SonarQube MCP Server

Name: SonarQube MCP Server
Author: Sonar

SonarQube Cloud or Server findings, quality gates and code analysis inside your coding assistant

Official · Sonar Java Local · stdio Developer tools Security

GitHub Docker Hub Website

80 popularity score ★ 680 ⇣ 712k pulls

Connect your client

Local (Docker)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.

Or add it by command or config

It needs SONARQUBE_TOKEN. Replace each <NAME> with your value.

Claude CodeTerminal

claude mcp add sonarqube -e SONARQUBE_TOKEN=<SONARQUBE_TOKEN> -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>"
      }
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>"
      }
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "sonarqube": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>"
      }
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]

[mcp_servers.sonarqube.env]
SONARQUBE_TOKEN = "<SONARQUBE_TOKEN>"

Gemini CLITerminal

gemini mcp add --scope user -e SONARQUBE_TOKEN=<SONARQUBE_TOKEN> sonarqube docker -- run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

Settings 12

Set together: analysis
`SONARQUBE_TOKEN` secret	Required: SonarQube Cloud token, or a USER token for SonarQube Server.
`SONARQUBE_ORG`	Optional: Cloud organization key to pin; without it tools take an organization argument.
`SONARQUBE_URL`	Optional: Server address (needed for SonarQube Server); https://sonarqube.us for Cloud US. Default `https://sonarcloud.io`.
`SONARQUBE_TOOLSETS`	Optional: Comma-separated toolsets to enable instead of the default set (e.g. vortex).
`SONARQUBE_READ_ONLY`	Optional: true hides every tool that can change data. Default `false`.
`SONARQUBE_PROJECT_KEY`	Optional: Default project key; removes projectKey from tool inputs.
`TELEMETRY_DISABLED`	Optional: true stops anonymous usage data being sent to SonarSource. Default `false`.
`STORAGE_PATH`	Optional: Writable folder for the server's files; set by the image, required when running the JAR.
`SONARQUBE_IDE_PORT`	Optional: Port 64120-64130 of a running SonarQube for IDE to use for analysis. For analyze_file_list.
`SONARQUBE_FORCE_LOCAL_ANALYSIS`	Optional: true keeps analyze_code_snippet instead of Vortex analysis on Cloud over stdio; needs the analysis toolset. Default `false`. For analyze_code_snippet.
Set together: http
`SONARQUBE_TRANSPORT`	Optional: http or https to serve Streamable HTTP instead of stdio.
`SONARQUBE_HTTP_HOST`	Optional: Address the HTTP service binds to. Default `127.0.0.1`.

In a container, a setting goes in with -e NAME=value after docker run.

What it does

SonarSource's own MCP server connects an assistant to SonarQube Cloud or a self-managed SonarQube Server. The assistant can look up issues and security hotspots and change their status, check a project's quality gate, read measures, coverage and duplication data, inspect rules, list branches and pull requests, and on Server read system health and logs. It can also run SonarQube's analyzers on a file the assistant is working on.

Only a token is needed to start. With no SONARQUBE_URL it connects to SonarQube Cloud (sonarcloud.io); SONARQUBE_ORG is now optional and, when set, pins one Cloud organization. Without it, list_organizations finds the user's organizations and organization-aware tools take an optional organization argument.

Which analysis tool appears is decided at startup, per the 1.30.0.4763 source. Over stdio on Cloud, run_advanced_code_analysis (Vortex) replaces analyze_code_snippet when a workspace is mounted at /app/mcp-workspace and an organization is entitled to Vortex; SONARQUBE_FORCE_LOCAL_ANALYSIS=true keeps analyze_code_snippet instead. Otherwise, if SonarQube for IDE answers on SONARQUBE_IDE_PORT, analyze_file_list and toggle_automatic_analysis are offered; if not, analyze_code_snippet. On a Vortex-entitled Server without a workspace mount, the code registers no analysis tool at all. Over HTTP, Cloud gets no analysis tools and Server gets analyze_code_snippet only when a startup SONARQUBE_TOKEN is set. The Vortex context tools come from a separate proxied server, stdio only,; the new vortex toolset replaces cag. Enterprise, organization and agentic readiness tools are Cloud-only; system tools are Server-only.

Two settings the code reads are not in the README: SONARQUBE_IS_CLOUD=true forces Cloud mode, and the older SONARQUBE_CLOUD_URL is still accepted when SONARQUBE_URL is unset. It runs over stdio by default, or as a stateless Streamable HTTP service (SONARQUBE_TRANSPORT=http or https) where each request brings its own bearer token.

What it needs

Runtime	Docker
Runs on	macOS, Windows, Linux
SonarQube Cloud	Free tierUser token; Vortex and agentic readiness tools need an organization entitlement
SonarQube Server	Your own instance2025.1 or later (Community Build 25.1+), USER token only; dependency risks need 2025.4 Enterprise with Advanced Security

Docker runs the sonarsource/sonarqube-mcp image, or Java 21+ runs the release JAR, which then also needs STORAGE_PATH set to a writable folder. Create a USER token in SonarQube (project and global tokens do not work on Server). For Server, set SONARQUBE_URL; without it the server connects to SonarQube Cloud. Images are tagged latest, by build (1.30.0.4763) and, for some releases, by the SonarQube Server version they align with (e.g. 2026.5.0).

Limits

Not covered In stdio mode it exits at start without SONARQUBE_TOKEN, and exits when the SonarQube Server is older than 2025.1 (Community Build 25.1).
Limit analyze_code_snippet is deprecated in favour of analyze_file_list and Vortex analysis.
Not covered Vortex context and analysis tools work over stdio only; Cloud in HTTP mode offers no analysis tools.
Not covered On a Vortex-entitled Server without a workspace mounted at /app/mcp-workspace, no analysis tool is registered (1.30.0.4763 source).
Cost Vortex, agentic readiness and dependency-risk tools need paid entitlements or editions.
Limit In HTTP mode the SONARQUBE_TOKEN header and a server-level SONARQUBE_ORG are deprecated; OAuth is for Sonar's hosted Cloud service only.
Early release The architecture toolset (architecture_get, and architecture_set that replaces a Cloud project's intended model) is on the main branch and in the README but not yet in a release.
Limit Licensed under the SONAR Source-Available License, not an open-source licence; use of results is bound by SonarQube's terms.

In stdio mode it exits at start without SONARQUBE_TOKEN, and without either SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server); it also exits when the Server version is older than 2025.1. analyze_code_snippet is deprecated and slated for removal. The Vortex tools only work over stdio. search_duplicated_files fetches at most 10,000 files. Sending a SONARQUBE_TOKEN header in HTTP mode is deprecated in favour of Authorization: Bearer. Licensed under the SONAR Source-Available License, not an open-source licence; use of results is bound by SonarQube's terms.

Who it suits

Teams already on SonarQube Cloud or SonarQube Server 2025.1 or later who want an assistant to triage issues, check quality gates or analyse a file before committing. Being SonarSource's own server, it tracks product features such as Vortex and dependency risks, though several need paid entitlements. Users on SonarQube Server 9.x or 10.x cannot use it, as it refuses older versions. Anyone wanting only lookups can set SONARQUBE_READ_ONLY=true; anyone without a SonarQube account gets nothing from it.

Tools 49

44 only read, 5 change things.

analyze_code_snippet: Run SonarQube analyzers on file content or a mounted file path (deprecated)
analyze_file_list: Have a running SonarQube for IDE analyse a list of files
toggle_automatic_analysis changes: Turn SonarQube for IDE's automatic analysis on or off
run_advanced_code_analysis: Run Vortex analysis on a file in the mounted workspace
search_files_by_coverage: List a project's files ordered from lowest coverage
get_file_coverage_details: Show line-by-line coverage for a file
search_dependency_risks: List dependency risks found by software composition analysis
list_enterprises: List the Cloud enterprises the token can see (Cloud only)
list_organizations: List the Cloud organizations the user belongs to, with keys and IDs (Cloud only)
change_sonar_issue_status changes: Accept, mark false positive or reopen an issue
search_sonar_issues_in_projects: Search issues across projects with filters
search_security_hotspots: Search security hotspots in a project
show_security_hotspot: Show the details of one security hotspot
change_security_hotspot_status changes: Change the review status of a security hotspot
list_languages: List the languages the instance supports
get_component_measures: Read metric values for a project, folder or file
search_metrics: List available metric definitions
list_portfolios: List enterprise portfolios
search_my_sonarqube_projects: Find projects the user can access
list_branches: List a project's branches
list_pull_requests: List a project's analysed pull requests
get_project_quality_gate_status: Report whether a project passes its quality gate
list_quality_gates: List the defined quality gates
show_rule: Show what a rule checks and why
search_duplicated_files: List files in a project that contain duplicated code
get_duplications: Show the duplicated blocks in a file
get_raw_source: Fetch a file's source text from SonarQube
get_scm_info: Fetch blame and commit data for a source file
get_system_health: Report Server health (Server only)
get_system_info: Report Server configuration, JVM and database details (Server only)
get_system_logs: Read Server system logs (Server only)
ping_system: Check that the Server answers (Server only)
get_system_status: Report Server version and run state (Server only)
create_webhook changes: Create a webhook on an organization or project
list_webhooks: List webhooks on an organization or project
search_by_signature_patterns: Find code elements whose declarations match regexes (Vortex)
search_by_body_patterns: Find code elements whose bodies match regexes (Vortex)
get_upstream_call_flow: Trace what calls a function (Vortex)
get_downstream_call_flow: Trace what a function calls (Vortex)
get_source_code: Fetch the code of an element found by Vortex
get_type_hierarchy: Show a type's parents and children (Vortex)
get_references: List direct inbound and outbound references of a class or module (Vortex)
get_current_architecture: Describe the project's current architecture (Vortex)
get_intended_architecture: Describe the project's intended architecture (Vortex)
get_guidelines: Fetch coding guidelines for categories or languages (Vortex)
check_dependency: Check whether a dependency between modules is allowed (Vortex)
start_agentic_readiness_assessment changes: Start an agentic readiness assessment of a branch (Cloud only)
get_agentic_readiness_assessment: Read the result of an agentic readiness assessment
list_agentic_readiness_assessments: List past agentic readiness assessments

Popularity

80 popularity score, on our list (the bar is 36)

★ 680 ⇣ 712k pulls

GitHub stars	680	34 points
Stars in 30 days	+22	6.8 points
Docker Hub pulls	712,140	30.8 points
Official server	Yes	8 points

Measured 2026-11-07. How the score works.

Where it is published

Code	sonarsource/sonarqube-mcp-server ★ 680
Docker Hub	sonarsource/sonarqube-mcp

What it can reach

Runs	On your machine
Reaches	The internet, Your code, Files on your machine
Changes things	Yes: it can write, send, create or delete
Sign-in	An API key or token
Licence	SONAR Source-Available License v1.0 (its licence file)
Usage data	Sends it unless you turn it off (`TELEMETRY_DISABLED`) Anonymous usage data sent to SonarSource; its README says no source code or IP address
Latest version	1.31.0.4891 GitHub release, 2026-11-02
Last code change	2026-11-06

Runs on your machine (Docker or Java) and calls the SonarQube Cloud or Server API with the token you supply, so it can see whatever that token's user can see, including source code via get_raw_source. Tools can change issue and hotspot statuses, create webhooks, start readiness assessments and toggle IDE analysis; SONARQUBE_READ_ONLY=true removes those. With a workspace mounted at /app/mcp-workspace it reads project files from disk. System tools expose Server logs and configuration to admin tokens. It sends anonymous usage data to SonarSource unless TELEMETRY_DISABLED=true. HTTP mode binds to 127.0.0.1 unless SONARQUBE_HTTP_HOST is set.

Over time

GitHub stars 680 +22 (+3 %)

680658

9 Oct 20267 Nov 2026

Docker Hub pulls 712k +309k (+77 %)

712k403k

9 Oct 20267 Nov 2026

Popularity score 80 +17 (+27 %)

8063

9 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-11-01.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![SonarQube MCP Server on EveryMCPServer](https://everymcpserver.com/badge/sonarqube-mcp-server.svg)](https://everymcpserver.com/servers/sonarqube-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Settings 12

What it does

What it needs

Limits

Who it suits

Tools 49

Similar servers

CodeQL Development MCP Server

SmartBear MCP Server

maven-mcp

Clerk MCP Server

BC Code Intelligence MCP Server

Socket MCP Server