Connect SonarQube to Cursor via MCP: Issues and Coverage

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → SonarQube, paste your credentials, mint an MCP API key — done. No Docker, no git clone, no local server.

SonarQube + Cursor

Let your AI read SonarQube: projects, quality gate status, measures such as coverage and their history, open issues by severity and software quality, analyses and branches. SonarQube Server or SonarQube Cloud, read-only, with a user token.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

SONARQUBE_URL, SONARQUBE_TOKEN

Step 1 — Get credentials

Setting up takes about 3 minutes. You need a SonarQube Server (the free Community Build works) or a SonarQube Cloud account with at least one analyzed project, and a user token.

1. Set SONARQUBE_URL, without /api and without a trailing slash: https://sonarcloud.io for SonarQube Cloud in the EU region, https://sonarqube.us for SonarQube Cloud in the US region, or your SonarQube Server's address as you open it in the browser, including any context path (for example https://sonar.example.com or https://example.com/sonarqube).
2. Create a user token and paste it into SONARQUBE_TOKEN, without the word Bearer. On Server: avatar → My Account → Security, then generate a token of type User. On Cloud: avatar → My Account → Access tokens → Personal Tokens, then generate a token. Project and global analysis tokens are for running scans and do not work for the Web API.
3. On SonarQube Cloud, set SONARQUBE_ORGANIZATION to your organization key, shown in the URL sonarcloud.io/organizations/<key>. Cloud needs it to list projects and search issues. On Server, leave it empty.
4. Install the connector and run sonarqube_list_projects: it lists the projects the token can browse, with the project keys the other tools take.

What it reads: whether a project passed its quality gate (OK or ERROR, with each failing condition), current measures such as coverage, duplicated_lines_density, ncloc and the software_quality_* issue counts, how those measures changed from analysis to analysis, issues filtered by software quality (SECURITY, RELIABILITY, MAINTAINABILITY), severity and status, the project's analyses with their events, and its branches with their last analysis and gate status. All 7 tools are read-only, and the token decides which projects the AI sees.

Projects and branches: tools take the project key (for example payments-api, or my-org_payments-api on Cloud), not the display name. Without branch or pullRequest they read the main branch. The Community Build analyzes only the main branch.

Private network: on a self-hosted AnythingMCP, a SonarQube Server on an internal host or a private IP needs that host in SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call. AnythingMCP Cloud can only reach SonarQube Cloud or a SonarQube Server that is reachable from the public internet.

Limits: list tools return up to 500 items per page (1,000 for sonarqube_get_measures_history). Issue search returns at most 10,000 results in total, so narrow the filters instead of paging further. SonarQube Cloud answers 429 when a token sends too many requests: wait a few minutes and try again. SonarQube Server has no rate limit by default.

Common errors: 401 means the token is wrong, expired or revoked, or is an analysis token instead of a user token. 403 means the token's user lacks Browse permission on the project. 404 means the project key, branch or pull request does not exist, or SONARQUBE_URL is wrong. 400 names the missing or invalid parameter, for example a missing organization on Cloud.

The connector does not change anything in SonarQube (no issue transitions, assignments or comments, no quality gate, quality profile, project or token changes), and does not cover security hotspots, portfolios and applications, Web API v2, administration and system endpoints, or new-code-only issue filters.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Cursor

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Cursor reads MCP servers from ~/.cursor/mcp.json. Add this entry:

{
  "mcpServers": {
    "anythingmcp": {
      "url": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart Cursor.
3. Open Cursor → Settings → MCP and check that anythingmcp is listed and connected.
4. Start chatting — the agent can now call the SonarQube tools.

Available tools

FAQ

Does Cursor support custom MCP servers on the free tier? Yes — MCP is available on Hobby, Pro and Business plans.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT