MCP Directory

How to add SonarQube MCP Server to Claude Desktop

Official SonarQube MCP server: bring code quality, security, and coverage analysis from SonarQube Server or Cloud into AI agents. Paste the config into ~/Library/Application Support/Claude/claude_desktop_config.json and restart Claude Desktop.

Last updated June 14, 2026 · 586★ · stdio · apikey

Claude Desktop config for SonarQube MCP Server

docker pull sonarsource/sonarqube-mcp
{
  "mcpServers": {
    "sonarqube-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

Requires Docker to be installed and running.

Setup steps

  1. 1Open Claude Desktop → Settings → Developer → Edit Config (this opens ~/Library/Application Support/Claude/claude_desktop_config.json).
  2. 2Paste the SonarQube MCP Server config below under the top-level "mcpServers" key.
  3. 3Fill in any placeholder secrets (API keys, paths) in the snippet.
  4. 4Save the file, then fully quit and reopen Claude Desktop.
  5. 5Open a chat and confirm SonarQube MCP Server's tools appear under the 🔌 tools menu.

Before you start

  • Docker (or another OCI-compatible runtime such as Podman/nerdctl), or Java 21+ to run the standalone JAR
  • A SonarQube Cloud or SonarQube Server account
  • A SonarQube token (SONARQUBE_TOKEN); for SonarQube Server it must be a USER token
  • For SonarQube Cloud: your organization key (SONARQUBE_ORG); for SonarQube Server: your server URL (SONARQUBE_URL)

What SonarQube MCP Server can do in Claude Desktop

analyze_code_snippet

Analyze file content with SonarQube analyzers to identify code quality and security issues; optionally filter results to a specific code snippet. Reads from a mounted workspace via filePath, or accepts full fileContent.

analyze_file_list

Analyze files in the current working directory using a running SonarQube for IDE instance (available when SonarQube for IDE integration is enabled).

toggle_automatic_analysis

Enable or disable SonarQube for IDE automatic analysis of files as they are modified.

run_advanced_code_analysis

Run advanced code analysis on SonarQube Cloud for a single file (requires org entitlement and a mounted workspace).

search_files_by_coverage

Search for files in a project sorted by coverage (worst first) to identify files needing test coverage improvements.

get_file_coverage_details

Get line-by-line coverage for a file, including uncovered lines and partially covered branches.

search_dependency_risks

Search software composition analysis (SCA) issues / dependency risks for a project, application, or portfolio (SonarQube Server Enterprise with Advanced Security).

list_enterprises

List enterprises available in SonarQube Cloud that you have access to (returns enterprise IDs for use with other tools).

Security

Your SonarQube token is a sensitive credential. Avoid hardcoding tokens in command-line arguments (they are saved in shell history); prefer environment variables. Never commit tokens to version control, and use environment-variable substitution in config files. For SonarQube Server, the token must be a USER token (project or global tokens will not work). In Streamable HTTP/HTTPS mode the server is stateless and each request must carry the user's own token via an `Authorization: Bearer <token>` header; HTTPS with TLS is recommended for multi-user production deployments. The server collects anonymous usage telemetry (no source code or IP) which can be disabled with `TELEMETRY_DISABLED=true`.

SonarQube MCP Server + Claude Desktop FAQ

Where is the Claude Desktop config file?

Claude Desktop reads MCP servers from ~/Library/Application Support/Claude/claude_desktop_config.json. Paste the SonarQube MCP Server config there under the "mcpServers" key and restart the client.

Is SonarQube MCP Server safe to use with Claude Desktop?

Your SonarQube token is a sensitive credential. Avoid hardcoding tokens in command-line arguments (they are saved in shell history); prefer environment variables. Never commit tokens to version control, and use environment-variable substitution in config files. For SonarQube Server, the token must be a USER token (project or global tokens will not work). In Streamable HTTP/HTTPS mode the server is stateless and each request must carry the user's own token via an `Authorization: Bearer <token>` header; HTTPS with TLS is recommended for multi-user production deployments. The server collects anonymous usage telemetry (no source code or IP) which can be disabled with `TELEMETRY_DISABLED=true`.

Do I connect to SonarQube Cloud or SonarQube Server?

Both are supported. In stdio mode the presence of SONARQUBE_ORG determines the target: if SONARQUBE_ORG is set, SonarQube Cloud is used; otherwise SonarQube Server is used (set SONARQUBE_URL to your server URL). For SonarQube Cloud US, set SONARQUBE_URL=https://sonarqube.us.

What token do I need?

A SonarQube token via SONARQUBE_TOKEN. For SonarQube Cloud, a personal/account token plus your organization key (SONARQUBE_ORG). For SonarQube Server, the token must be a USER token (project or global tokens will not work) plus your server URL (SONARQUBE_URL).

Can I run it without Docker?

Yes. You can download a pre-built standalone JAR from the SonarSource binaries repository and run it with `java -jar` using Java 21 or later (set STORAGE_PATH plus your token/org or URL). You can also build it from source with Gradle.

View repo Full SonarQube MCP Server page