MCP server · SonarSource
SonarQube MCP Server
⚠ No independent security audit: entries summarize official sources only. Review permissions and code before installing.
- Type
- MCP server
- Tasks
- Code review
- Compatible agents
- Google Antigravity, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, Kiro, VS Code, Windsurf, Zed (source: clients with a setup heading or install/config instructions in the official README)
- Verdict
- Pick it if your project already runs on SonarQube Cloud or Server and you want the agent to read issues and quality gates during review; set SONARQUBE_READ_ONLY=true for review-only use.
- Permissions
- Reads issues, quality gates, measures, security hotspots, coverage and rules from SonarQube Cloud or Server with the token's rights, and can analyze file content; some tools write (e.g. changing issue status) unless SONARQUBE_READ_ONLY=true. Sends anonymous usage telemetry unless TELEMETRY_DISABLED=true.
- Credentials
- SonarQube user token (SONARQUBE_TOKEN) plus SONARQUBE_ORG for SonarQube Cloud or SONARQUBE_URL for SonarQube Server.
- Maintenance
- Release 1.29.0.4488 on 2026-10-13; last commit 2026-10-19
- License
- SONAR Source-Available License v1.0 (per LICENSE; GitHub detects no SPDX license)
- Install
- Run the `sonarsource/sonarqube-mcp` container from your client's MCP config (e.g. `claude mcp add sonarqube`), or use the official configuration generator (see README). Official install docs ↗
- Source
- https://github.com/SonarSource/sonarqube-mcp-server
- Verified on
- 2026-10-18