skills.rest
jwvdvuurst
jwvdvuurstCOMMUNITY
Explore all skills by this author →
GitHub

sonarqube-mcp

Integrates SonarQube and SonarCloud quality gates, issue triage, and code analysis via MCP server.

Updated Dec 26, 2025
Search Tags:#static analysis#code analysis#mcp#quality gate#issue triage#sonarqube#sonarcloud
One-click install
npx skills add https://github.com/jwvdvuurst/CalculatorCollection --skill sonarqube-mcp-jwvdvuurst
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sonarqube-mcp
Source: https://github.com/jwvdvuurst/CalculatorCollection/tree/main/skills/sonarqube-mcp
Command: npx skills add https://github.com/jwvdvuurst/CalculatorCollection --skill sonarqube-mcp-jwvdvuurst

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? It brings SonarQube and SonarCloud code quality workflows directly into the agent session, so developers can check quality gates, triage issues, and analyze code before pushing without leaving their workflow or opening the SonarQube UI. ## Core Features & Use Cases - Quality Gate Monitoring: Check whether a project or pull request passes its quality gate before merging or deploying. - Issue Discovery and Triage: Search issues by project, severity, and pull request, then mark false positives or accepted debt with documented reasons. - Pre-Push Analysis: Run shift-left analysis on code snippets in 12 languages (Java, TypeScript, Python, Go, and more) before committing. - Rule Education: Retrieve full rule documentation with remediation guidance and compliant code examples. - Use Case: Before merging PR #234, ask the agent to check the quality gate for project backend-api; if it fails, the agent lists the blocking issues grouped by Security, Reliability, and Maintainability, and explains each unfamiliar rule. ## Quick Start Set the SONARQUBE_TOKEN and SONARQUBE_URL (or SONARQUBE_ORG for SonarCloud) environment variables with Docker running, then ask the agent to check the quality gate status for your project key.

Frequently Asked Questions about sonarqube-mcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a SonarQube quality gate before merging a PR?▼

Call the get_project_quality_gate_status tool with your projectKey and the pullRequest parameter set to the PR number. A status of OK means it is safe to merge; ERROR returns failing conditions with metric keys, actual values, and thresholds.

How to analyze code with SonarQube before committing?▼

Use the analyze_code_snippet tool with your projectKey, the full fileContent, and a language hint such as java, typescript, python, or go. It returns issues with severity, line numbers, and rule keys you can look up with show_rule.

Does the SonarQube MCP server work with SonarCloud?▼

Yes, SonarCloud is supported by setting SONARQUBE_TOKEN and SONARQUBE_ORG environment variables instead of SONARQUBE_URL. SonarCloud project keys typically follow the org_repo format with an underscore.

What severity values can I filter SonarQube issues by?▼

The severities filter accepts only BLOCKER, HIGH, MEDIUM, LOW, and INFO. Legacy labels like CRITICAL, MAJOR, and MINOR appear in display text but are not valid filter values; map CRITICAL to HIGH and MAJOR to MEDIUM.

Why is the SonarQube MCP server not starting?▼

The server runs via Docker, so verify Docker is installed and running first. Then confirm SONARQUBE_TOKEN is set, plus SONARQUBE_URL for SonarQube Server or SONARQUBE_ORG for SonarCloud; use host.docker.internal for local instances.

What are the limitations of SonarQube snippet analysis?▼

The analyze_code_snippet tool analyzes file content in isolation without full project context, so rules requiring cross-file analysis will not fire. Results may differ slightly from a full CI analysis, so treat it as a pre-commit check rather than a gate replacement.

Related Skills

Explore More Software Engineering Skills→
etendosoftwareetendosoftware
1

etendo-sonar

Run SonarQube analysis on Etendo modules and fix code issues.

Official
Advanced
NJX-njxNJX-njx
55

prepare-pr

Rebase GitHub pull requests onto main, fix review issues, and run build and test gates.

Community
Intermediate
devs6186devs6186

verification-loop

Automates TypeScript/Python builds, linting, tests, and scans for GitHub pull requests.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate