Skip to main content

Set up the SonarQube MCP server

The SonarQube MCP server gives AI agents access to your code quality and security analysis — searching issues and security hotspots, checking quality gate status, reading coverage and duplication metrics, and analyzing code snippets against your organization's rules. This guide covers connecting SonarQube to MintMCP for each SonarQube deployment.

Choose your path​

How you connect depends on where SonarQube runs:

Your deploymentHow to connect
SonarQube CloudSonarSource hosts an MCP endpoint — add it as a remote MCP
SonarQube Server 2026.3+ (Developer edition or above)Your server hosts its own MCP endpoint at /mcp — add it as a remote MCP

Both paths authenticate with per-user SonarQube tokens, so SonarQube applies each user's own permissions and MintMCP attributes every tool call to the user who made it.

Prerequisites​

  • A MintMCP admin account
  • A SonarQube Cloud organization, or a SonarQube Server instance on 2026.3 or later (Developer, Enterprise, or Data Center edition)
  • Each user needs a SonarQube account able to generate a user token under My Account > Security

SonarSource hosts the MCP endpoint — nothing to deploy.

Find your organization key​

The endpoint needs your organization key on each request. Find it in SonarQube Cloud under Administration > Organization settings; it also appears in your organization's URL.

Add to MintMCP​

  1. In MintMCP, go to MCP store and open the Recommended servers tab.

  2. Select SonarQube Cloud to open its configuration panel.

  3. In Server URL, enter the endpoint for your SonarQube Cloud region:

    RegionServer URL
    US (default)https://api.sonarqube.us/mcp
    EUhttps://api.sonarcloud.io/mcp

  4. In Organization key, enter your SonarQube Cloud organization key from the previous step.

  5. Click Install.

When users connect, each person generates a token in SonarQube Cloud under My Account > Security > Generate Tokens and pastes it into MintMCP.

Available tools​

The tool set depends on your SonarQube version and edition. Against a current SonarQube Server, the MCP server exposes tools including:

  • Issues: search_sonar_issues_in_projects, change_sonar_issue_status
  • Security hotspots: search_security_hotspots, show_security_hotspot, change_security_hotspot_status
  • Quality gates: get_project_quality_gate_status, list_quality_gates
  • Measures and coverage: get_component_measures, search_files_by_coverage, get_file_coverage_details, search_metrics
  • Duplications: get_duplications, search_duplicated_files
  • Projects and branches: search_my_sonarqube_projects, list_branches, list_pull_requests
  • Analysis: analyze_code_snippet, show_rule

Use tool customization to curate which of these are exposed — for example, hiding the status-changing tools to keep the connector read-only.

Security considerations​

  • SonarQube user tokens carry the creating user's permissions — each user can only see projects they're already authorized to see, and SonarQube's own audit trail attributes actions to them.
  • A few tools mutate state (change_sonar_issue_status, change_security_hotspot_status, analyze_code_snippet submits code to SonarQube for analysis). Hide them via tool customization if you want a read-only connector.
  • Rotate tokens in SonarQube under My Account > Security; revoking a token there immediately cuts off the corresponding MintMCP connection.

Next steps​