# sonarqube

Brings SonarQube code quality and security checks directly into the agent coding workflow. Catches bugs and leaked secrets during development.

- plugin · `type=plugin` · Claude Code, GitHub Copilot · ★ 113
- Author: SonarSource
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/SonarSource/sonarqube-agent-plugins
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/plugins/sonarqube

## What it does

This plugin injects SonarQube analysis right into local agent sessions. Hooks inspect modified files immediately after edits, screening against 7,500+ issue categories across 40+ programming languages. Before files reach the model, an inspection layer intercepts 450+ sensitive token patterns to block secret leakage.

Running the plugin requires a SonarQube instance (Cloud, Server, or Community Build), the `sonar` CLI, Node.js, and an active container engine like Docker, Podman, or Nerdctl. Without an available container runtime, the MCP server cannot launch. Setup is completed with `/sonarqube:sonar-integrate` or by running `sonar integrate claude`.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install sonarqube@claude-plugins-official
```
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-community
```
In the agent chat (not a shell):
```text
/plugin install sonarqube@claude-community
```
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-official
```

### GitHub Copilot

**Command from the source**
```bash
copilot plugin install sonarqube@awesome-copilot
```

## When to use it
- Stop API tokens and passwords from entering LLM context
- Spot bugs and security flaws right after an agent edits a file
- Verify quality gate status before committing changes
- Inspect project test coverage and duplication numbers

## Example prompts
- /sonarqube:sonar-quality-gate
- /sonarqube:sonar-integrate
- Check my code for open SonarQube issues and show coverage findings

## Similar
- [sonarqube-mcp](https://affpapa.org/en/nevibecode/skills/sonarqube-mcp.md) — skill · 3600 installs
- [SonarQube MCP Server](https://affpapa.org/en/nevibecode/mcp/sonarqube-mcp-server.md) — MCP server · ★ 674
- [static-code-analysis](https://affpapa.org/en/nevibecode/skills/static-code-analysis.md) — skill · 617 installs
- [dockerfile-validator](https://affpapa.org/en/nevibecode/skills/dockerfile-validator.md) — skill · 740 installs
- [ai-quality-gate](https://affpapa.org/en/nevibecode/mcp/ai-quality-gate.md) — MCP server · ★ 31
- [sast-scanning](https://affpapa.org/en/nevibecode/skills/sast-scanning.md) — skill · 372 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md