SonarQube MCP Code quality

Quality gates, metrics, issues and security hotspots for projects on SonarQube Server or SonarQube Cloud.

1 credits / tool call

Quick start

Add a SonarQube connection with the settings below, then click Test configuration.
Create an API key for your agent.
Paste the key below, click Test endpoint, and copy the configuration for your platform.

Endpoint	`https://market.oshaani.com/sonarqube` (your default connection) or `https://market.oshaani.com/sonarqube/<connection-id>`
Transport	Streamable HTTP (stateless, JSON responses). MCP protocol versions 2024-11-05 to 2025-11-25 and 2026-07-28.
Authentication	`Authorization: Bearer <API key>`, using a key from the API keys page.

Agent configuration

Endpoint The default URL uses your organisation's default SonarQube connection; a URL with an ID pins one connection.

API key

Get a key

The key is filled into the snippets below. It stays in this page and is only sent with the test request.

Runs initialize and tools/list against the endpoint, exactly like an agent. No credits are charged.

Any MCP client that supports remote (Streamable HTTP) servers with custom headers.

{
  "name": "sonarqube",
  "transport": "streamable-http",
  "url": "https://market.oshaani.com/sonarqube",
  "headers": {
    "Authorization": "Bearer YOUR_API_KEY"
  }
}

~/.cursor/mcp.json (all projects) or .cursor/mcp.json in a project.

{
  "mcpServers": {
    "sonarqube": {
      "url": "https://market.oshaani.com/sonarqube",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Settings > Developer > Edit Config (claude_desktop_config.json). Uses the mcp-remote bridge; needs Node.js.

{
  "mcpServers": {
    "sonarqube": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://market.oshaani.com/sonarqube",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Run in your terminal, or put the JSON in .mcp.json at the project root.

claude mcp add --transport http sonarqube https://market.oshaani.com/sonarqube \
  --header "Authorization: Bearer YOUR_API_KEY"

# .mcp.json
{
  "mcpServers": {
    "sonarqube": {
      "type": "http",
      "url": "https://market.oshaani.com/sonarqube",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

.vscode/mcp.json (GitHub Copilot agent mode). VS Code prompts for the key once and stores it securely.

{
  "inputs": [
    {
      "type": "promptString",
      "id": "oshaani-mcp-key",
      "description": "oshaani MCP Marketplace API key",
      "password": true
    }
  ],
  "servers": {
    "sonarqube": {
      "type": "http",
      "url": "https://market.oshaani.com/sonarqube",
      "headers": {
        "Authorization": "Bearer ${input:oshaani-mcp-key}"
      }
    }
  }
}

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "sonarqube": {
      "serverUrl": "https://market.oshaani.com/sonarqube",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Responses API remote MCP tool (Python SDK).

from openai import OpenAI

client = OpenAI()
response = client.responses.create(
    model="gpt-4.1",
    tools=[{
        "type": "mcp",
        "server_label": "sonarqube",
        "server_url": "https://market.oshaani.com/sonarqube",
        "headers": {"Authorization": "Bearer YOUR_API_KEY"},
        "require_approval": "never",  # or "always" to approve each tool call
    }],
    input="What can you do with these tools?",
)
print(response.output_text)

Messages API MCP connector (Python SDK).

import anthropic

client = anthropic.Anthropic()
response = client.beta.messages.create(
    model="claude-sonnet-4-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "What can you do with these tools?"}],
    mcp_servers=[{
        "type": "url",
        "url": "https://market.oshaani.com/sonarqube",
        "name": "sonarqube",
        "authorization_token": "YOUR_API_KEY",
    }],
    betas=["mcp-client-2025-04-04"],
)
print(response.content)

Official MCP Python SDK 2.x (pip install mcp); works inside any agent framework.

import asyncio

from mcp import ClientSession
from mcp.client.streamable_http import create_mcp_http_client, streamable_http_client


async def main():
    headers = {"Authorization": "Bearer YOUR_API_KEY"}
    async with create_mcp_http_client(headers=headers) as http:
        async with streamable_http_client("https://market.oshaani.com/sonarqube", http_client=http) as (read, write, *_):
            async with ClientSession(read, write) as session:
                await session.initialize()
                tools = await session.list_tools()
                print([tool.name for tool in tools.tools])


asyncio.run(main())

Quick check from a terminal: lists the tools without charging credits.

curl -s https://market.oshaani.com/sonarqube \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Connection settings

Entered once per connection on market.oshaani.com. Secrets are encrypted and never shown again or sent to agents.

Setting	Type	Description
SonarQube URL `url`	string (uri) default "https://sonarcloud.io"	Your SonarQube Server URL, or https://sonarcloud.io for SonarQube Cloud min length 1, max length 2083
Token `token` required secret	string	User token from My Account > Security (Browse permission on the projects)
Organization key `organization`	string	SonarQube Cloud only
Verify TLS certificate `verify_tls`	boolean default true

Tools (6)

`list_projects` read-only

List projects, optionally filtered by name or key

Argument	Type	Description
`query`	string	Part of the project name or key min length 2
`page_size`	integer default 50	min 1, max 500
`page`	integer default 1	min 1

`get_quality_gate` read-only

Get a project's quality gate status and the conditions that pass or fail

Argument	Type	Description
`project_key` required	string	Project key, e.g. my-org_my-service min length 1, max length 400
`branch`	string	Branch name; omit for the main branch
`pull_request`	string	Pull request ID, to check the PR analysis instead of a branch

`get_measures` read-only

Get metrics such as coverage, bugs, vulnerabilities, code smells and ratings for a project

Argument	Type	Description
`project_key` required	string	Project key, e.g. my-org_my-service min length 1, max length 400
`metrics`	array of string	Metric keys; default: alert_status, bugs, vulnerabilities, security_hotspots, code_smells, coverage, duplicated_lines_density, ncloc, sqale_rating, reliability_rating, security_rating
`branch`	string	Branch name; omit for the main branch
`pull_request`	string	Pull request ID, to check the PR analysis instead of a branch

`search_issues` read-only

Search open issues (bugs, vulnerabilities, code smells) in a project

Argument	Type	Description
`project_key` required	string	Project key, e.g. my-org_my-service min length 1, max length 400
`types`	array of "BUG" \| "VULNERABILITY" \| "CODE_SMELL"	Issue types
`severities`	array of "BLOCKER" \| "CRITICAL" \| "MAJOR" \| "MINOR" \| "INFO"	Severities
`branch`	string	Branch name; omit for the main branch
`pull_request`	string	Pull request ID, to check the PR analysis instead of a branch
`page_size`	integer default 50	min 1, max 500
`page`	integer default 1	min 1

`list_security_hotspots` read-only

List security hotspots that still need review

Argument	Type	Description
`project_key` required	string	Project key, e.g. my-org_my-service min length 1, max length 400
`branch`	string	Branch name; omit for the main branch
`pull_request`	string	Pull request ID, to check the PR analysis instead of a branch
`page_size`	integer default 50	min 1, max 500

`get_rule` read-only

Explain a coding rule: what it detects and how to fix it

Argument	Type	Description
`rule_key` required	string	e.g. python:S1192 pattern ^[\w-]+:[\w-]+$

Billing & errors

Each successful tool call costs 1 oshaani.com credit. initialize, tools/list, failed calls and timeouts are free.

JSON-RPC code	Meaning
`-32054` (HTTP 401)	Missing, unknown or revoked API key
`-32053` (HTTP 404)	No SonarQube connection configured for your organisation, or the connection ID is wrong
`-32055` (HTTP 403)	Connection disabled or origin not allowed
`-32052` (HTTP 429)	Rate limit reached; retry after a minute
`-32050`	Not enough oshaani.com credits for the call
`-32051`	Billing temporarily unavailable; the call was not run

Errors from SonarQube itself (bad IDs, permissions) come back as tool results with isError: true so the agent can read and correct them. See the SonarQube API documentation.

SonarQube MCP Code quality

Quick start

Agent configuration

Connection settings

Tools (6)

list_projects read-only

get_quality_gate read-only

get_measures read-only

search_issues read-only

list_security_hotspots read-only

get_rule read-only