MCP server

SonarQube MCP Server

Code quality and security issues, quality gates and metrics from SonarQube Cloud or Server. Official: built and maintained by Sonar. It runs locally on your machine over stdio. Setup below for 12 clients (checked 2026-10-25). Repo and registry data checked 2026-10-24.

Maintainer: Official · Sonar
Runs: Local (stdio)
Repo: SonarSource/sonarqube-mcp-server
GitHub: ★ 672, last push 2026-10-23 (checked 2026-10-24)
Registry: io.github.SonarSource/sonarqube-mcp-server
Connects to: SonarQube

Install the SonarQube MCP Server

Pick your client. Each tab starts the same local command. Config shapes checked against each client's docs on 2026-10-25.

Needs SONARQUBE_TOKEN (replace the ... with your value).

Run in a terminal. Everything after -- is the command that starts the server. docs

claude mcp add --transport stdio --env SONARQUBE_TOKEN=... sonarqube -- docker run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp

Claude Desktop only: Settings > Developer > Edit Config opens claude_desktop_config.json. Add this, save and restart the app. docs

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project), or use the install button. docs

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to Cursor

Add to .vscode/mcp.json (note the "servers" key and the type), or use the install button. Command Palette > "MCP: Open User Configuration" for all workspaces. docs

{
  "servers": {
    "sonarqube": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to VS Code

Run codex mcp add --env SONARQUBE_TOKEN=... sonarqube -- docker run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp, or add this to ~/.codex/config.toml. docs

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "docker.io/sonarsource/sonarqube-mcp"]

[mcp_servers.sonarqube.env]
SONARQUBE_TOKEN = "..."

Run in a terminal (-s user adds it for all projects; the default is this project). docs

gemini mcp add -s user -e SONARQUBE_TOKEN=... sonarqube docker -- run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp

Run in a terminal; it writes ~/.copilot/mcp-config.json. docs

copilot mcp add --env SONARQUBE_TOKEN=... sonarqube -- docker run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp

Add to mcp_config.json: ~/.config/devin/mcp_config.json on macOS and Linux (older installs: ~/.codeium/windsurf/mcp_config.json), %APPDATA%\devin\ on Windows. docs

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to Zed's settings.json (or Settings > AI > MCP Servers > Add Server). Remote servers without an Authorization header sign in with OAuth. docs

{
  "context_servers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to opencode.json in the project (or ~/.config/opencode/opencode.json). docs

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sonarqube": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "enabled": true,
      "environment": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Add to ~/.kiro/settings/mcp.json (all projects) or .kiro/settings/mcp.json (this project). docs

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

MCP Servers > Configure > Configure MCP Servers opens cline_mcp_settings.json; add this entry. docs

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "docker.io/sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "..."
      }
    }
  }
}

Security notes

The local server runs with your user's permissions (it runs in a Docker container, and only the variables passed with -e reach it).
Needs SONARQUBE_TOKEN. Use a key or token with the narrowest scopes (read-only if there is one), and keep it out of config files you commit (.mcp.json, .vscode/mcp.json).

Alternatives

all security MCP servers →

Burp Suiteofficial · ★ 1.3k
Use Burp Suite from an agent: send requests, read proxy history and scanner issues.
Socketofficial · ★ 137
Check npm, PyPI and other packages for supply-chain risk before the agent installs them.
Auth0official · ★ 121
Manage Auth0 applications, APIs, actions, logs and forms from the agent.
Oktaofficial · ★ 74
Self-hosted server to manage Okta users, groups, apps, policies and system logs.
HashiCorp Vaultofficial · ★ 65
Read and write Vault secrets and manage mounts in HashiCorp Vault.
Trivyofficial · ★ 53
Scan filesystems, images and repos for vulnerabilities and misconfigurations with Trivy.
1Password Environmentsofficial
Local server in the 1Password app to manage project environment variables, with approval prompts.
Clerkofficial
Hosted server to manage Clerk apps, users and domains, plus Clerk SDK snippets.

FAQ

What does the SonarQube MCP Server do?+

Code quality and security issues, quality gates and metrics from SonarQube Cloud or Server.

Is the SonarQube MCP server official?+

Official: built and maintained by Sonar.

How do I add SonarQube to Claude Code?+

Run: claude mcp add --env SONARQUBE_TOKEN=... --transport stdio sonarqube -- docker run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp. Add --scope project to share it with your team through .mcp.json.

How do I use the SonarQube MCP server in Cursor or VS Code?+

Open the Cursor or VS Code tab above: it has the mcp.json entry and a one-click install link. Cursor uses the "mcpServers" key; VS Code uses "servers" and needs a type ("stdio").

Does SonarQube work in ChatGPT and claude.ai?+

No: it runs locally over stdio, and ChatGPT and claude.ai only connect to remote servers. Use it in Claude Desktop, Claude Code, Cursor, VS Code or another client that can start a local process.

What are the alternatives to the SonarQube MCP server?+

Other security MCP servers: Burp Suite, Socket, Auth0, Okta and HashiCorp Vault.

All MCP servers · What is an MCP server? · Agent skills