Home › Servers › SonarQube

SonarQube MCP server

SonarSource's local server for code quality and security findings in SonarQube Server or Cloud.

Transport	stdio (local, oci)
Auth	Local install declares secret environment variables
Registry name	io.github.SonarSource/sonarqube-mcp-server · 1.21.0
Source	https://github.com/SonarSource/sonarqube-mcp-server
Remote endpoints	None declared
Data source	Official MCP Registry
Date checked	2026-10-17

Install

Configs are generated only from packages and remotes on the registry entry. Empty optional flags are listed instead of inserted. Nothing is added that the entry does not declare.

The registry lists this as an oci package (docker.io/sonarsource/sonarqube-mcp) with runtime no runtimeHint, and does not include a run argument. No docker command is invented from that entry.

What the registry and the README publish

The official MCP Registry entry io.github.SonarSource/sonarqube-mcp-server, version 1.21.0, is titled "SonarQube MCP Server". Its description is: "Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants." The package on that entry is the OCI image docker.io/sonarsource/sonarqube-mcp with transport stdio. No remote URL is declared. The entry does not include a run argument, so the install section above does not invent a docker run command. Checked 2026-10-17. Registry record: io.github.SonarSource/sonarqube-mcp-server.

The project README at SonarSource/sonarqube-mcp-server says the server integrates with SonarQube Server or Cloud and can analyze a code snippet in the agent context. The same README says a SonarQube token is a credential: do not hardcode it in a command that lands in shell history, and prefer an environment variable. It documents a manual container setup separately from the registry package fields. That container example is not copied onto this page, because this directory only prints a command the registry entry itself declares.

FAQ

What transport does SonarQube use?

stdio (local, oci).

What credentials are declared for SonarQube?

Local install declares secret environment variables.

When was this checked, and what is the source?

These facts were checked on 2026-10-17. Registry name: io.github.SonarSource/sonarqube-mcp-server. Source: https://github.com/SonarSource/sonarqube-mcp-server.

Similar servers

Auth0

Security & Identity

Manages Auth0 tenants (applications, APIs, actions, logs, forms) through conversational requests.

stdio (local, npm)

Microsoft Sentinel

Security & Identity

Microsoft's hosted server for exploring security data in a Sentinel data lake.

Streamable HTTP (remote)

OSCAL (AWS Labs)

Security & Identity

An AWS Labs server for OSCAL security-control documents. It is a different registry entry from the AWS MCP Server.

stdio (local, pypi)

Snyk

Security & Identity

Runs Snyk security scans from an agent so vulnerabilities can be found and fixed in code.

stdio (local, npm)