SonarQube

SonarQube

This connector reads SonarQube through the v1 Web API (<your SonarQube address>/api), which is the same on SonarQube Server (including the free Community Build) and SonarQube Cloud. All 7 tools are GET requests: the AI can read projects, quality gates, measures, issues, analyses and branches, and cannot change anything in SonarQube. The token decides what it sees: only the projects its user can browse.

Setup (about 3 minutes)

1. Set SONARQUBE_URL without /api and without a trailing slash:
   • SonarQube Cloud, EU region: https://sonarcloud.io
   • SonarQube Cloud, US region: https://sonarqube.us
   • SonarQube Server: its address as you open it in the browser, including any context path, for example https://sonar.example.com or https://example.com/sonarqube.
2. Create a token and paste it into SONARQUBE_TOKEN. On Server: avatar → My Account → Security → generate a token of type User. Project and global analysis tokens are for running scans and do not work for the Web API. On Cloud: avatar → My Account → Access tokens → Personal Tokens → generate a token. It is sent as Authorization: Bearer <token>.
3. On SonarQube Cloud, set SONARQUBE_ORGANIZATION to your organization key (shown in the URL, sonarcloud.io/organizations/<key>): Cloud requires it to list projects and search issues. On Server, leave it empty; Server ignores it.

Private network: on a self-hosted AnythingMCP, a SonarQube Server on an internal host or a private IP (sonar.intern, 10.0.0.x) needs that host in SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made. AnythingMCP Cloud can only reach SonarQube Cloud or a SonarQube Server that is reachable from the public internet.

Projects, branches and pull requests: projects are addressed by their project key (for example payments-api or my-org_payments-api on Cloud), not their display name. Start with sonarqube_list_projects. Without branch or pullRequest every tool reads the main branch; sonarqube_list_branches lists the others. The Community Build analyzes only the main branch.

Quality gate: sonarqube_get_quality_gate_status returns OK or ERROR with each failing condition. SonarQube Cloud marks this endpoint as deprecated but still answers it. If it ever stops answering, use sonarqube_get_measures with metricKeys set to alert_status,quality_gate_details, which exist on Server and Cloud.

Metrics: useful keys for sonarqube_get_measures and sonarqube_get_measures_history are coverage, duplicated_lines_density, ncloc, alert_status, software_quality_reliability_issues, software_quality_security_issues and software_quality_maintainability_issues. Prefer the software_quality_* keys over bugs, vulnerabilities and code_smells, which SonarQube Cloud has deprecated.

Issues: sonarqube_search_issues filters by project with componentKeys and by the impact model: impactSoftwareQualities (SECURITY, RELIABILITY, MAINTAINABILITY), impactSeverities (BLOCKER, HIGH, MEDIUM, LOW, INFO) and issueStatuses (OPEN, CONFIRMED, ACCEPTED, FIXED, FALSE_POSITIVE). The older types, severities and statuses filters are deprecated on Cloud and not used here. Security issues replace the separate security hotspots.

Pagination: list tools take p (page, from 1) and ps (page size, up to 500; up to 1000 on sonarqube_get_measures_history). The response carries paging with pageIndex, pageSize and total. Issue search returns at most 10,000 results in total: narrow the filters rather than paging further.

Rate limits: SonarQube Cloud answers 429 when a token sends too many requests; wait a few minutes and try again. SonarQube Server has no rate limit by default.

Errors: 401 means the token is wrong, expired or revoked, or is an analysis token rather than a user token. 403 means the token's user lacks Browse permission on the project. 404 means the project key, branch or pull request does not exist, or SONARQUBE_URL is wrong. 400 names the missing or invalid parameter, for example a missing organization on Cloud.

Out of scope here: any write (issue transitions, assignments and comments, quality gate and quality profile changes, creating or deleting projects, token management), security hotspots, portfolios and applications, Web API v2, administration and system endpoints, and new-code-only issue filters.