SonarQube & SonarCloud MCP. Run deep code analysis commands directly from your AI agent.

Listen up. The SonarQube & SonarCloud MCP Server connects your static analysis—the deep dive stuff from Sonar—right into your AI client. You don't gotta jump between tabs or mess with UIs just to check code quality or find a bug. It lets your agent query the whole codebase for security issues, tech debt metrics, and whether the project even passes its own standards.

Find bugs, spot duplication, and verify complex rules instantly.

Project Mapping and Structure. You can start by listing every available project in your SonarQube/SonarCloud instance using search_projects. To get a full picture of what you're working with, use get_component_tree; this maps out all files and directories in the entire project, giving you a complete overview of its architecture. You can also call list_rules to retrieve every available analysis rule used by your SonarQube instance, optionally narrowing that list down by programming language.

Code Quality Gate Status. Before you commit anything, you gotta know if it's good enough. Call get_quality_gate_status to check the project's overall status against its required quality standards in a single call; this tells you immediately if the gate passed or failed. If you need to see what gates even exist, use list_quality_gates.

Measuring Technical Debt and Coverage. You can pull key performance indicators (KPIs) using get_measures. This gathers various code quality metrics for a project, like unit test coverage percentages and the technical debt rate, which Sonar calls the Sqale Index. If you need to know what rules are available to check these measurements, you'll look at list_rules.

Finding Flaws and Security Holes. To find specific security flaws or code smells, call search_issues. This searches for codebase issues across the entire project and lets your agent filter those results by severity—you can drill down to Critical, Blocker, or whatever else you're worried about. For high-risk areas, use get_hotspots; this identifies specific sections of the code flagged as potential security weak spots or manual review points.

To find duplicated code that needs cleaning up, run get_duplications, and it calculates and retrieves blocks of repeated code within a specified file.

Deep Dive Forensics. When you spot an issue, you need proof. Use search_issues to pinpoint specific flaws by severity, then use get_source_code to pull the annotated source code for any file. This includes exact line numbers and all associated warnings flagged by SonarQube. You can also manually look at a project's core files using get_component_tree if you need to understand exactly which folder a specific issue belongs to, or use search_projects to confirm the unique key of the project you're investigating.

How it Works. Your AI client uses these tools to check your code. You can ask for a status report, and it will execute get_quality_gate_status. It pulls all the raw data needed—from component mapping via get_component_tree to specific flaw reports from search_issues—and hands it back in context. This means you're always working with real metrics, not just vague suggestions.