on 2026-06-06. Prefer the live repository, README, Docker Hub package page, license, build manifest, MCP registry metadata, telemetry sample, server implementation, and representative issue and hotspot mutation tools for current installation and behavior details.

Features

  • Connect to SonarQube Cloud with SONARQUBE_TOKEN and SONARQUBE_ORG.
  • Connect to SonarQube Server with SONARQUBE_TOKEN and SONARQUBE_URL.
  • Search projects, branches, pull requests, issues, security hotspots, measures, metrics, quality gates, rules, dependency risks, duplicated files, source information, and system data.
  • Analyze code snippets directly inside the agent context.
  • Retrieve source, SCM, coverage, and duplications context when the token has permission.
  • Change issue status and security hotspot status when allowed by the token.
  • Toggle automatic analysis and create webhooks in supported configurations.
  • Run as the mcp/sonarqube container over stdio for local MCP clients.

Installation

For SonarQube Cloud, provide a token and organization key:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG mcp/sonarqube

For SonarQube Server, provide a token and server URL:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL mcp/sonarqube

Use SonarQube Cloud US by also setting SONARQUBE_URL to https://sonarqube.us.

Use Cases

  • Ask Claude to explain why a quality gate failed.
  • Summarize open code quality, security, or dependency-risk findings for a project or branch.
  • Investigate a security hotspot and draft remediation steps.
  • Pull project measures, coverage, duplications, or metrics into a code review.
  • Inspect branch and pull request context before deciding what to fix first.
  • Analyze a snippet inside the MCP workflow.
  • Prepare issue status or hotspot status updates for human review.

Safety and Privacy

Treat SonarQube MCP Server as access to code quality, source, and security intelligence. A broadly scoped token can expose source snippets, SCM data, security findings, dependency risks, logs, system metadata, and project relationships to the model context.

The server includes state-changing tools. Keep a human approval step before changing issue status, changing security hotspot status, toggling automatic analysis, creating webhooks, or taking any action that could alter audit trails or project configuration.

Review SonarSource licensing, product terms, container image practices, and telemetry behavior before using the server in regulated, confidential, or commercial environments. Keep tokens and server URLs in environment variables or secret stores, not prompts or repository files.

Duplicate Check

Existing entries cover other code quality, security, DevOps, and repository analysis tools, but no SonarQube MCP Server entry, SonarSource/sonarqube-mcp-server, mcp/sonarqube container entry, or matching source URL was found in content/mcp.

#sonarqube#code-quality#security#devops#analysis

Source citations

Add this badge to your README

Show that SonarQube MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/sonarqube-mcp-server.svg)](https://heyclau.de/entry/mcp/sonarqube-mcp-server)

How it compares

SonarQube MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

1 trust signal differ across this comparison (Submitter).

Field
SonarQube MCP Server logoSonarQube MCP Server

Official SonarSource MCP server that connects Claude to SonarQube Server or SonarQube Cloud for code quality, security issues, hotspots, measures, quality gates, branches, pull requests, snippets, and system context.

Open dossier
gcloud MCP Server logogcloud MCP Server

Google Cloud gcloud MCP server from googleapis that lets Claude run approved gcloud CLI commands with allowlist and denylist controls for cloud resource inspection, automation, and operations.

Open dossier
OpenTelemetry MCP Server for Claude

Analyze distributed traces and LLM observability data from Claude — search traces and spans, find errors, list services, analyze LLM token usage, identify slow LLM operations, and discover AI model usage patterns — with the OpenTelemetry MCP server supporting Jaeger, Grafana Tempo, and Traceloop backends.

Open dossier
Aiven MCP Server for Claude

Manage your Aiven cloud database services from Claude — list and monitor PostgreSQL, Apache Kafka, ClickHouse, Valkey, and OpenSearch services, execute SQL queries, manage Kafka topics and schemas, tail logs, and optimize queries — with the official Aiven MCP server.

Open dossier
Next steps
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
SubmitterDiffersoktofeesh1oktofeesh1——
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandSonarQube MCP Server logoSonarQube MCP Servergcloud MCP Server logogcloud MCP Server——
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
AuthorSonarSourceGoogle APIsTraceloopAiven
Added2026-06-062026-06-062026-06-182026-06-18
Platforms
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Harness
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Source repo————
Safety notes✓SonarQube MCP Server uses the permissions of the provided SonarQube token and can expose project, issue, hotspot, measure, branch, pull request, rule, source, and system information. Source code snippets, raw source, SCM details, coverage information, security findings, dependency risks, duplicated files, system logs, and health data can be sensitive. The source tree includes tools for changing issue status, changing security hotspot status, toggling automatic analysis, and creating webhooks; require human approval for actions that mutate SonarQube state. Use least-privilege tokens and separate development, staging, and production SonarQube contexts where possible. Container execution pulls and runs `mcp/sonarqube`; pin image versions or use reviewed container controls if your environment requires reproducible artifacts.✓gcloud MCP Server executes gcloud CLI commands with the permissions of the active gcloud account. Allowed commands can create, update, delete, deploy, scale, list, export, or configure Google Cloud resources depending on IAM permissions and selected services. The server blocks command substitution, pipes, redirection, SSH-style commands, interactive commands, and a default set of sensitive command prefixes, but allowed gcloud commands can still have real infrastructure, billing, IAM, and data impact. Use allowlists for narrow workflows and service account impersonation with limited roles when possible. Require human approval for IAM, billing, networking, firewall, storage, database, secret, deployment, delete, and production-impacting commands.✓All tools are read-only — the server queries trace data but does not modify your application or tracing backend. Trace data may contain sensitive information (request parameters, user IDs, SQL queries) — ensure Claude has appropriate access to this data.✓Write operations (create/update services, deploy apps) are available but require `AIVEN_READ_ONLY=false` — the server defaults to read-only mode. Aiven services include managed production databases — confirm before creating or modifying services.
Privacy notes✓SonarQube tokens, organization keys, server URLs, project keys, branch names, pull request identifiers, source snippets, issue messages, hotspot details, logs, and system metadata may appear in MCP client logs, model transcripts, and tool outputs. The repository includes telemetry sample documentation; review SonarSource telemetry, product, and data-processing policies before enabling the server in regulated environments. Do not paste SonarQube tokens, private server URLs, raw source, or security findings into public prompts, issues, screenshots, or repository files. Security issue and hotspot data can reveal exploitable weaknesses before fixes are released; limit model and user access accordingly.✓gcloud output can reveal project IDs, resource names, regions, IAM bindings, service accounts, logs, errors, labels, metadata, URLs, secrets references, billing context, and infrastructure topology. Authentication state, ADC files, service account impersonation details, access tokens, project IDs, and local gcloud configuration should stay out of prompts and repository files. Command output may be retained by the MCP client, model provider, terminal logs, shell history, and chat transcripts. Avoid broad listing or export commands against production projects unless data handling and retention have been reviewed.✓Distributed trace content including service names, operation names, error messages, HTTP parameters, and LLM prompt/response metadata may be surfaced in Claude's context. For Traceloop backend, `BACKEND_API_KEY` is required and grants access to your Traceloop organization's trace data.✓Service metadata, metrics, application logs, PostgreSQL query stats, Kafka topic configurations, and Schema Registry content from your Aiven account are surfaced in Claude's context. Your `AIVEN_TOKEN` grants account-level API access — keep it in the MCP config env and never commit it to version control.
Prerequisites
  • Docker or another OCI-compatible container runtime.
  • SonarQube Cloud organization key or SonarQube Server URL.
  • SonarQube user token scoped to the projects and actions Claude should access.
  • Organization policy for whether an agent may inspect source snippets, issues, hotspots, measures, quality gates, pull requests, server logs, or system data.
  • Node.js 20 or newer with npm or another compatible package runner.
  • Google Cloud CLI installed and authenticated.
  • Active gcloud account, project, and configuration scoped to the intended environment.
  • Least-privilege user or service account impersonation for the allowed cloud actions.
  • An OpenTelemetry-compatible tracing backend: Jaeger (local), Grafana Tempo, or Traceloop Cloud.
  • Services instrumented with OpenTelemetry sending traces to your backend.
  • Python 3.11+ with `uvx` available.
  • An MCP client such as Claude Code or Claude Desktop.
  • An Aiven account — sign up at aiven.io.
  • An Aiven API token: User Information → Authentication → Generate Token.
  • Node.js with `npx` available.
  • An MCP client such as Claude Code or Claude Desktop.
Install
docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG mcp/sonarqube
npx -y @google-cloud/gcloud-mcp
claude mcp add opentelemetry -e BACKEND_TYPE=jaeger -e BACKEND_URL=http://localhost:16686 -- uvx opentelemetry-mcp
claude mcp add --scope user aiven-mcp -e AIVEN_TOKEN=<your-token> -- npx -y mcp-aiven
Config
Manual-only setup:
claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG mcp/sonarqube
{
  "mcpServers": {
    "gcloud": {
      "command": "npx",
      "args": [
        "-y",
        "@google-cloud/gcloud-mcp"
      ],
      "type": "stdio"
    }
  }
}
{
  "mcpServers": {
    "opentelemetry": {
      "command": "uvx",
      "args": ["opentelemetry-mcp"],
      "env": {
        "BACKEND_TYPE": "jaeger",
        "BACKEND_URL": "http://localhost:16686",
        "MAX_TRACES_PER_QUERY": "100",
        "BACKEND_TIMEOUT": "30"
      }
    }
  }
}
{
  "mcpServers": {
    "aiven-mcp": {
      "command": "npx",
      "args": ["-y", "mcp-aiven"],
      "env": {
        "AIVEN_TOKEN": "<your-token>",
        "AIVEN_READ_ONLY": "true",
        "AIVEN_SERVICES_SCOPE": "kafka,pg"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Source-backed guides for putting this to work.

Auditing MCP Client Configuration Before Team Rollout

Audit MCP client configuration before sharing it with a team.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by YB0y

Auto Mode Hard-Deny Policies For Safe Automation

Set autoMode.hard_deny rules to block risky actions in auto mode.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by kiannidev

Claude Code in Regulated Finance Environments

Deploy Claude Code in security-sensitive finance environments.

Added 8mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by JSONbored

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.