SonarQube MCP Server

SonarSource's official MCP server: agents query SonarQube Cloud or Server issues, quality gates, hotspots and metrics, and analyze code snippets.

Category

MCP Servers

Website

https://www.sonarsource.com/products/sonarqube/mcp-server/

Repository

https://github.com/SonarSource/sonarqube-mcp-server

Docs

https://docs.sonarsource.com/sonarqube-mcp-server

Status

active

Pricing

freemium

License

LicenseRef-Sonar-Source-Available-1.0

Maintainer

SonarSource

Added

2026-10-28

Updated

2026-10-28

Last verified

2026-10-28

Submitted by

agentica-curator

Tags

• mcp
• code-quality
• security
• static-analysis
• sast

Description

Tool groups include analysis (snippet analysis in the agent context), coverage, dependency risks, issues, security hotspots, measures and metrics, projects, quality gates, rules, duplications, sources, portfolios, webhooks and context augmentation, with selective tool enablement to cut context. Runs from the sonarsource/sonarqube-mcp container (or a standalone JAR) over stdio, Streamable HTTP or HTTPS; Sonar also runs a hosted SonarQube Cloud MCP service that supports OAuth (mcp:tools:read / mcp:tools:write scopes). A config generator is at mcp.sonarqube.com. Latest release 1.30.0.4763 (2026-10-23).

Agent access

Auth

api-key

Notes

SONARQUBE_TOKEN (user token) plus SONARQUBE_ORG for Cloud or SONARQUBE_URL for Server (https://sonarqube.us for Cloud US). OAuth only on Sonar's hosted Cloud MCP service; self-hosted SonarQube Server still uses tokens.

Related

• Semgrep MCP (Semgrep Guardian): Semgrep's MCP server, now shipped in the semgrep CLI (`semgrep mcp`) and bundled as Semgrep Guardian plugins to scan agent-written code for vulnerabilities.
• Snyk Agent Scan: Security scanner that discovers agent components on your machine (agents, MCP servers, skills) and scans them for prompt injections and vulnerabilities.
• GitHub MCP Server: GitHub's official MCP server: lets agents read repos and code, manage issues and PRs, analyze code and monitor Actions workflows.

Guides & comparisons

• Scan agent-written code for vulnerabilities with the Semgrep MCP server (Guide): Give a coding agent a deterministic security scanner. Install the Semgrep CLI, run its built-in MCP server (`semgrep mcp`), wire it into Claude Code, Cursor, VS Code, Codex or Kiro, and call semgrep_scan and custom-rule scans. Includes two gotchas we hit, and when SonarQube's MCP server fits better.

Sources

• https://github.com/SonarSource/sonarqube-mcp-server
• https://github.com/SonarSource/sonarqube-mcp-server/blob/master/LICENSE
• https://github.com/SonarSource/sonarqube-mcp-server/releases/tag/1.30.0.4763
• https://mcp.sonarqube.com/config-generator.html

Machine-readable

• JSON
• Markdown
• Source file on GitHub (edit via pull request)