--- title: "SonarQube MCP Server: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/sonarqube/ description: "Inspect SonarQube issues and quality gates, with optional analysis and write tools controlled by toolsets and read-only mode." --- # SonarQube MCP Server: review, setup & limitations · Undominated.ai > Inspect SonarQube issues and quality gates, with optional analysis and write tools controlled by toolsets and read-only mode. [← Explore all mcp servers](/mcp-servers/) CODE SECURITY / SonarSource # SonarQube MCP Server Inspect SonarQube issues and quality gates, with optional analysis and write tools controlled by toolsets and read-only mode. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/SonarSource/sonarqube-mcp-server) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher SonarSource Licence [SONAR Source-Available License v1.0 ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/LICENSE) Revision 8cbd65c79da3 [Read what was—and wasn’t—checked ↓](#review) “Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.” [SonarSource · upstream description ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/server.json) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Connects existing SonarQube findings to a coding workflow instead of treating generated fixes as analysis evidence. - Documents separate toolset and read-only controls for local and per-request HTTP use. - The pinned README connects an agent to SonarQube Server or Cloud, and it can also analyze a code snippet in the conversation. - Read-only mode and per-request toolset headers can only shrink the tool set that the process was started with. ### A good fit for - Explaining a failing quality gate and locating the related issues before drafting a patch. - Reviewing issue context with write tools disabled, then rerunning your established scanner to validate a proposed fix. - Reading SonarQube issues and quality gates with a user token - A container deployment that should not expose write tools ### Weigh up before choosing - SSAL v1.0 restricts external AI interaction. The same-revision README says documented MCP use is permitted; this profile records that publisher clarification, not a general licence clearance. No source bundle is redistributed. - SonarQube Server requires a USER token; project/global tokens are not interchangeable. Server support starts at SQS 2025.1 or SQCB 25.1 in the inspected README. - Read-only defaults to false. Tool availability varies by Server/Cloud, edition and entitlement; advanced Vortex tools require stdio and the documented entitlements. - A Docker container on Linux cannot reach a SonarQube for IDE server on localhost unless the run adds host networking. - analyze_code_snippet is deprecated in this README. - Tokens must not be committed or placed in shell history. - A pin does not verify transitive dependencies. - This review did not execute the resource. - A token accepted in one deployment or region does not establish access in another; preserve server-level read-only restrictions when narrowing per-request tools. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - Pinned SonarQube setup and access-control documentation - Actual SSAL v1.0 licence at the same revision - Java 21 build toolchain - README.md - LICENSE - Round 2 reread of acquired publisher setup and permission evidence; see immutable wave review. ### Our findings - The actual SSAL licence restricts external AI interaction, while the same-revision README explicitly permits documented MCP use. The Java toolchain specifies version 21. - Read-only mode and toolset selection are cumulative; HTTP request headers cannot expand the server-level tool scope. - The server talks to SonarQube Server or Cloud with a user token, and it can analyze snippet content in the agent context. - SONARQUBE_READ_ONLY=true is the documented read-only switch. Per-request SONARQUBE_TOOLSETS and SONARQUBE_READ_ONLY headers can only reduce that scope, never expand it. - The README says not to hardcode the token. On Linux, a container cannot reach the IDE's embedded server on localhost without --network=host. - The Cloud US connection requires SONARQUBE_URL=https://sonarqube.us in addition to the account's applicable Cloud configuration. ### Not established by this review - Installation, authentication and live tool execution were not tested. - Service availability, security isolation and package/container parity with source were not tested. - The server was not started and its tools were not called. - A pin does not verify transitive dependencies. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/README.md) - The README's client commands span several lines, so no one-line command is reproduced. Add the README's docker run block to the client configuration with SONARQUBE_TOKEN and either SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server). - Set SONARQUBE_READ_ONLY=true and a narrow SONARQUBE_TOOLSETS if the agent should not change issues. Do not commit the token. ### Before you start - Docker or another OCI runtime - A SonarQube Cloud or Server user token ### Documented configuration example Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts. { "mcpServers": { "sonarqube": { "command": "docker", "args": [ "run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp" ], "env": { "SONARQUBE_TOKEN": "", "SONARQUBE_ORG": "" } } } } Copy configuration ↗ ### Compatibility Antigravity · Claude Code · Codex CLI · Cursor · Gemini CLI · GitHub Copilot CLI · Kiro · VS Code · Windsurf · Zed ### Implementation Java ### Transports stdio · Streamable HTTP ### Local process - Reads projects, issues and quality-gate state within the token’s permissions. - With write tools enabled, can change issue state and other SonarQube resources; analysis tools may process submitted code. ### Cost model SSAL source terms apply. SonarQube subscription, entitlements and hosting are separate; no price was reviewed. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Pinned SonarQube setup and access-control documentation ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/README.md) Checked 2026-10-14 https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/README.md Supports: install, configExample, access, limitations, review, license - [Actual SSAL v1.0 licence at the same revision ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/LICENSE) Checked 2026-10-14 https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/LICENSE Supports: license, limitations - [Java 21 build toolchain ↗](https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/build.gradle.kts) Checked 2026-10-14 https://github.com/SonarSource/sonarqube-mcp-server/blob/8cbd65c79da3b5ee2b24150efcc870dd95fed9e8/build.gradle.kts Supports: language, install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Semgrep CLI MCP ↗ Run Semgrep scans and inspect rule or platform findings through the maintained MCP server inside the Semgrep CLI.](/mcp-servers/semgrep-cli/)[### Snyk Studio MCP ↗ Invoke Snyk source, dependency, configuration and package-health checks through its CLI-integrated MCP server.](/mcp-servers/snyk/)[### Trivy MCP ↗ Aqua Security plugin that exposes Trivy scans to MCP clients for a local filesystem, a container image, or a remote repository.](/mcp-servers/aquasecurity-trivy-mcp/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)