SonarQube MCP Server

About

## SonarQube MCP Server: Continuous Code Quality Inspection The **SonarQube MCP Server** integrates enterprise-grade code quality and security analysis into Google Antigravity, enabling continuous inspection that catches bugs, vulnerabilities, and code smells before they reach production. ### Why SonarQube MCP? - **Deep Analysis**: Detect bugs, vulnerabilities, and code smells with sophisticated static analysis across 25+ languages - **Security Focus**: Identify OWASP Top 10 vulnerabilities and security hotspots requiring review - **Quality Gates**: Enforce quality standards with configurable gates that prevent substandard code from merging - **Technical Debt**: Quantify and track technical debt with effort estimates for remediation planning - **Historical Trends**: Track quality metrics over time to measure improvement and prevent regression ### Key Features #### 1. Code Analysis ```python from anthropic import Anthropic client = Anthropic() response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Run SonarQube analysis on the main branch and show critical issues by category" }] ) ``` #### 2. Security Scanning ```python # Check security issues response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "List all security vulnerabilities and hotspots, prioritized by severity" }] ) ``` #### 3. Quality Gate Status ```python # Check quality gates response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Show quality gate status for the feature branch and what conditions are failing" }] ) ``` #### 4. Technical Debt Report ```python # Analyze technical debt response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Generate technical debt report showing effort estimates for each component" }] ) ``` ### Configuration ```json { "mcpServers": { "sonarqube": { "command": "npx", "args": ["-y", "@anthropic/mcp-server-sonarqube"], "env": { "SONAR_HOST_URL": "https://sonarqube.yourcompany.com", "SONAR_TOKEN": "your-sonar-token" } } } } ``` ### Use Cases **CI/CD Integration**: Block deployments automatically when quality gates fail to maintain standards. **Security Compliance**: Meet security requirements by tracking and resolving vulnerabilities systematically. **Code Review Enhancement**: Use SonarQube findings to inform and prioritize code review efforts. **Team Improvement**: Track quality metrics per team to identify coaching opportunities and celebrate improvements. The SonarQube MCP Server brings enterprise code quality practices into your AI-assisted development workflow, ensuring consistent standards and continuous improvement.

Installation

{
  "mcpServers": {
    "sonarqube": {
      "mcpServers": {
        "sonarqube": {
          "env": {
            "SONAR_URL": "https://sonarqube.example.com",
            "SONAR_TOKEN": "your-token"
          },
          "args": [
            "-y",
            "sonarqube-mcp-server"
          ],
          "command": "npx"
        }
      }
    }
  }
}

How to Use

1. 1Deploy SonarQube server
2. 2Generate token
3. 3Analyze code quality