Skip to content

sonarsource/sonarqube

v2.7.0SSAL-1.0

SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.

GitHubOpen Website

SonarQube agent integrations

Made by Sonar

SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.

SonarQube combines deterministic checks with AI-assisted workflows so quality rules apply consistently to code from both developers and agents. Where your stack supports it, analysis and secrets scanning can run inside the agent loop instead of only in CI.

What do the plugins include

The Plugin helps agents connect to SonarQube CLI and SonarQube MCP Server for issue detection, checking project metrics such as test coverage and duplications, fetch dependency risks, etc. Claude Code, Copilot CLI, Codex, Antigravity, Devin, Pi, and OpenCode (through SonarQube CLI) install agent hooks for secrets scanning and, when entitled, Vortex analysis.

How to use: Run /sonarqube:sonar-integrate after installation to walk through setup — CLI installation, authentication, and wiring up the MCP Server and hooks. From there, use slash commands like /sonarqube:sonar-quality-gate to check quality gates or interact naturally with prompts like "analyze my code for issues," "show open SonarQube findings," or "check my coverage." With Vortex analysis enabled, verification happens automatically after each edit with no manual invocation required.

Prerequisites

  • A SonarQube account (SonarQube Cloud, Server, or Community Build). Some features (for example Vortex analysis) depend on your SonarQube Cloud organization settings.
  • SonarQube CLI (sonar) on your machine.
  • A container runtime (Docker, Podman, or Nerdctl) for the MCP server image.

Authenticate once with sonar auth login (browser flow; credentials stay in your OS keychain). The MCP server uses that login.

Check auth anytime:

sonar auth status

How plugins connect to SonarQube

SonarQube CLI can wire everything for you:

sonar integrate claude        # Claude Code: MCP, hooks, secrets scanning, etc.
sonar integrate copilot       # GitHub Copilot CLI: MCP, hooks, secrets scanning, etc.
sonar integrate codex         # Codex: MCP, hooks, secrets scanning, Vortex analysis hook
sonar integrate antigravity   # Antigravity: hooks, instructions, CAG, MCP patch (after plugin install)
sonar integrate cursor        # Cursor: MCP, secret-scanning hooks, Vortex analysis instructions
sonar integrate devin         # Devin: MCP, hooks, secrets scanning, Vortex analysis
sonar integrate pi            # Pi: MCP, hooks, secrets scanning, Vortex analysis
sonar integrate opencode      # OpenCode: MCP, hooks, secrets scanning, Vortex analysis

Run these after sonar auth login. Use the /sonarqube:sonar-integrate skill if you prefer a guided flow (install/update CLI, login, then integrate).

Claude Code

Install from Anthropic's marketplace claude-plugins-official:

/plugin install sonarqube@claude-plugins-official

claude plugin install sonarqube@claude-plugins-official

One-time setup

  • Node.js — for the SessionStart hook (scripts/setup.js).
  • Install SonarQube CLI if needed, then /sonarqube:sonar-integrate or sonar auth login + sonar integrate claude.

sonar auth login by scenario:

ScenarioCommand
SonarQube Cloud (EU)sonar auth login -o <org-key>
SonarQube Cloud (US)sonar auth login -o <org-key> -s https://sonarqube.us
SonarQube Serversonar auth login -s <server-url>

Optional: add sonar-project.properties in the project root with sonar.projectKey, sources, etc.

GitHub Copilot CLI

Plugin bundle: .github/plugin/.

  1. Install sonarqube from the pre-packaged awesome-copilot plugins catalog:

    /plugin install sonarqube@awesome-copilot

  2. Run sonar integrate copilot, or invoke the /sonarqube:sonar-integrate skill.

Same workflows as Usage once MCP is connected.

Cursor

.cursor-plugin/ with MCP via mcp.json.

  1. Install SonarQube plugin through Cursor's marketplace:
/add-plugin sonarqube
  1. Run sonar integrate cursor, or invoke the /sonarqube:sonar-integrate skill.

Antigravity

Repo-root plugin: plugin.json, mcp_config.json, rules/sonarqube.md, and shared skills/. Hooks and managed instructions are not in the plugin bundle—they are installed by sonar integrate antigravity.

Recommended flow (full integration)

# 1. Plugin bundle — skills, rules, MCP
agy plugin install https://github.com/SonarSource/sonarqube-agent-plugins

# 2. Auth + hooks / instructions / CAG / MCP patch
sonar auth login
sonar integrate antigravity

Or use /sonarqube:sonar-integrate inside Antigravity for a guided flow. Restart the agent session if MCP tools do not appear.

Install options

OptionCommand / pathWhat you get
CLI globalagy plugin install <git-url|path|archive>Plugin copied to ~/.gemini/config/plugins/sonarqube/
IDE workspace<project>/.agents/plugins/sonarqube/Plugin for that workspace only
Monorepo devOpen sonarqube-agent-plugins as workspaceAuto-discovery from repo root — no agy plugin install

Installing the whole repo is acceptable — other agents' dot-folders are inert in Antigravity.

Same workflows as Usage once MCP is connected.

Factory Droid

.factory-plugin/ with MCP via mcp.json and the reviewer in droids/. No hooks: secrets scanning and Vortex analysis hooks are not available in Droid.

  1. Install the plugin from the SonarSource marketplace:
droid plugin marketplace add SonarSource/sonarqube-agent-plugins
droid plugin install sonarqube@sonarqube-agent-plugins

Droid names the marketplace after the repository, not after the name in marketplace.json, so the plugin is sonarqube@sonarqube-agent-plugins.

  1. Run sonar auth login, or invoke the /sonarqube:sonar-integrate skill.

Devin

.devin-plugin/ with MCP via mcp.json.

  1. Install the plugin from GitHub:
devin plugins install SonarSource/sonarqube-agent-plugins
  1. Run sonar auth login, then sonar integrate devin, or invoke the /sonarqube:sonar-integrate skill. Restart the Devin session afterwards so the hooks and MCP configuration are loaded.

Codex CLI

Plugin bundle: .codex-plugin/ — catalog sonar, plugin sonarqube (see .codex-plugin/plugin.json).

  1. Add SonarSource/sonarqube-agent-plugins as a plugin marketplace in Codex CLI:

    codex plugin marketplace add SonarSource/sonarqube-agent-plugins

  2. Install sonarqube plugin from that catalog:

    codex plugin add sonarqube@sonar

  3. Run sonar auth login.

  4. Run sonar integrate codex. This wires MCP in ~/.codex/config.toml, secrets hooks, and—when your SonarQube Cloud org has Vortex analysis—a PostToolUse hook on apply_patch that runs analysis on the git change set after each edit, applying to all Codex sessions on this machine.

Same workflows as Usage once MCP is connected.

Kiro

Plugin includes MCP configuration (kiro-power/mcp.json) that runs the mcp/sonarqube image and relies on SonarQube CLI for authentication—the same sonar auth login session.

sonar auth login, then enable the power per Kiro’s documentation.

OpenCode

  1. Install the SonarQube plugin in OpenCode V2:

    opencode plugin add 'github:SonarSource/sonarqube-agent-plugins#master'

  2. Run sonar integrate opencode, or invoke the /sonar-integrate skill.

Pi

  1. Install the SonarQube plugin:

    pi install git:github.com/SonarSource/sonarqube-agent-plugins

  2. Run sonar integrate pi, or invoke the /skill:sonar-integrate skill.

Usage

Skills are the same across agents. Ask in natural language, invoke skills explicitly, or use the SonarQube MCP tools your client shows after MCP starts.

On Claude Code, GitHub Copilot CLI, and Cursor, the plugin also ships a sonarqube-reviewer agent (agents/sonarqube-reviewer.agent.md) that composes the skills below into a single PR/diff review — quality gate, issues, dependency risks, duplication, and coverage — without editing code itself.

MCP reference: SonarQube MCP Server docs.

Skills

Set up

/sonarqube:sonar-integrate

List projects

/sonarqube:sonar-list-projects
/sonarqube:sonar-list-projects my-project

List issues

/sonarqube:sonar-list-issues
/sonarqube:sonar-list-issues my-project --severities CRITICAL

Fix an issue

/sonarqube:sonar-fix-issue java:S1481 src/main/java/MyClass.java
/sonarqube:sonar-fix-issue python:S2077 src/auth/login.py:34

Quality gate / analyze / coverage / duplication / dependency risks

/sonarqube:sonar-quality-gate
/sonarqube:sonar-quality-gate my-project --branch main

/sonarqube:sonar-analyze
/sonarqube:sonar-analyze src/auth/login.py

/sonarqube:sonar-coverage
/sonarqube:sonar-coverage my-project --max 50
/sonarqube:sonar-coverage my-project --file src/auth/login.py

/sonarqube:sonar-duplication
/sonarqube:sonar-duplication my-project --pr 42

/sonarqube:sonar-dependency-risks
/sonarqube:sonar-dependency-risks my-project --pr 42

/sonarqube:sonar-triage-dependency-risks
/sonarqube:sonar-triage-dependency-risks my-project --branch main --fix

License

Copyright (C) 2025-2026 SonarSource Sàrl. Licensed under SSAL-1.0.

Support