• TRIAGE
  • ANALYSIS
  • REMEDIATION
  • HUMAN

How to audit security hotspots with your AI

Connect SonarQube or SonarCloud to your AI client. Once connected, your agent can pull security data and inspect the code responsible for every flagged risk.

Ask AI about this page

Short answer

How can I use AI to audit security hotspots?

Your agent pulls hotspots and vulnerabilities directly from your Sonar projects and reads the specific files where they live. You get a clear explanation of why a risk exists and how to fix it. This breakdown shows you exactly how the investigation works.

The outcomes.

Where your security data lands.

The AI turns Sonar analysis into a direct investigation of your code.

TRIAGE

Prioritized risk lists

The agent finds hotspots and issues so you can see what matters most. You get a focused list of high-severity threats.

ANALYSIS

Code-level context

By reading the source files, your agent explains the logic behind a vulnerability. You see exactly why a specific line triggered a warning.

REMEDIATION

Fix suggestions

The AI suggests code changes to resolve the identified security risks. You get a concrete starting point for your patches.

HUMAN

Final decision making

The AI identifies the problem and suggests the fix, but you decide if the change is safe to merge. You maintain control over the codebase.

The workflow

What your AI does when the data arrives.

Your agent moves from finding a warning to explaining the code that caused it.

  1. Identify hotspots

    The agent scans your Sonar projects to find all active security hotspots that need review.

    get_hotspots

  2. Find vulnerabilities

    It searches for specific high-severity issues within your project scope.

    search_issues

  3. Inspect the code

    The agent pulls the relevant source files to understand the execution path of the risk.

    get_source_code

  4. Explain the risk

    The agent combines the issue details and the source code to explain the vulnerability in plain English.

    get_source_codesearch_issues

Try it

Copy these to start.

Use these prompts to begin your security audit.

Starting points

These are opening lines. Swap out the project names for your actual SonarQube or SonarCloud project keys.

SonarQube Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_65ij3kQdNIdLxz6QrHqXvdxjl6hvRUXIu2uwF792/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — SonarQube capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "sonarqube-sonarcloud-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_65ij3kQdNIdLxz6QrHqXvdxjl6hvRUXIu2uwF792/mcp"
    }
  }
}
Copy into chat04

  • List all security hotspots in my 'payment-gateway' project.

  • Find high-severity issues in 'auth-service' and explain why they are dangerous.

  • Read the source code for the hotspot in 'user-api' and suggest a fix.

  • Summarize the most critical vulnerabilities in my 'web-frontend' project.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect SonarQube & SonarCloud once, then ask.

Provide your credentials through the secure link. Once connected, your AI client can immediately start querying your Sonar data.

Connect SonarQube & SonarCloud to your AI

FAQ

How this task behaves.

  • 01

    Can the AI fix my code automatically?

    No. The AI can suggest fixes and read the code, but it cannot write or commit changes to your repository.

  • 02

    Can the AI delete issues in SonarQube?

    No. The AI only has tools to read hotspots, search for issues, and read source code. It cannot modify your SonarQube data.

  • 03

    Does this work with both SonarQube and SonarCloud?

    Yes, the connector works with both platforms.

  • 04

    Can the AI see my entire codebase?

    No. The AI only reads the specific files it needs to investigate the hotspots or issues you ask about.

  • 05

    Can the AI create new Sonar projects?

    No. The tools are limited to reading existing hotspots, issues, and source code.

  • More questions about SonarQube & SonarCloud? The Connector page answers them. See everything the SonarQube & SonarCloud Connector can do

Connect SonarQube to Claude, Cursor, ChatGPT & more