Server data from the Official MCP Registry
SonarQube MCP — projects, metrics, quality gate, issues, worst-metric ranking.
SonarQube MCP — projects, metrics, quality gate, issues, worst-metric ranking.
Valid MCP server (1 strong, 3 medium validity signals). 12 known CVEs in dependencies (0 critical, 6 high severity) Package registry verified. Imported from the Official MCP Registry.
6 files analyzed · 13 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Unverified package source
We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.
Set these up before or after installing:
Environment variable: SONARQUBE_URL
Environment variable: SONARQUBE_TOKEN
Environment variable: SONARQUBE_SSL_VERIFY
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-mshegolev-sonarqube-mcp": {
"env": {
"SONARQUBE_URL": "your-sonarqube-url-here",
"SONARQUBE_TOKEN": "your-sonarqube-token-here",
"SONARQUBE_SSL_VERIFY": "your-sonarqube-ssl-verify-here"
},
"args": [
"sonarqube-mcp"
],
"command": "uvx"
}
}
}From the project's GitHub README.
MCP server for SonarQube. Lets an LLM agent (Claude Code, Cursor, OpenCode, etc.) discover projects, pull headline metrics, check Quality Gate status, search issues with severity/type filters, and rank projects by the worst value of any metric.
Python, FastMCP, stdio transport.
Works with any SonarQube 9.x / 10.x instance (self-hosted) and with SonarCloud.
A few community SonarQube MCPs exist, but they tend to stop at single-project reads. This one adds cross-project ranking (sonarqube_worst_metrics) — the operation a lead actually runs during a triage session: "show me the top 10 worst-coverage services in the org". All tools are read-only and safely parameterised (Pydantic input validation, severity / type whitelists).
readOnlyHint: True, destructiveHint: False, idempotentHint: True. Nothing can mutate SonarQube from this server./api/measures/search calls under the hood, sorts ascending or descending based on whether higher is worse for the chosen metric.Discovery
sonarqube_list_projects — paginated project search with optional text filterSingle-project insight
sonarqube_project_metrics — measures for one project (default set covers bugs / coverage / smells / ratings / ncloc / tests / alert_status)sonarqube_quality_gate_status — Quality Gate status + per-condition failuresIssue triage
sonarqube_get_issues — issue search filtered by severity / type / resolution statusCross-project ranking
sonarqube_worst_metrics — top-N projects sorted by the worst value of a metric (e.g. worst coverage, most bugs)Requires Python 3.10+.
# via uvx (recommended — no install, just run)
uvx --from sonarqube-mcp sonarqube-mcp
# or via pipx
pipx install sonarqube-mcp
claude mcp add sonarqube -s project \
--env SONARQUBE_URL=https://sonar.example.com \
--env SONARQUBE_TOKEN=squ_your_token \
--env SONARQUBE_SSL_VERIFY=true \
-- uvx --from sonarqube-mcp sonarqube-mcp
Or in .mcp.json:
{
"mcpServers": {
"sonarqube": {
"type": "stdio",
"command": "uvx",
"args": ["--from", "sonarqube-mcp", "sonarqube-mcp"],
"env": {
"SONARQUBE_URL": "https://sonar.example.com",
"SONARQUBE_TOKEN": "${SONARQUBE_TOKEN}",
"SONARQUBE_SSL_VERIFY": "true"
}
}
}
}
Check:
claude mcp list
# sonarqube: uvx --from sonarqube-mcp sonarqube-mcp - ✓ Connected
| Variable | Required | Description |
|---|---|---|
SONARQUBE_URL | yes | SonarQube URL (no trailing slash) |
SONARQUBE_TOKEN | yes | Bearer token. Generate in: My Account → Security → Tokens |
SONARQUBE_SSL_VERIFY | no | true/false. Default: true. |
Note on HTTP proxies. The client intentionally disables env-based proxy discovery (trust_env=False) because self-hosted SonarQube is typically reachable only on an internal network. If you connect to SonarCloud or any SonarQube that lives behind a corporate proxy, you'll currently need to drop the proxy variables at the process level — a SONARQUBE_TRUST_ENV_PROXY knob is planned for a follow-up release.
einvy:aut_einvy?"einvy:aut_einvy"einvy:qa_assistant?"sonarqube_worst_metrics)Higher is worse (sorted descending — more is worse):
bugs, code_smells, vulnerabilities, duplicated_lines_density, reliability_rating, security_rating, security_review_rating, sqale_rating, open_issues
Lower is worse (sorted ascending — less is worse):
coverage, line_coverage, branch_coverage, test_success_density, tests
Ratings in SonarQube are numeric strings "1" (A, best) through "5" (E, worst).
readOnlyHint: True — nothing can mutate SonarQube.POST / PUT / DELETE is ever called.sonarqube_worst_metrics, which makes one search call + ⌈candidate_pool/100⌉ bulk-measures calls. Default settings land at ≤ 2 calls.p + ps params) — no full-result buffering in the MCP server.sonarqube_worst_metrics caps candidate_pool at 500 — on instances with thousands of projects, pre-filter with query= before ranking (see the tool docstring).git clone https://github.com/mshegolev/sonarqube-mcp.git
cd sonarqube-mcp
pip install -e '.[dev]'
pytest
MIT © Mikhail Shchegolev
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.