SonarQube MCP Server – Quick‑start guide for AI‑augmented code analysis

What it is – A Model Context Protocol (MCP) server that lets AI agents (Claude, Gemini, Copilot, Cursor, etc.) talk to a SonarQube instance (self‑hosted or SonarCloud). The server runs in a Docker container and exposes a simple JSON‑RPC‑style API that the agent can call to:

Submit whole‑project analyses
Analyse a single code snippet on‑the‑fly
Retrieve findings (bugs, security hotspots, code‑smells) for use in chat‑based coding assistants.

Why it matters – Modern LLM‑powered coding assistants need trustworthy, up‑to‑date static‑analysis data. By plugging SonarQube into the MCP ecosystem, you get high‑quality, language‑aware security and quality signals directly inside the chat, without having to run a full SonarQube scan yourself.

Getting started (the fastest way)

Open the configuration generator – https://mcp.sonarqube.com/config-generator.html. It asks for your SonarQube token (and optional org or server URL) and spits out a ready‑to‑paste JSON snippet.

Run the Docker image – the generator already points to sonarsource/sonarqube-mcp. Example command:

docker run --init --pull=always -i --rm \
    -e SONARQUBE_TOKEN=$YOUR_TOKEN \
    -e SONARQUBE_ORG=$YOUR_ORG   # only for SonarCloud
    sonarsource/sonarqube-mcp

Replace the env vars with the values the generator gave you.

Add the snippet to your agent’s MCP config – each supported agent (Claude, Gemini, Copilot, Cursor, VS Code, etc.) has a small UI/button that lets you paste the JSON. After that the agent can start asking SonarQube for analysis results.

Manual installation (if you prefer to build/run yourself)

Pull the image from Docker Hub: docker pull sonarsource/sonarqube-mcp.
Or build locally from this repo (see the GitHub Actions badge for the build status).

Required environment variables:

Variable	Meaning
`STORAGE_PATH`	Absolute path inside the container where the server stores its cache and temporary files. The official image sets this automatically.
`SONARQUBE_TOKEN`	Your SonarQube user token (never commit it).
`SONARQUBE_ORG`	Only for SonarCloud – organization key.
`SONARQUBE_URL`	URL of a self‑hosted SonarQube server (omit for SonarCloud).
`SONARQUBE_PROJECT_KEY`	Optional default project; useful when you always work on a single project.
`SONARQUBE_IDE_PORT`	Port used by SonarQube for IDE when you want the MCP server to talk to the IDE‑embedded analysis server (add `--network=host` on Linux).

How to hook it up to popular AI agents

The repo ships ready‑made snippets for many agents. The pattern is the same: a JSON object under mcpServers.sonarqube that tells the agent which command to run (docker run … sonarsource/sonarqube-mcp) and which environment variables to inject.

Agent	Where to paste the snippet
Claude	`claude mcp add sonarqube …` (see the Claude Code section)
Gemini	`gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins` then set env vars
GitHub Copilot CLI	`copilot mcp add` UI or edit `~/.copilot/mcp-config.json`
Cursor	Click the Install button on the Cursor page (URL provided in the README)
VS Code	Click the badge under the VS Code section – it opens a pre‑filled install wizard
Windsurf, Zed, Kiro, Antigravity	Similar JSON‑based config files – just copy the block from the corresponding collapsible section

All snippets follow the same shape, e.g. for SonarCloud:

{
  "command": "docker",
  "args": ["run","--init","--pull=always","-i","--rm","-e","SONARQUBE_TOKEN","-e","SONARQUBE_ORG","sonarsource/sonarqube-mcp"],
  "env": {"SONARQUBE_TOKEN":"<YOUR_TOKEN>","SONARQUBE_ORG":"<YOUR_ORG>"}
}

Replace the placeholders with your real token/org.

Security best practices (highlighted in the README)

Never put the token on the command line – it ends up in shell history. Use -e env vars as shown.
Never commit the token – keep it in environment variables or secret stores (GitHub Secrets, Copilot MCP secrets, etc.).
Pull the image regularly (--pull=always) to get the latest security fixes.

When would you use it?

Chat‑based code review – ask Claude or Gemini “What security issues does this PR have?” and the agent will query SonarQube via MCP and include the findings in its answer.
IDE‑integrated assistance – SonarLint/IDE plugins can call the MCP server to get richer context for on‑the‑fly suggestions.
CI/CD pipelines – add the MCP server as a step in a Copilot‑enabled pipeline to automatically surface SonarQube findings in the build logs.

Where to go next?

Read the full SonarQube product documentation: https://www.sonarsource.com/products/sonarqube/.
Explore the MCP protocol spec (search “Model Context Protocol” on SonarSource docs) to understand the request/response format.
If you need custom behaviour (e.g., filtering certain rule types), fork the repo and modify the server code – the CI badge shows the current build health.

TL;DR – The SonarQube MCP Server is a thin Docker‑based bridge that lets any LLM‑powered coding assistant query SonarQube for up‑to‑date quality and security analysis. Set it up with the config generator, run the container, add the JSON snippet to your agent, and you’ll have trustworthy static‑analysis data inside your AI‑driven workflow.

SonarSource/sonarqube-mcp-server