# SonarQube MCP Server

Wires SonarQube Server or Cloud into your AI assistant so the agent can read code quality and security findings and analyze a snippet in context.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 671
- Author: SonarSource
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/SonarSource/sonarqube-mcp-server
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/sonarqube-mcp-server

## What it does

The server runs in a container and talks to the assistant over stdio. The image is `sonarsource/sonarqube-mcp`: it queries your SonarQube Server or Cloud instance and hands the agent quality and security data. Snippet analysis works inside the agent context too, without loading the whole project.

You need a SonarQube user token, plus an organization key for Cloud. Treat the token as a credential: passing it as a command-line argument leaves it in shell history, and committing it to version control is worse. Use environment variables instead. For SonarQube Cloud US the URL is `https://sonarqube.us`.

Startup goes through `docker run`, so Docker or another OCI-compatible runtime has to be on the machine. The plain `sonarsource/sonarqube-mcp` tag pulls the latest build each time, while a pinned tag such as `sonarsource/sonarqube-mcp:1.19.0.2785` gives you a reproducible one.

## Requirements
- Needs: Docker
- Environment variables: `SONARQUBE_TOKEN`, `SONARQUBE_ORG`, `SONARQUBE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env SONARQUBE_TOKEN=<SONARQUBE_TOKEN> --env SONARQUBE_ORG=<SONARQUBE_ORG> --env SONARQUBE_URL=<SONARQUBE_URL> --transport stdio sonarqube-mcp-server -- docker run -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG -e SONARQUBE_URL docker.io/sonarsource/sonarqube-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add sonarqube-mcp-server --env SONARQUBE_TOKEN=<SONARQUBE_TOKEN> --env SONARQUBE_ORG=<SONARQUBE_ORG> --env SONARQUBE_URL=<SONARQUBE_URL> -- docker run -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG -e SONARQUBE_URL docker.io/sonarsource/sonarqube-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "sonarqube-mcp-server": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "SONARQUBE_TOKEN",
                "-e",
                "SONARQUBE_ORG",
                "-e",
                "SONARQUBE_URL",
                "docker.io/sonarsource/sonarqube-mcp"
            ],
            "env": {
                "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>",
                "SONARQUBE_ORG": "<SONARQUBE_ORG>",
                "SONARQUBE_URL": "<SONARQUBE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "sonarqube-mcp-server": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "SONARQUBE_TOKEN",
                "-e",
                "SONARQUBE_ORG",
                "-e",
                "SONARQUBE_URL",
                "docker.io/sonarsource/sonarqube-mcp"
            ],
            "env": {
                "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>",
                "SONARQUBE_ORG": "<SONARQUBE_ORG>",
                "SONARQUBE_URL": "<SONARQUBE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e SONARQUBE_TOKEN=<SONARQUBE_TOKEN> -e SONARQUBE_ORG=<SONARQUBE_ORG> -e SONARQUBE_URL=<SONARQUBE_URL> sonarqube-mcp-server docker run -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG -e SONARQUBE_URL docker.io/sonarsource/sonarqube-mcp
```
Replace <…> with your own values

## When to use it
- read project quality metrics from SonarQube without opening the web UI
- walk through vulnerabilities and code smells inside the agent chat
- check a code snippet for issues without building the whole project
- pull Quality Gate status into the assistant's context
- connect a SonarQube Cloud instance to a local workflow

## Example prompts
- Show me the open vulnerabilities in the SonarQube project
- Run this snippet through SonarQube
- What is the Quality Gate status for the main project?

## Similar
- [sonarqube-mcp](https://affpapa.org/en/nevibecode/skills/sonarqube-mcp.md) — skill · 3600 installs
- [sast-configuration](https://affpapa.org/en/nevibecode/skills/sast-configuration.md) — skill · 10800 installs
- [code-auditor](https://affpapa.org/en/nevibecode/skills/code-auditor.md) — skill · 333 installs
- [security-best-practices](https://affpapa.org/en/nevibecode/plugins/security-best-practices.md) — plugin · ★ 40418
- [general-best-practices](https://affpapa.org/en/nevibecode/skills/general-best-practices.md) — skill · 794 installs
- [daily-coding](https://affpapa.org/en/nevibecode/skills/daily-coding.md) — skill · 368 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md