What is SonarQube MCP Server?
The SonarQube MCP Server is SonarSource's official server for connecting AI agents to SonarQube Cloud and SonarQube Server. The repo is SonarSource/sonarqube-mcp-server (there is no separate sonar-mcp-server); release 1.31.0 shipped on 2 November 2026. It lets an agent search issues and Security Hotspots, check a project's quality gate, read coverage, duplication and dependency-risk data, and run Sonar's analysers on a file before it is committed.
You run it yourself as the sonarsource/sonarqube-mcp container over stdio or Streamable HTTP, or, since March 2026, point an HTTP client at the hosted endpoint built into SonarQube Cloud at https://api.sonarcloud.io/mcp. The server itself is free, under the source-available SONAR Source-Available License, but it is only as useful as the SonarQube plan behind it.
How to install SonarQube MCP Server
docker run --init -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp (or https://api.sonarcloud.io/mcp)Is SonarQube MCP Server worth it?
The SonarQube MCP Server is worth installing for any team that already gates pull requests on SonarQube, and close to pointless for anyone who does not. Its value is that the agent sees the same issues, rules and quality-gate verdict your CI will apply, and can fix a failing gate before the pull request is opened. The README documents 51 tools across 20 toolsets, from search_sonar_issues_in_projects and get_project_quality_gate_status to coverage lookups that list the exact uncovered lines.
Analysis is the part to understand. The default analyze_code_snippet tool runs Sonar's analysers on a file, but the agent has to pass the whole file as an argument, which spends context on every call; mounting the project into the container at /app/mcp-workspace lets the server read files from disk instead. The deeper Vortex analysis and code-context tools (call graphs, type hierarchies, dependency checks) only work over stdio, need a workspace mount and need an organisation entitled to the Vortex add-on, which Sonar's pricing lists for Enterprise customers.
The hosted Cloud endpoint removes Docker but trims the toolset: Sonar's docs say it exposes "a smaller, fixed subset of tools", disables heavy analysis to protect shared infrastructure, and cannot run Vortex. OAuth sign-in works there for an approved list of clients including Claude Code, Codex, Cursor, VS Code and ChatGPT; self-run servers still need a SonarQube user token, and SonarQube Server must be 2025.1 or later.
The catch: write tools are on unless you set SONARQUBE_READ_ONLY=true, so an agent can mark an issue as a false positive or accept a Security Hotspot, which is exactly the shortcut a model under pressure to pass a gate might take. The self-run server also sends anonymous usage telemetry to SonarSource by default (no source code, according to the README) until you set TELEMETRY_DISABLED=true, and open issues report the server failing every call until restarted after its SonarQube instance restarts.
Our take: run it read-only and let the CI quality gate remain the authority. Semgrep's server is the better fit for a team without a Sonar contract, because its free engine works on its own.
Where it earns its place
A 15-developer Java team on SonarQube Cloud Team
Stop agent-written pull requests from failing the quality gate
The agent calls get_project_quality_gate_status and search_sonar_issues_in_projects on its branch, fixes what it finds, then opens the pull request. Run with SONARQUBE_READ_ONLY=true so it fixes code rather than closing issues. Costs nothing beyond the Team plan, from $34 a month for 100k lines.
An engineer told to raise coverage on a legacy module
Write tests for the lines nobody covered
search_files_by_coverage lists the worst-covered files and get_file_coverage_details gives the exact uncovered lines and branches, so the agent writes targeted tests instead of guessing.
An engineering manager at a bank that bans local Docker
Give developers Sonar findings in their AI assistant without installing anything
Point Claude Code or VS Code at https://api.sonarcloud.io/mcp and sign in with OAuth. The hosted server has fewer tools and no heavy analysis, but needs no deployment or token handling on laptops.
Before you commit
- Setup
- docker run --init -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp, with documented configs for Claude Code, Codex, Cursor, Copilot, Gemini CLI, Kiro, VS Code, Windsurf and Zed and a config generator at mcp.sonarqube.com; or the hosted https://api.sonarcloud.io/mcp (https://api.sonarqube.us/mcp for the US region).
- Integrations
- 51 tools in 20 toolsets: issues, Security Hotspots, quality gates, rules, measures, coverage, duplications, dependency risks, sources, webhooks, portfolios and Server administration, plus Vortex context and architecture tools. Write tools include change_sonar_issue_status, change_security_hotspot_status and create_webhook; SONARQUBE_TOOLSETS and SONARQUBE_READ_ONLY narrow the list.
- Data and privacy
- A user token reads whatever that user can see, including raw source via get_raw_source if the sources toolset is on. The hosted endpoint runs on Sonar's infrastructure; OAuth scopes mcp:tools:read and mcp:tools:write separate read and write access. Self-run servers send anonymous telemetry unless TELEMETRY_DISABLED=true. No published security advisories.
- Cost at scale
- The server is free; the bill is SonarQube. Cloud Team starts at $34 a month for 100k lines of private code and is free up to 50k; Server is quoted per instance per year by lines of code, and over the licensed lines new analyses are rejected. Vortex, Advanced Security (dependency risks) and Sonar's agents are extra subscriptions. Sonar publishes no rate limits for the MCP endpoint.
- Limits
- Hosted endpoint has a fixed, smaller toolset and no Vortex; OAuth not yet supported for SonarQube Server; Server 2025.1 or Community Build 25.1 minimum; Server connections need a USER token, not project or global tokens. Open issues report calls failing permanently after the SonarQube instance restarts.
What’s good
- Same issues, rules and quality gate as your SonarQube CI
- Hosted Cloud endpoint with OAuth, no Docker needed
- Read-only mode and per-toolset filtering to cut context
- Line-level coverage tools for writing missing tests
- Frequent releases from SonarSource itself
What’s not
- Little use without a SonarQube Cloud or Server subscription
- Write tools on by default; an agent can mark findings as false positives
- Snippet analysis passes whole files through the context unless you mount the workspace
- Vortex analysis needs a paid Enterprise add-on and stdio
- Telemetry on by default; source-available, not open-source, licence
Best for
Teams that already gate merges on SonarQube and want their coding agent to meet that gate before a pull request is opened.
SonarQube MCP Server alternatives
SonarQube MCP Server: common questions
- Is SonarQube MCP Server worth it?
- If your merges already wait on a SonarQube quality gate, this lets the agent read that gate before you do; without a SonarQube subscription it has little to offer. We rate it 4.1 out of 5.
- How much does SonarQube MCP Server cost?
- Server free (SONAR Source-Available Licence). SonarQube Cloud free for private projects up to 50k lines of code; Team from $34/month for 100k lines; Server editions priced per instance per year by lines of code, quote only; Vortex is a separate add-on.
- What are the downsides of SonarQube MCP Server?
- Little use without a SonarQube Cloud or Server subscription; write tools on by default; an agent can mark findings as false positives; snippet analysis passes whole files through the context unless you mount the workspace; vortex analysis needs a paid Enterprise add-on and stdio; telemetry on by default; source-available, not open-source, licence.
- Who is SonarQube MCP Server best for?
- Teams that already gate merges on SonarQube and want their coding agent to meet that gate before a pull request is opened.
- How much does SonarQube MCP Server cost for a team or in production?
- The server is free; the bill is SonarQube. Cloud Team starts at $34 a month for 100k lines of private code and is free up to 50k; Server is quoted per instance per year by lines of code, and over the licensed lines new analyses are rejected. Vortex, Advanced Security (dependency risks) and Sonar's agents are extra subscriptions. Sonar publishes no rate limits for the MCP endpoint.
- Is SonarQube MCP Server safe for company data?
- A user token reads whatever that user can see, including raw source via get_raw_source if the sources toolset is on. The hosted endpoint runs on Sonar's infrastructure; OAuth scopes mcp:tools:read and mcp:tools:write separate read and write access. Self-run servers send anonymous telemetry unless TELEMETRY_DISABLED=true. No published security advisories.
- What are the best SonarQube MCP Server alternatives?
- The closest alternatives we have reviewed are Semgrep MCP, Snyk MCP Server (Snyk Studio) and GitHub MCP Server.
Answers checked Nov 9, 2026.
Make SonarQube MCP Server? Show this rating on your site
