Integrates SonarQube/SonarCloud via MCP server for quality gate checks, issue discovery/triaging, pre-push code analysis, and rule explanations in agent workflows. Use for gate status, finding issues, snippet analysis before commits, or rule details.
From developer-kit-toolsnpx claudepluginhub giuseppe-trisciuoglio/developer-kit --plugin developer-kit-toolsThis skill is limited to using the following tools:
references/best-practices.mdreferences/llm-context.mdreferences/metrics.mdreferences/severity-levels.mdScans installed skills to extract principles shared across 2+ skills and distills them into rules by appending, revising, or creating rule files.
Provides guidance on returns authorization, receipt inspection, condition grading, disposition routing, refund processing, fraud detection, and warranty claims in e-commerce operations.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Leverage SonarQube and SonarCloud capabilities directly through the Model Context Protocol (MCP) server to enforce code quality, discover issues, and run pre-push analysis inside the agent workflow.
This skill provides instructions and patterns for using the SonarQube MCP Server tools. It enables automated workflows for:
Use this skill when:
Trigger phrases: "check quality gate", "sonarqube quality gate", "find sonar issues", "search sonar issues", "analyze code with sonar", "check sonar rule", "sonarcloud issues", "pre-push sonar check", "sonar pre-commit"
The plugin includes a .mcp.json that starts the SonarQube MCP Server automatically via Docker. Before using this skill, set the required environment variables:
SonarQube Server (remote or local):
export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_URL="https://sonarqube.mycompany.com" # or http://host.docker.internal:9000 for local Docker
SonarCloud:
export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_ORG="your-org-key" # required for SonarCloud
# SONARQUBE_URL is not needed for SonarCloud
Requirements:
SONARQUBE_TOKEN is always requiredSONARQUBE_URL is required for SonarQube Server (use host.docker.internal for local instances)SONARQUBE_ORG is required for SonarCloud (omit SONARQUBE_URL in that case)Set your SonarQube/SonarCloud credentials:
# SonarQube Server
export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_URL="https://sonarqube.mycompany.com"
# SonarCloud
export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_ORG="your-org-key"
Verify MCP tool availability:
mcp__sonarqube-mcp__<tool-name>If the MCP server fails to start, check:
references/metrics.md — Common SonarQube metrics and their meaningreferences/severity-levels.md — Sonar severity levels and impact categoriesreferences/best-practices.md — Workflows for PR checks and pre-commit analysisreferences/llm-context.md — Tool selection guide and parameter mapping for LLM agentsDetermine which operation the user needs:
| User Intent | Tool to Use |
|---|---|
| Check if project passes quality gate | get_project_quality_gate_status |
| Find critical issues in a project | search_sonar_issues_in_projects |
| Analyze code before committing | analyze_code_snippet |
| Understand a flagged rule | show_rule |
| Get detailed project metrics | get_component_measures |
| Mark an issue as false positive | change_sonar_issue_status |
If the user's intent is ambiguous, ask for the project key and the goal before proceeding.
Use get_project_quality_gate_status to verify a project meets its quality standards.
Parameters:
projectKey (string) — Project key in SonarQube/SonarCloudpullRequest (string, optional) — Pull request ID for PR-specific gate checkanalysisId (string, optional) — Specific analysis IDNote: There is no
branchparameter on this tool. Without apullRequestoranalysisId, the tool returns the quality gate status for the default branch.
Pattern — Check default branch gate:
{
"name": "get_project_quality_gate_status",
"arguments": {
"projectKey": "my-application"
}
}
Pattern — Check PR gate before merge:
{
"name": "get_project_quality_gate_status",
"arguments": {
"projectKey": "backend-service",
"pullRequest": "456"
}
}
Interpreting the response:
status: "OK" — Gate passed, safe to merge/deploystatus: "ERROR" — Gate failed; check conditions array for failing metricsmetricKey, actualValue, errorThreshold, comparatorFor more on metric keys, see references/metrics.md.
Use search_sonar_issues_in_projects to find and prioritize issues.
Parameters:
projects (array, optional) — List of project keys; omit to search all accessible projectsseverities (array, optional) — Filter: BLOCKER, HIGH, MEDIUM, LOW, INFOpullRequestId (string, optional) — Limit search to a specific PRp (integer, optional) — Page number (default: 1)ps (integer, optional) — Page size (default: 100, max: 500)Pattern — Find blockers and critical issues:
{
"name": "search_sonar_issues_in_projects",
"arguments": {
"projects": ["my-backend", "my-frontend"],
"severities": ["BLOCKER", "HIGH"],
"p": 1,
"ps": 50
}
}
Pattern — Search issues in a PR:
{
"name": "search_sonar_issues_in_projects",
"arguments": {
"projects": ["my-service"],
"pullRequestId": "123",
"severities": ["HIGH", "MEDIUM"],
"p": 1,
"ps": 100
}
}
Managing issues with change_sonar_issue_status:
Use this to mark false positives or accepted technical debt:
{
"name": "change_sonar_issue_status",
"arguments": {
"key": "AY1234",
"status": "falsepositive",
"comment": "This pattern is safe in our context because..."
}
}
Valid statuses: falsepositive (not a real issue), accept (acknowledged technical debt), reopen (reset to open)
Always present the list of issues to the user before changing their status. Never autonomously mark issues as false positives without explicit user confirmation.
Use analyze_code_snippet to run SonarQube analysis on code before committing.
Parameters:
projectKey (string) — Project key for contextfileContent (string, required) — Full content of the file to analyzelanguage (string, optional) — Language hint for better accuracycodeSnippet (string, optional) — Narrow results to a specific sub-range within fileContentSupported languages: javascript, typescript, python, java, go, php, cs, cpp, kotlin, ruby, scala, swift
Pattern — Analyze TypeScript file before commit:
{
"name": "analyze_code_snippet",
"arguments": {
"projectKey": "my-typescript-app",
"fileContent": "async function fetchUser(id: string) {\n const query = `SELECT * FROM users WHERE id = ${id}`;\n return db.execute(query);\n}",
"language": "typescript"
}
}
Pattern — Analyze Python file:
{
"name": "analyze_code_snippet",
"arguments": {
"projectKey": "my-python-service",
"fileContent": "import pickle\n\ndef load_model(path):\n with open(path, 'rb') as f:\n return pickle.load(f)",
"language": "python"
}
}
Response interpretation:
ruleKey, severity, clean code attribute, impact category, line number, quick fix availabilityCRITICAL and HIGH severity issues before committingshow_rule with the ruleKey value for any unfamiliar ruleUse show_rule to understand why a rule exists and how to fix flagged code.
Parameters:
key (string) — Rule key in format <language>:<rule-id> (e.g., typescript:S1082, java:S2068)Pattern — Get rule documentation:
{
"name": "show_rule",
"arguments": {
"key": "typescript:S1082"
}
}
Response includes: rule name, type, severity, full description, tags (e.g., cwe, owasp-a2), language, remediation effort estimate, code examples (non-compliant vs compliant).
Use get_component_measures to retrieve detailed metrics for a project, directory, or file.
Parameters:
projectKey (string) — Project key in SonarQube/SonarCloudpullRequest (string, optional) — PR ID for PR-scoped metricsmetricKeys (array) — List of metric keys to retrieveCommon metric keys: coverage, bugs, vulnerabilities, code_smells, complexity, cognitive_complexity, ncloc, duplicated_lines_density, new_coverage, new_bugs
Pattern — Project health dashboard:
{
"name": "get_component_measures",
"arguments": {
"projectKey": "my-project-key",
"metricKeys": ["coverage", "bugs", "vulnerabilities", "code_smells", "ncloc"]
}
}
For full metric reference, see references/metrics.md.
After each tool call:
User request: "Check if the quality gate passes for project backend-api on PR #234"
{
"name": "get_project_quality_gate_status",
"arguments": {
"projectKey": "backend-api",
"pullRequest": "234"
}
}
If gate fails: Extract failing conditions, present them to the user, then use search_sonar_issues_in_projects filtered by the same PR to show the actual issues.
User request: "Analyze this Go function before I push it"
{
"name": "analyze_code_snippet",
"arguments": {
"projectKey": "my-go-service",
"fileContent": "func handler(w http.ResponseWriter, r *http.Request) {\n id := r.URL.Query().Get(\"id\")\n query := fmt.Sprintf(\"SELECT * FROM orders WHERE id = %s\", id)\n rows, _ := db.Query(query)\n // ...\n}",
"language": "go"
}
}
Present findings → for each issue, optionally call show_rule with the ruleKey value to explain the fix.
User request: "Show me all blocker issues in payment-service"
{
"name": "search_sonar_issues_in_projects",
"arguments": {
"projects": ["payment-service"],
"severities": ["BLOCKER"],
"p": 1,
"ps": 50
}
}
Group results by category (Security, Reliability, Maintainability) and present to user. Offer to call show_rule for unfamiliar rules.
get_project_quality_gate_status as part of any PR review workflowanalyze_code_snippet during development, not only in CIshow_rule for unfamiliar keys — Never dismiss a rule without understanding its intentp and ps parameters; handle multi-page responses for complete coveragechange_sonar_issue_statuslanguage in analyze_code_snippet for more accurate analysisanalyze_code_snippet analyzes snippets in isolation — full project context may affect results in CIreferences/llm-context.mdpaging.total and paging.pageSize in the response to determine whether to iterate further pages