MCP server · Code and developer tools
SonarQube MCP server
Connects an assistant to SonarQube Cloud or Server to analyse code, review issues and hotspots, and check quality gates.
- Maintainer
- SonarSource (official)
- Licence
- Not published (hosted service)
- Runs
- Locally (docker)
- Sign-in
- A token or API key
- Registry version
- 1.21.0 (updated 2026-06-25)
- Last activity
- 2026-10-14
Overview
What it does
SonarSource’s MCP server links an assistant to SonarQube Cloud or SonarQube Server. The recommended setup runs the sonarsource/sonarqube-mcp container image over stdio, with a user token and either your SonarQube Cloud organisation key or your server URL. An online configuration generator produces ready-made settings for common clients. HTTP and HTTPS transports are available for shared deployments. It is published under the SONAR Source-Available Licence v1.0, not an open source licence.
Use it when your projects are already analysed by SonarQube and you want an assistant to read issues, fix them and confirm the quality gate passes. It can also analyse code snippets or files in the agent’s context. Tools come in toolsets, and only a core set (analysis, issues, projects, quality gates, rules, measures, security hotspots and more) is on by default; SONARQUBE_TOOLSETS changes the list. Mounting your project at /app/mcp-workspace lets the server read files from disk, which saves context.
Tools
What the assistant can do
- Analyse code snippets and files against Sonar rules
- Search issues and change their status
- Search and review Security Hotspots
- Check quality gate status and project measures
- Browse rules, duplications and test coverage
- Analyse dependency risks (SCA)
- Opt-in portfolio, webhook and system administration toolsets
Install
Install SonarQube MCP server in your app
You need:
- Docker or another OCI container runtime
- A SonarQube Cloud organisation key, or a SonarQube Server URL (pass SONARQUBE_URL instead of SONARQUBE_ORG)
- A SonarQube user token
Run in your project. --scope local keeps the servers private to you in this project; use user for every project.
claude mcp add --env SONARQUBE_TOKEN="${SONARQUBE_TOKEN}" --env SONARQUBE_ORG="${SONARQUBE_ORG}" --scope local sonarqube -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp
claude mcp add --env SONARQUBE_TOKEN="$env:SONARQUBE_TOKEN" --env SONARQUBE_ORG="$env:SONARQUBE_ORG" --scope local sonarqube -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp
- Set SONARQUBE_TOKEN, SONARQUBE_ORG first, e.g. export SONARQUBE_TOKEN=… in your shell. The command saves the value, not the variable.
Project root. Commit it to share the servers with your team; each person sets the variables in their own shell.
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "${SONARQUBE_TOKEN}",
"SONARQUBE_ORG": "${SONARQUBE_ORG}"
}
}
}
}
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json (Settings → Developer → Edit Config). Restart Claude after saving.
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "<SONARQUBE_TOKEN>",
"SONARQUBE_ORG": "<SONARQUBE_ORG>"
}
}
}
}
- Claude Desktop doesn’t read variables in this file: replace <SONARQUBE_TOKEN>, <SONARQUBE_ORG> with the real values.
- This file contains your keys once filled in. It lives in your user folder; never commit or share it.
In your project, or ~/.cursor/mcp.json for every project.
{
"mcpServers": {
"sonarqube": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "${env:SONARQUBE_TOKEN}",
"SONARQUBE_ORG": "${env:SONARQUBE_ORG}"
}
}
}
}
In your workspace. VS Code asks for each secret the first time a server starts and stores it securely.
{
"inputs": [
{
"type": "promptString",
"id": "sonarqube-token",
"description": "SONARQUBE_TOKEN",
"password": true
},
{
"type": "promptString",
"id": "sonarqube-org",
"description": "SONARQUBE_ORG",
"password": true
}
],
"servers": {
"sonarqube": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "${input:sonarqube-token}",
"SONARQUBE_ORG": "${input:sonarqube-org}"
}
}
}
}
macOS/Linux: ~/.config/devin/mcp_config.json · Windows: %APPDATA%\devin\mcp_config.json. Read by the default Devin Local agent and by the legacy Cascade agent.
{
"mcpServers": {
"sonarqube": {
"command": "docker",
"args": [
"run",
"--init",
"--pull=always",
"-i",
"--rm",
"-e",
"SONARQUBE_TOKEN",
"-e",
"SONARQUBE_ORG",
"sonarsource/sonarqube-mcp"
],
"env": {
"SONARQUBE_TOKEN": "${env:SONARQUBE_TOKEN}",
"SONARQUBE_ORG": "${env:SONARQUBE_ORG}"
}
}
}
}
- Devin’s docs confirm ${env:…} references for the legacy Cascade agent; for the default Devin Local agent they only document them in OAuth settings. If a server can’t authenticate, check Devin’s MCP docs.
Want it alongside other servers? Open SonarQube MCP Server in the MCP config generator and add the rest; it writes one file per app. The snippets follow the setup in the server’s README, checked on 2026-10-14.
Before you install
- Set SONARQUBE_READ_ONLY=true to disable write tools such as changing issue status, and use SONARQUBE_TOOLSETS to limit the tools offered.
- Mounting a directory at /app/mcp-workspace gives the server read access to those files.
- The server sends anonymous usage data to SonarSource. Set TELEMETRY_DISABLED=true to turn it off.
- A local MCP server runs with your user account’s permissions. Install it only from the source linked above. See how to choose a safe server.
Why it’s listed
Why we list it
Puts an established code quality and security platform in the assistant’s loop, with read-only and toolset controls documented by the vendor.
Related
More MCP servers
- GitHub MCP ServerLets an assistant read code, manage issues and pull requests, and check Actions runs in the GitHub repositories you can access.
- GitLab MCP serverGives an assistant access to GitLab projects, issues, merge requests, pipelines and search through an MCP endpoint built into GitLab.
- Sentry MCPLets a coding assistant search Sentry errors, traces and logs, triage issues and read Sentry docs while you debug.
- Figma MCP serverGives a coding assistant design context from Figma files, such as layout, variables and components, and can write back to the canvas.
- Semgrep MCP serverLets an assistant scan code for security issues with Semgrep, write custom rules and pull findings from Semgrep AppSec Platform.
- Postman MCP ServerConnects an assistant to your Postman workspaces, collections, specs and environments, and can generate client code from APIs.
All MCP serversMCP config generatorGuide: MCP servers in Claude CodeGuide: what is MCP?