# SonarQube & SonarCloud MCP for AI Agents AI Agent Connect > SonarQube & SonarCloud MCP. Connect your quality gates to your AI logic. Find bugs, duplications, and security flaws instantly. This integration pulls live data from your static analysis dashboards into your AI chat, letting you query technical debt and security hotspots without switching tabs. ## Overview - **Category:** ship-it - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_65ij3kQdNIdLxz6QrHqXvdxjl6hvRUXIu2uwF792/ai-agent-connect - **Tags:** static-analysis, code-quality, bug-detection, technical-debt, on-premise, code-security ## Description This Connector connects your SonarQube or SonarCloud dashboards directly to your AI workflow. Instead of manually hunting through dashboards to find out why a build failed or where a security risk lies, you can just ask your agent to summarize the current state of your project's health. It pulls the latest data on unit test coverage, technical debt, and security hotspots so you can address the most critical issues first. Because Vinkius makes it easy to manage these connections, you can swap between different projects and instantly see which components need the most attention. It's about turning static analysis into a conversation rather than a chore. You can get an overview of your entire codebase or dive deep into a single file to see exactly which lines of code triggered a specific rule. This means you spend less time navigating web interfaces and more time actually fixing the problems that matter. You can check for critical vulnerabilities or understand why a specific component is flagged for duplication without leaving your workspace. It handles the querying of the Sonar API so you can focus on refactoring and shipping cleaner code. By bringing these insights into your primary AI client, you can move from identifying a problem to generating a fix in a single turn. ## Tools ### get_component_tree Get the full folder and file structure of a project along with its associated metrics. This helps you see the entire architecture of your codebase in one view. ### get_duplications Identify specific blocks of duplicated code within a single file. Use this to find redundant logic that needs to be consolidated. ### get_hotspots Retrieve security hotspots that require manual review from your project. This lets you prioritize the most sensitive areas of your code. ### get_measures Pull specific metrics like unit test coverage or technical debt for a project. You can get a clear picture of your code's health with these numbers. ### get_quality_gate_status Check if a project currently meets your team's quality gate requirements. This is the quickest way to see if a build is ready for production. ### get_source_code Fetch specific lines of annotated source code for a file. You can see exactly which lines triggered a rule so you can fix them faster. ### list_quality_gates List all the quality gate definitions in your instance. This helps you understand the rules your project must follow. ### list_rules List all analysis rules being applied to your code. You can filter these by language to see what checks are active. ### search_issues Filter through project issues by severity to find the most pressing bugs. This helps you focus on critical fixes instead of minor ones. ### search_projects Search for project keys and names across your entire instance. This is the first step to finding the right project for your queries. ## Prompt Examples **Prompt:** ``` Check if our backend project passed the quality gate. ``` **Response:** ``` Checking the status for `backend-api`... **Quality Gate Status: PASSED** ✅ Reliability: 98.2% ✅ Security: 100% ✅ Coverage: 84.5% The project currently meets all defined quality standards. ``` **Prompt:** ``` What are the most critical security issues in the frontend app? ``` **Response:** ``` I found 3 **Blocker** issues in the `frontend-portal` project: | Issue | Location | Severity | | :--- | :--- | :--- | | SQL Injection | `auth/login.js` | Blocker | | XSS Vulnerability | `ui/header.js` | Blocker | | Hardcoded Secret | `config/env.js` | Blocker | Would you like me to pull the source code for the first one? ``` **Prompt:** ``` Give me a summary of the test coverage and technical debt for the auth service. ``` **Response:** ``` Here is the current health summary for the `auth-service`: * **Test Coverage**: 72.4% * **Technical Debt**: 14 hours 22 minutes * **Duplication Rate**: 4.2% I can help you find the specific files with the lowest coverage if you'd like. ``` ## Capabilities ### Check quality gate status Verify if your project meets your defined quality standards in real time. ### Search for critical issues Filter through your codebase to find high-severity bugs and security flaws. ### View component trees Get an overview of your project's folder structure and file metrics. ### Identify code duplication Find specific blocks of redundant code that need to be consolidated. ### Retrieve annotated source code Pull the exact lines of code that triggered specific analysis rules. ### List analysis rules View all the active rules being applied to your codebase. ### Search for projects Locate specific project keys and names across your entire instance. ## Use Cases ### Fixing a blocked PR A developer is blocked from merging because of a quality gate failure. They ask the agent to check the status and find the specific issues. ### Security hotspot audit A DevSecOps engineer needs to identify all high-severity security hotspots in a new microservice before deployment. ### Technical debt reporting A tech lead wants to know the total technical debt and test coverage for a legacy repository without opening a browser. ### Contextual code refactoring An engineer wants to see the specific lines of code that triggered a security warning to understand the fix. ## Benefits - Stop guessing if your PR passed by using get_quality_gate_status to pull live status directly into your chat. - Identify critical vulnerabilities faster by using search_issues to filter by severity like Blocker or Critical. - Get an instant overview of your folder structures and project metrics using get_component_tree. - Reduce technical debt by identifying specific code duplication blocks with get_duplications. - See the exact lines of code causing issues by pulling annotated source code with get_source_code. - Audit your entire project's ruleset by listing all analysis rules with list_rules to ensure consistency. ## How It Works The bottom line is you get instant access to your static analysis data without leaving your AI chat. 1. Connect your SonarQube or SonarCloud instance to your AI client. 2. Enter your unique Project URL and your secure User API Token. 3. Ask your agent to check coverage, find security flaws, or report on technical debt. ## Frequently Asked Questions **Can I use the SonarQube & SonarCloud MCP to check my PR status?** Yes. You can ask your agent to check the quality gate status to see if your latest changes meet the team's standards before you merge. **How does the SonarQube & SonarCloud MCP help with security?** It pulls security hotspots and critical issues directly into your chat. This lets you see vulnerabilities and risks immediately without navigating a separate dashboard. **Can I use this for both SonarQube and SonarCloud?** Yes, it works with both self-hosted SonarQube instances and cloud-based SonarCloud dashboards. **Does the SonarQube & SonarCloud MCP show me my test coverage?** Yes, you can query specific metrics to see your branch and line coverage instantly for any project in your organization. **Can I see the actual code lines that triggered a warning?** Yes, the Connector can pull the specific annotated source code lines so you can see exactly which parts of your code need refactoring. **Is this Connector suitable for tracking technical debt?** Absolutely. You can pull technical debt metrics and identify specific blocks of duplicated code to help prioritize your cleanup tasks. **Can I connect this extension to my company's self-hosted, private SonarQube on-premise instance?** Yes! The tool requires a `SONAR_BASE_URL` credential. If your company uses `https://sonar.internal-corp.local:9000`, the Connector traffic routes originating from your local desktop client to that exact internal instance seamlessly, guaranteeing total compatibility even inside VPNs. **How can the AI know how to fix a Sonar 'Code Smell' specifically?** When the AI notices an identified smell from `search_issues`, it queries `list_rules` looking for the exact underlying Sonar rule ID definitions. Armed with the rigid logic rules enforced by SonarQube plus the `get_source_code` of your file, the LLM patches the snippet flawlessly. **Can it inspect duplication limits and technical debt logic?** Yes. Ask the LLM to inspect technical debt by running `get_measures` providing 'sqale_index' metric. On the other hand, it can pull specific chunk references using the `get_duplications` command, helping you extract redundant code safely.