Happy slice of mcp pizzaMCP.pizza

sonarqube-mcp-server

MCP.Pizza Chef: SonarSource

SonarQube scans code for bugs, security holes, and messy patterns. This connects those findings to your editor's AI assistant, so instead of opening a separate dashboard you can ask what is wrong and get an explanation in place. It works in Cursor, VS Code, Windsurf, and Zed. You connect it either to SonarQube's hosted service or your own installation, and you need a token from your account.

Coding
Data

Use This MCP server To

Ask why a piece of my code was flagged Find the security problems in my project Get a plain explanation of a code warning See which files have the most issues Check if my changes introduced new problems Have my assistant suggest a fix for a finding

README

SonarQube MCP Server

Build Quality Gate Status

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Quick setup

Security best practices

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

  • Avoid hardcoding tokens in command-line arguments – they get saved in shell history
  • Use environment variables – set tokens in environment variables before running commands

When using configuration files:

  • Never commit tokens to version control
  • Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

sonarqube-mcp-server FAQ

Can I use this to understand why my code was flagged?
Yes — you can ask about a specific finding and get an explanation without leaving your editor.
Which editors does it work in?
It is set up for Cursor, VS Code, Windsurf, and Zed.
Do I need an account or token?
Yes, you need a token from either SonarQube's hosted service or your own installation.
Can I use this to find security problems before I ship?
Yes — it surfaces security findings alongside quality ones, so you can review them as you work.
How hard is it to set up?
It expects you to run it with Docker or connect to a hosted address, so some technical comfort helps.
Does it work with my own SonarQube installation?
Yes, you can point it at your own server rather than the hosted service.