Does this work with SonarCloud?

Yes, this MCP supports both self-hosted SonarQube instances and SonarCloud dashboards.

Which AI clients can I use with this MCP?

You can use this with any MCP-compatible client, including Claude, Cursor, and Windsurf.

How do I secure my credentials?

Vinkius manages your credentials and API tokens securely, so you don't have to handle them in your local environment.

Can I filter issues by severity?

Yes, the search_issues capability allows you to filter issues by specific severity levels like Critical or Blocker.

Can the AI actually see my code?

Yes, the get_source_code capability allows your agent to retrieve annotated source code lines to help with debugging.

Can I connect this extension to my company's self-hosted, private SonarQube on-premise instance?

Yes! The capability requires a SONAR_BASE_URL credential. If your company uses https://sonar.internal-corp.local:9000, the MCP traffic routes originating from your local desktop client to that exact internal instance seamlessly, guaranteeing total compatibility even inside VPNs.

How can the AI know how to fix a Sonar 'Code Smell' specifically?

When the AI notices an identified smell from search_issues, it queries list_rules looking for the exact underlying Sonar rule ID definitions. Armed with the rigid logic rules enforced by SonarQube plus the get_source_code of your file, the LLM patches the snippet flawlessly.

Can it inspect duplication limits and technical debt logic?

Yes. Ask the LLM to inspect technical debt by running get_measures providing 'sqale_index' metric. On the other hand, it can pull specific chunk references using the get_duplications command, helping you extract redundant code safely.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect Sonarqube Sonarcloud to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Bring your static analysis directly into your AI workflow.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through SonarQube.

01
Get duplications
This capability pulls specific blocks of duplicated code within a file in SonarQube.
02
Get hotspots
Use this to retrieve security hotspots identified in a SonarQube project.
03
Get measures
This capability fetches specific code quality metrics and KPIs for a project using metric keys.
04
Get quality gate status
This capability checks whether a SonarQube project has passed or failed its quality gate.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through SonarQube.

05
List quality gates
This capability returns a list of all defined quality gates in your SonarQube instance.
06
List rules
Use this to see the specific analysis rules enabled in SonarQube, which can be filtered by language.
07
Search issues
This capability searches for code issues in a project, allowing you to filter by severity levels.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through SonarQube.

08
Search projects
This capability finds project keys and names across your SonarQube or SonarCloud environment.
09
Get component tree
This capability retrieves the file and directory hierarchy for a project along with its metrics.
10
Get source code
Use this to pull raw, annotated source code lines for a specific file.

Real work

What teams actually run

PR Blockage Troubleshooting

When a quality gate fails, your agent can identify the specific rule violation and propose a fix.

Security Auditing

Quickly find and investigate security hotspots and high-severity vulnerabilities.

Technical Debt Management

Monitor coverage and duplication levels to decide where to focus refactoring efforts.

Project Health Checks

Get a high level view of project metrics and component trees through simple text queries.

Automate a task

Put SonarQube to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

SonarQube works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put SonarQube to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

942ms average. Fast in production.

SonarQube is checked daily against the live service.

Daily averagePeak 1403ms

Oct 3Today

Fastest day: 739ms
Slowest day: 1403ms
14-day trend: Slowing+18%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of SonarQube, so you can see the experience inside your AI.

It does not authenticate your account with SonarQube. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

SonarQube Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_65ij3kQdNIdLxz6QrHqXvdxjl6hvRUXIu2uwF792/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — SonarQube capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "sonarqube-sonarcloud-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_65ij3kQdNIdLxz6QrHqXvdxjl6hvRUXIu2uwF792/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up SonarQube in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work SonarQube owners hand off.

This MCP is built for engineering teams that rely on SonarQube for continuous inspection.

01
Software Engineers
Ask your agent why a PR was blocked and get immediate refactor suggestions.
02
DevSecOps
Query specific CVE details and audit security hotspots without leaving your IDE.
03
Tech Leads
Get quick reports on duplication ratios and test coverage across different modules.

FAQ

Questions SonarQube owners ask.

01
Does this work with SonarCloud?
Yes, this MCP supports both self-hosted SonarQube instances and SonarCloud dashboards.
02
Which AI clients can I use with this MCP?
You can use this with any MCP-compatible client, including Claude, Cursor, and Windsurf.
03
How do I secure my credentials?
Vinkius manages your credentials and API tokens securely, so you don't have to handle them in your local environment.
04
Can I filter issues by severity?
Yes, the search_issues capability allows you to filter issues by specific severity levels like Critical or Blocker.
05
Can the AI actually see my code?
Yes, the get_source_code capability allows your agent to retrieve annotated source code lines to help with debugging.
06
Can I connect this extension to my company's self-hosted, private SonarQube on-premise instance?
Yes! The capability requires a SONAR_BASE_URL credential. If your company uses https://sonar.internal-corp.local:9000, the MCP traffic routes originating from your local desktop client to that exact internal instance seamlessly, guaranteeing total compatibility even inside VPNs.
07
How can the AI know how to fix a Sonar 'Code Smell' specifically?
When the AI notices an identified smell from search_issues, it queries list_rules looking for the exact underlying Sonar rule ID definitions. Armed with the rigid logic rules enforced by SonarQube plus the get_source_code of your file, the LLM patches the snippet flawlessly.
08
Can it inspect duplication limits and technical debt logic?
Yes. Ask the LLM to inspect technical debt by running get_measures providing 'sqale_index' metric. On the other hand, it can pull specific chunk references using the get_duplications command, helping you extract redundant code safely.

Explore

More in Ship It

Connect SonarQube to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-04

Get duplications

Get hotspots

Get measures

Get quality gate status

05-07

List quality gates

List rules

Search issues

08-10

Search projects

Get component tree

Get source code

What teams actually run

PR Blockage Troubleshooting

Security Auditing

Technical Debt Management

Project Health Checks

Building your own app? The connector is yours to use.

SonarQube Connector

Claude Desktop

Software Engineers

DevSecOps

Tech Leads

Does this work with SonarCloud?

Which AI clients can I use with this MCP?

How do I secure my credentials?

Can I filter issues by severity?

Can the AI actually see my code?

Can I connect this extension to my company's self-hosted, private SonarQube on-premise instance?

How can the AI know how to fix a Sonar 'Code Smell' specifically?

Can it inspect duplication limits and technical debt logic?

SonarCloud AI Connector

Codacy AI Connector

Code Clone Detector AI Connector

Code Integrity Prover AI Connector

Suggestions

DeepSource AI Connector

CodeRabbit AI Connector

Aikido Security AI Connector

Coveralls (Code Coverage Analytics API) AI Connector