Allows interaction with a SonarQube instance for managing projects, issues, metrics, quality gates, and performing code reviews and security audits.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@sonar-mcp list all projects in my SonarQube instance"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for interacting with SonarQube code quality platform.
21 SonarQube tools organized into 7 categories, accessible via dispatch pattern
6 MCP Prompts for code review, security audits, and quality reports
7 MCP Resources for browseable URI-based access to SonarQube data
Multi-instance support for managing multiple SonarQube servers
HTTP transport modes - stdio, SSE, and streamable-http
Related MCP server: sonarqube-api-mcp
# Using pip
pip install sonar-mcp
# Using uv (recommended)
uv pip install sonar-mcpAdd to your Claude Code MCP settings:
{
"mcpServers": {
"sonar-mcp": {
"command": "sonar-mcp",
"env": {
"SONAR_TOKEN": "your-sonarqube-token",
"SONAR_URL": "https://sonarqube.example.com"
}
}
}
}The server uses a dispatch pattern (similar to GitLab MCP) with just 3 meta-tools:
# Discover available tools by category
sonar_list_categories()
sonar_list_categories(category="issue") # Filter to specific category
# Get parameter schema for a tool
sonar_get_tool_schema(tool_name="sonar_list_issues")
# Execute any tool by name
sonar_execute_tool(tool_name="sonar_list_projects")
sonar_execute_tool(tool_name="sonar_list_issues", arguments={"project": "my-project"})For Claude Code and other MCP clients that use stdio transport:
sonar-mcp
# or
python -m sonar_mcpFor web-based clients or remote access:
# Start server on default port 8000
sonar-mcp --transport streamable-http
# Custom host and port
sonar-mcp --transport streamable-http --host 0.0.0.0 --port 3000
# Using environment variables
SONAR_MCP_TRANSPORT=streamable-http SONAR_MCP_PORT=3000 sonar-mcpFor clients that support SSE transport:
sonar-mcp --transport sse --port 8000Option | Description | Default |
| Transport protocol: |
|
| Host address for HTTP transports |
|
| Port for HTTP transports |
|
| Show version and exit | - |
Variable | Description | Required |
| SonarQube API token | Yes |
| SonarQube server URL | Yes |
| Default transport mode | No |
| Default host for HTTP | No |
| Default port for HTTP | No |
These 3 tools provide access to all SonarQube functionality:
Tool | Description |
| Discover available tools by category |
| Get parameter schema for a specific tool |
| Execute any tool by name with arguments |
Instance management for SonarQube server connections:
sonar_list_instances - List all configured instances
sonar_manage_instance - Create, update, delete instances
sonar_select_instance - Set the active instance
sonar_test_connection - Test instance connectivity
Project operations:
sonar_list_projects - List all accessible projects
sonar_get_project - Get project details and metrics
sonar_detect_project - Auto-detect project from current directory
Issue management:
sonar_list_issues - List issues with filtering (severity, type, status)
sonar_get_issue - Get detailed issue information
sonar_transition_issue - Change issue status (resolve, falsepositive, etc.)
sonar_add_comment - Add a comment to an issue
sonar_bulk_transition - Bulk transition multiple issues
Quality gate operations:
sonar_get_quality_gate - Get quality gate status (OK/ERROR)
sonar_check_goals - Validate against quality goals
Metrics retrieval:
sonar_get_metrics - Get project metrics
sonar_get_coverage - Get coverage percentage
sonar_get_file_coverage - Get file-level coverage details
Rule information:
sonar_get_rule - Get rule details and remediation guidance
Async task management:
sonar_get_task - Get task status
sonar_list_tasks - List background tasks
sonar_cancel_task - Cancel a running task
Browseable URI-based access to SonarQube data:
URI Pattern | Description |
| List all projects |
| Get project details |
| Get project issues |
| Get issues by severity |
| Get project metrics |
| Get quality gate status |
Reusable prompt templates for code quality workflows:
Prompt | Description |
| Review code issues and suggest fixes |
| Generate fix recommendations for issues |
| Generate quality report for a project |
| Check project against quality goals |
| Perform security vulnerability audit |
| Generate fixes for security vulnerabilities |
# Clone the repository
git clone https://github.com/wadew/sonar-mcp.git
cd sonar-mcp
# Create virtual environment
uv venv
source .venv/bin/activate
# Install dependencies
uv pip install -e ".[dev]"# Run all tests with coverage
pytest tests/ -v --cov=src/sonar_mcp --cov-report=term-missing
# Run with coverage enforcement (80% minimum)
pytest tests/ -v --cov=src/sonar_mcp --cov-fail-under=80# Check linting
ruff check src/ tests/
# Format code
ruff format src/ tests/
# Type checking
mypy src/MIT License - see LICENSE for details.
Follow TDD (Test-Driven Development) - write tests first
Maintain 80% coverage on ALL modules
Ensure all linting and type checks pass
Use conventional commits
See CONTRIBUTING.md for detailed guidelines.
Execute any SonarQube tool by name with the provided arguments.
Use after getting the schema to understand required parameters.
Args: tool_name: Name of the tool to execute (e.g., 'sonar_list_issues') arguments: Tool-specific arguments (optional). See sonar_get_tool_schema for details.
Returns: The tool's return value, or error dict if tool not found or execution fails.
| Name | Required | Description | Default |
|---|---|---|---|
| tool_name | Yes | ||
| arguments | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the execution action and return values (tool result or error dict) but does not discuss side effects, destructive potential, or authentication needs. The behavior is partially transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, front-loaded with purpose, followed by clear Args and Returns sections. Every sentence is informative without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers usage flow (get schema first) and basic behavior. With an output schema available, the lack of detailed return format is acceptable. It could mention that the output depends on the specific tool executed, but the guidance is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds value by providing an example for tool_name ('sonar_list_issues') and directing users to sonar_get_tool_schema for argument details. This compensates for the lack of schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Execute any SonarQube tool by name with the provided arguments.' It distinguishes from siblings like sonar_get_tool_schema (schema retrieval) and sonar_list_categories (listing).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using this tool after obtaining the schema via sonar_get_tool_schema, which is a clear prerequisite. It does not explicitly list when not to use, but the guidance is sufficient for an executor tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the full JSON schema for a specific SonarQube tool.
Use after list_categories to get parameter details before calling execute_tool.
Args: tool_name: Name of the tool (e.g., 'sonar_list_issues', 'sonar_get_project')
Returns: Dictionary with: - success: bool - Operation success status - tool_name: str - The tool name - schema: dict - JSON schema for tool parameters - description: str - Tool description from docstring - error: str - Error message (if success is False)
| Name | Required | Description | Default |
|---|---|---|---|
| tool_name | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, and the description adds value by detailing the return structure (success, tool_name, schema, description, error) and noting that schema provides parameter details, without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with no wasted words, front-loads the purpose, and uses clear sections for args and returns, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (1 param) and presence of an output schema in the description, the tool is fully documented with purpose, usage, parameter details, and return format, leaving no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description explicitly documents the 'tool_name' parameter with examples (e.g., 'sonar_list_issues'), adding meaning beyond the bare schema definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the full JSON schema for a specific SonarQube tool, and distinguishes it from sibling tools 'sonar_execute_tool' and 'sonar_list_categories' by positioning it as a preparatory step before execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs to 'Use after list_categories to get parameter details before calling execute_tool', providing clear workflow context. While it does not enumerate alternatives or when-not-to-use, the guidance is direct and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Discover available SonarQube tools by category.
Returns tool names and descriptions. Categories: instance, project, issue, quality, metrics, rules, task
Args: category: Optional category name to filter (e.g., "project", "issue"). If provided, returns only that category's tools.
Returns: Dictionary with: - success: bool - Operation success status - categories: list - Available categories (when no filter) - category: dict - Single category details (when filtered) - total_tools: int - Total number of tools - error: str - Error message (if success is False)
| Name | Required | Description | Default |
|---|---|---|---|
| category | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations confirm readOnly and idempotent, and description adds detail on return structure and category enumeration, providing full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is structured and concise, covering purpose, parameters, and return values without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple with one optional param; description fully explains input, output, and behavior; output schema is supplemented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only parameter 'category' is described with purpose and example values (instance, project, etc.) despite schema lacking enums; adds essential semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses verb 'Discover' and clarifies it lists SonarQube tools by category, distinct from sibling tools which execute or get schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Does not explicitly state when to use this tool versus siblings, but the purpose of listing tools is implied; no usage exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.1.0sonar_execute_toolsonar_get_tool_schemasonar_list_categoriesEach tool serves a unique purpose: list_categories allows discovery, get_tool_schema provides parameter details, and execute_tool runs the actual tool. No overlap in functionality.
All tools follow a consistent 'sonar_verb_noun' pattern (list_categories, get_tool_schema, execute_tool), using snake_case and clear action-resource naming.
Three tools is an ideal size for a meta-MCP server that dynamically exposes many underlying tools. Each tool earns its place with a critical role in the workflow.
The set covers the full discovery-execution lifecycle: discover tools, inspect schema, then execute. No gaps for the intended meta-functionality.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
A Model Context Protocol (MCP) server for Selise Blocks Cloud integration
An MCP server that provides access to Testiny projects, test cases and test runs
MCP Spec Compliance MCP — audits any MCP server.json against the official Model Context Protocol
Model Context Protocol server for Studex tools, notifications, and profile integrations
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/wadew/sonar-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
