SonarQube Integration for MCP Server Code Snippet Analysis

Overview

This MCP (Model Context Protocol) server integrates SonarQube code analysis directly into MCP-enabled agents and tooling. It accepts code snippets or small projects delivered by agents, runs SonarQube analysis (quality, reliability, security rules), and returns structured findings that agents or LLM-based assistants can consume in real time. The server is designed to enable continuous, snippet-level analysis without requiring a full repository checkout or a separate CI pipeline.

By colocating SonarQube analysis in an MCP endpoint, developers and automation systems can get fast, context-aware quality feedback as part of interactive workflows (code review assistants, in-editor tools, automated pull request comments). This approach reduces friction for early-stage feedback and helps surface security or maintainability issues before code is merged.

Features

• Analyze code snippets or small sets of files via an MCP-compatible HTTP API
• Integrates with SonarQube (hosted or self-managed) through SonarQube Web API / scanners
• Returns structured issues (type, severity, line, message) suitable for agents and LLMs
• Lightweight, intended for quick, snippet-level analysis rather than full repo scans
• Configurable project key, language, and SonarQube credentials via env variables or config file
• Docker-friendly and easy to run locally or in CI

Installation / Configuration

Prerequisites: a running SonarQube instance (local or remote) and a SonarQube token with api access.

1. Clone the repository:

git clone https://github.com/SonarSource/sonarqube-mcp-server.git
cd sonarqube-mcp-server

2. Configure environment variables (example):

export SONAR_HOST_URL="https://sonarqube.example.com"
export SONAR_TOKEN="your_sonar_token"
export MCP_PORT=8080
export SONAR_PROJECT_KEY="mcp-temp-project"

3. Run locally (example using Node/Python/Java runtime provided in repo):

# Example: if the project provides a start script
npm install
npm start
# or
python -m mcp_server.main

4. Docker (example):

docker build -t sonarqube-mcp-server .
docker run -e SONAR_HOST_URL=${SONAR_HOST_URL} \
           -e SONAR_TOKEN=${SONAR_TOKEN} \
           -e SONAR_PROJECT_KEY=${SONAR_PROJECT_KEY} \
           -p 8080:8080 \
           sonarqube-mcp-server

5. docker-compose example:

version: "3.8"
services:
  mcp-server:
    image: sonarqube-mcp-server:latest
    environment:
      - SONAR_HOST_URL=https://sonarqube.example.com
      - SONAR_TOKEN=your_sonar_token
      - SONAR_PROJECT_KEY=mcp-temp-project
    ports:
      - "8080:8080"

Key configuration variables

Available Resources

• GitHub repository: https://github.com/SonarSource/sonarqube-mcp-server
• SonarQube documentation: use the SonarQube Web API or scanner docs for advanced tuning
• Example clients: the repo includes sample MCP client snippets (curl, Python, JS) demonstrating how to call the analyze endpoint

API Example

Basic analyze request (snippet of JavaScript):

curl -X POST "http://localhost:8080/analyze" \
  -H "Content-Type: application/json" \
  -d '{
    "projectKey": "mcp-temp-project",
    "language": "js",
    "files": [
      {"path": "index.js", "content": "const a=1; function foo(){return a}"} 
    ]
  }'

Example response (JSON):

{
  "issues": [
    {
      "file": "index.js",
      "line": 1,
      "severity": "MINOR",
      "message": "Remove this unused variable 'a'.",
      "rule": "javascript:S1481"
    }
  ],
  "analysisId": "mcp-20260410-abcdef"
}

Use Cases

• In-editor assistant: Send the current buffer or selected snippet to the MCP server to get immediate SonarQube issues and suggestions without running a full scanner locally.
• Pull request bot: As part of CI or PR checks, extract changed files and request snippet-level analysis for faster, targeted feedback on newly introduced problems.
• LLM-powered code reviewer: Integrate the MCP server as a feedback backend so an LLM can reason about code quality and include SonarQube findings in its review comments.
• Security triage: Quickly scan a suspicious snippet from logs, tickets, or pastebins to detect potential security hotspots before escalating.

Notes and Best Practices

• This server is optimized for quick snippet scans. For full-project analysis, prefer standard SonarQube scanners configured in CI.
• Keep SonarQube tokens secure and grant the minimum required permissions.
• Use a unique or transient project key for temporary analyses to avoid polluting long-term project data.
• Tune SonarQube rules and language analyzers on the SonarQube server for best results with your codebase.

If you need more examples or want to contribute, see the GitHub repository for code, issues, and contribution guidelines.