sonarqube

SonarQube agent integrations

Made by Sonar

SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.

SonarQube combines deterministic checks with AI-assisted workflows so quality rules apply consistently to code from both developers and agents. Where your stack supports it, analysis and secrets scanning can run inside the agent loop instead of only in CI.

What do the plugins include

The Plugin helps agents connect to SonarQube CLI and SonarQube MCP Server for issue detection, checking project metrics such as test coverage and duplications, fetch dependency risks, etc. Claude Code, Copilot CLI, Codex, and Antigravity (through SonarQube CLI) install agent hooks for secrets scanning and, when entitled, Vortex agentic analysis.

How to use: Run /sonarqube:sonar-integrate after installation to walk through setup — CLI installation, authentication, and wiring up the MCP Server and hooks. From there, use slash commands like /sonarqube:sonar-quality-gate to check quality gates or interact naturally with prompts like "analyze my code for issues," "show open SonarQube findings," or "check my coverage." With Vortex agentic analysis enabled, verification happens automatically after each edit with no manual invocation required.

Prerequisites

• A SonarQube account (SonarQube Cloud, Server, or Community Build). Some features (for example Vortex agentic analysis) depend on your SonarQube Cloud organization settings.
• SonarQube CLI (sonar) on your machine.
• A container runtime (Docker, Podman, or Nerdctl) for the MCP server image.

Authenticate once with sonar auth login (browser flow; credentials stay in your OS keychain). The MCP server uses that login.

Check auth anytime:

sonar auth status

---

How plugins connect to SonarQube

SonarQube CLI can wire everything for you:

sonar integrate claude        # Claude Code: MCP, hooks, secrets scanning, etc.
sonar integrate copilot       # GitHub Copilot CLI: MCP, hooks, secrets scanning, etc.
sonar integrate codex         # Codex: MCP, hooks, secrets scanning, Vortex agentic analysis hook
sonar integrate antigravity   # Antigravity: hooks, instructions, CAG, MCP patch (after plugin install)
sonar integrate cursor        # Cursor: MCP, secret-scanning hooks, Vortex agentic analysis instructions

Run these after sonar auth login. Use the /sonarqube:sonar-integrate skill if you prefer a guided flow (install/update CLI, login, then integrate).

Claude Code

Install from Anthropic's marketplace claude-plugins-official:

/plugin install sonarqube@claude-plugins-official

claude plugin install sonarqube@claude-plugins-official

One-time setup

• Node.js — for the SessionStart hook (scripts/setup.js).
• Install SonarQube CLI if needed, then /sonarqube:sonar-integrate or sonar auth login + sonar integrate claude.

sonar auth login by scenario:

Scenario	Command
SonarQube Cloud (EU)	sonar auth login -o <org-key>
SonarQube Cloud (US)	sonar auth login -o <org-key> -s https://sonarqube.us
SonarQube Server	sonar auth login -s <server-url>

Optional: add sonar-project.properties in the project root with sonar.projectKey, sources, etc.

---

GitHub Copilot CLI

Plugin bundle: .github/plugin/.

1. Install sonarqube from the pre-packaged awesome-copilot plugins catalog:

   /plugin install sonarqube@awesome-copilot
   

2. Run sonar integrate copilot, or invoke the /sonarqube:sonar-integrate skill.

Same workflows as Usage once MCP is connected.

---

Cursor

.cursor-plugin/ with MCP via mcp.json.

1. Install SonarQube plugin through Cursor's marketplace:

/add-plugin sonarqube

2. Run sonar integrate cursor, or invoke the /sonarqube:sonar-integrate skill.

---

Antigravity

Repo-root plugin: plugin.json, mcp_config.json, rules/sonarqube.md, and shared skills/. Hooks and managed instructions are not in the plugin bundle—they are installed by sonar integrate antigravity.

Recommended flow (full integration)

# 1. Plugin bundle — skills, rules, MCP
agy plugin install https://github.com/SonarSource/sonarqube-agent-plugins