SonarQube

You run a SonarQube MCP Server to access SonarQube data through a standardized MCP interface. This lets you authenticate, list projects, view project details, and retrieve metrics from SonarQube in a consistent way for your tools and editors.

How to use

To use this MCP server, you start it in your development environment and connect with an MCP client. You will provide your SonarQube instance URL and a token for authentication, then you can list projects, view details, and fetch metrics through the MCP endpoints.

Prepare your environment and ensure your client can reach your SonarQube instance. Set the following environment variables before starting the MCP server to enable authentication and remote access: SONARQUBE_URL and SONARQUBE_TOKEN.

How to install

Prerequisites: Node.js >= v20.0.0 and a MCP-capable client.

Install the MCP server globally or run it directly with the package manager.

npm install -g @lomas/sonarqubemcp
# or
npx @lomas/sonarqubemcp@latest

Configure your MCP client to connect to SonarQube MCP

Use your MCP client to point at the local or remote MCP server. The following example shows configuring a client to execute the MCP with npx for local use and passing SonarQube credentials via environment variables.

{
  "mcpServers": {
    "SonarQube MCP": {
      "command": "npx",
      "args": [
        "-y",
        "@lomas/sonarqubemcp@1.0.3",
        "sonarqubemcp"
      ],
      "env": {
        "SONARQUBE_URL": "<url>",
        "SONARQUBE_TOKEN": "<token>"
      }
    }
  }
}

Cursor IDE configuration

In Cursor, you can add a global MCP server. Use the recommended configuration to run the MCP server via npx.

{
  "mcpServers": {
    "SonarQube MCP": {
      "command": "npx",
      "args": [
        "-y",
        "@lomas/sonarqubemcp@1.0.3",
        "sonarqubemcp"
      ],
      "env": {
        "SONARQUBE_URL": "<url>",
        "SONARQUBE_TOKEN": "<token>"
      }
    }
  }
}

Windsurf and VS Code connections

You can also configure Windsurf or VS Code to start the MCP server using the same npx command. Add the following config to your respective MCP configuration file.

{
  "mcpServers": {
    "context7": {
      "command": "npx",
      "args": ["-y", "@upstash/context7-mcp"]
    }
  }
}

Security notes

Always protect your SonarQube token. Do not commit tokens to source control. Use environment variable management or secret stores to inject SONARQUBE_URL and SONARQUBE_TOKEN at runtime.

Troubleshooting

Error: Connection refused — Ensure the SonarQube server is running and the URL in SONARQUBE_URL is correct.

Error: Invalid token — Regenerate your SonarQube token and verify it has the required permissions.

Available tools

authenticate

Validate SonarQube token and establish authentication for subsequent MCP calls.

list_projects

Retrieve a list of all SonarQube projects accessible with the provided token.

get_project_details

Fetch detailed information for a specific project by its key.

get_project_metrics

Obtain metrics for a given project and requested metrics set.