# SonarCloud MCP for AI Agents AI Agent Connect > SonarCloud MCP connects your code quality metrics and security scans directly to your AI client. It lets you pull project bugs, technical debt metrics, and quality gate statuses into your editor so you can fix issues before they hit your CI/CD pipeline. ## Overview - **Category:** ship-it - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_AaTqtTQdWH19bXPgs4DcTcK4VjPKy3gHjFtRX8gy/ai-agent-connect - **Tags:** static-analysis, code-quality, technical-debt, security-hotspots, ci-cd-pipeline, code-review ## Description Bring your SonarCloud quality checks and static analysis directly into your workspace. Instead of jumping back and forth between your IDE and a web dashboard, you can ask your agent to pull project bugs, technical debt metrics, and security hotspots on demand. This makes it much easier to keep your code compliant with your team's CI/CD rules while you're actually writing it. You can see which components are failing checks and get the details on what needs to be fixed without leaving your flow. Because Vinkius hosts this Connector, you can connect it to your preferred AI client and start getting real-time insights into your code health. It turns your development environment into a more informed place where you can catch flaws before they ever hit your pipeline. You no longer have to wait for a build to fail or a security scan to complete before you know if your work is up to standard. By having this data available in your chat window, you can address issues like cognitive complexity or missing test coverage the moment you write the code. It bridges the gap between your active development and the strict requirements of your production environment, making the entire cycle faster and more reliable. You get the peace of mind that comes from knowing your code meets every quality standard before you ever hit the commit button. ## Tools ### search_users Look up team members within your SonarCloud organization. Use this to verify who has access to specific repositories. ### search_projects Find specific projects in SonarCloud using organization keys. This helps you quickly switch context between different apps. ### list_organizations See a list of all organizations tied to your account. This is useful for managing multiple company profiles. ### get_analysis_status Check the current status of the latest code analysis for a project. Use it to see if your recent push was scanned. ### get_quality_gate_status Pull the pass or fail status of a project's quality gate. It tells you immediately if your code meets the requirements. ### get_issue_details Get the full details of a specific code quality issue or bug. This helps you understand the exact fix required. ### get_project_measures Retrieve specific metrics like coverage for a project component. Use this to monitor your progress on test requirements. ### search_issues Search for code quality issues and security hotspots within a project. This helps you prioritize the most critical bugs. ### list_project_components List all files and directories within a specific project. This gives your agent a better map of your codebase structure. ## Prompt Examples **Prompt:** ``` Check if the backend project passed its quality gate. ``` **Response:** ``` Checking the status for `backend-api-service`... **Quality Gate Status: 🔴 ERROR** The project failed the quality gate because the new code coverage is only 72%, which is below your 80% target. It also flagged 3 new code smells in the `auth` module. Would you like me to search for those specific issues? ``` **Prompt:** ``` Find any critical security issues in the api-backend project. ``` **Response:** ``` Searching for CRITICAL security hotspots in `api-backend-srv`... **Security Issues Found:** - 🚨 **Critical Vulnerability**: Hardcoded credentials detected in `config/db.js` (Line 42) - 🚨 **Critical Bug**: Possible SQL injection in `user_search.py` (Line 118) I can provide the full details for either of these if you'd like. ``` **Prompt:** ``` What's the current code coverage for the auth component? ``` **Response:** ``` Retrieving coverage metrics for `src/auth`... **Current Metrics:** - **Code Coverage**: 84.2% - **Complexity Score**: 12 (Low) - **Technical Debt**: 42 hours The component is currently meeting the team's coverage requirements. ``` ## Capabilities ### Check quality gate status Instantly see if your project meets the required code quality standards. ### Find codebase bugs Identify specific code quality issues and security flaws within your project. ### View technical debt metrics Get a clear picture of your project's technical debt and coverage. ### Explore project components List all files and directories within a project to map out your codebase. ### Monitor analysis status Check if the latest code analysis scan is finished. ### Manage organization users List organizations and team members tied to your SonarCloud profile. ## Use Cases ### Fixing PR Failures A developer's PR fails the CI. They ask the agent to check the `get_quality_gate_status` to see exactly why it failed and what needs fixing. ### Security Audits A DevSecOps lead wants to see all critical vulnerabilities. They ask the agent to `search_issues` for high-severity bugs in the API backend. ### Coverage Verification A developer wants to ensure a new module hits 80% coverage. They ask the agent to pull `get_project_measures` for that specific component. ### Project Discovery A new team member needs to find all active projects. They ask the agent to `search_projects` by organization key to see what's available. ## Benefits - Pull quality gate statuses using `get_quality_gate_status` to see if your code is ready for production without leaving your IDE. - Find security hotspots quickly with `search_issues` to fix vulnerabilities before they ever reach your live environment. - Get exact code coverage numbers for any component using `get_project_measures` while you're actively developing new features. - View specific bug details with `get_issue_details` to understand exactly what needs to be changed to pass your build. - Check your project's analysis status with `get_analysis_status` to see if the latest scan is complete after a push. - Browse your project's files and directories with `list_project_components` to give your agent better context on your folder structure. ## How It Works The bottom line is you get real-time code health data inside your editor instead of hunting for it in a separate web dashboard. 1. Subscribe to the SonarCloud MCP on the Vinkius marketplace. 2. Add your SonarCloud Security Token to your local configuration. 3. Ask your agent to check your project's quality gate or find specific bugs. ## Frequently Asked Questions **Does the SonarCloud MCP show me my project's technical debt?** Yes, it pulls project measures and issues so you can see your debt metrics directly in your chat window. **Can I use this to find specific bugs in my code?** Yes, you can search for specific issues and get the full details on bugs without leaving your editor. **How do I see if my code meets the quality gate requirements?** The Connector lets your agent check the gate status for any project instantly, showing you if you're ready for production. **Can this help with security hotspot detection?** Yes, it allows your agent to search for and report security hotspots in your codebase as you work. **Does this work with my existing SonarCloud account?** Yes, you just need to provide your SonarCloud security token to connect the Connector to your account. **Can I see which team members are in my organization?** Yes, the Connector can list organizations and search for users tied to your SonarCloud profile. **Can the AI rewrite my code so it passes the Sonar Quality Gate?** Yes! The bot uses `get_issue_details` and `get_quality_gate_status` to absorb exactly what SonarCloud requires. By operating inside your IDE (e.g. Cursor, Copilot), the LLM reads its own localized codebase, applies the requested Sonar rules, and proposes a completely polished update resolving the warnings. **How do I check if my test coverage is sufficient using prompts?** You don't need distinct commands. Simply ask: 'Show me the coverage and bug count metrics for the MY-CORE-API project'. The autonomous agent triggers `get_project_measures` extracting precise variables (e.g., metricKeys='coverage,bugs') dropping them beautifully formatted on your screen. **Will my organization see when I retrieve security issues via AI?** The integration processes calls entirely under your designated SonarCloud User Token privileges. It acts as an API bridge simulating legitimate network traffic like a dashboard plugin would. All requests to SonarCloud are encrypted from your client PC. No prompt data or bug details are permanently warehoused by Vinkius systems.