> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/agent-centric-development-cycle/developer-tools/agent-plugins/github-copilot.md). # GitHub Copilot The SonarQube plugin for GitHub Copilot CLI connects your AI coding agent to SonarQube's code quality and security data. Once installed and configured, Copilot can analyze code, list and fix issues, check quality gates, inspect coverage and duplication, and run [Agentic Analysis](/agent-centric-development-cycle/features/agentic-analysis.md) through the [Broken mention](broken://pages/KCG1e43mJm4inAtljVSk). The plugin's secrets-detection capabilities keep credentials out of your prompts and the files the agent reads or writes. The plugin works with SonarQube Cloud or SonarQube Server. ## Features The plugin gives the Copilot CLI agent access to the full set of [MCP Server tools reference](broken://pages/ea46038af875afd47c74801363a8a22f726ee654) exposed by the SonarQube MCP Server, including: * Code analysis: analyze code snippets and files in the agent context. * Issues: search, review, and update code issues. * Quality gates: check the quality gate status for a project. * Security hotspots: search and review security hotspots. * Coverage: find under-covered files and review line-by-line coverage. * Dependencies: check third-party dependencies for SCA issues. The plugin also installs: * Secrets detection: a secrets detection hook that blocks Copilot from reading or writing files containing exposed credentials. The plugin also installs custom instructions that tell the agent to refuse working with exposed tokens, since GitHub Copilot CLI doesn't currently support a prompt-time hook. ## Prerequisites * A SonarQube Cloud organization or SonarQube Server instance. * A container runtime (Docker, Podman, or nerdctl) to run the SonarQube MCP Server image. ## Install Install the SonarQube plugin from the `awesome-copilot` marketplace, which is registered by default in GitHub Copilot CLI: * From your shell, run `copilot plugin install sonarqube@awesome-copilot`. * Or inside an interactive Copilot CLI session, run `/plugin install sonarqube@awesome-copilot`. For details on plugin marketplaces and installation, see [Finding and installing plugins for GitHub Copilot CLI](https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/plugins-finding-installing). ## Configuration After installing the plugin, finish setup by running the guided integration skill: ``` /sonar-integrate ``` The skill does the following: 1. Install the SonarQube CLI if not already present, or update it with `sonar self-update`. 2. Authenticate with SonarQube Cloud or your SonarQube Server instance via `sonar auth login`. Your browser opens to complete login; the token is stored in your system keychain. 3. Run `sonar integrate copilot` to register the SonarQube MCP Server and install the secrets-detection hook on your machine. ## Agentic Analysis and Context Augmentation The plugin's MCP Server wiring lets GitHub Copilot CLI use SonarQube Cloud's [Agentic Analysis](/agent-centric-development-cycle/features/agentic-analysis.md) and [Context Augmentation](/agent-centric-development-cycle/features/context-augmentation.md) features through additional MCP toolsets. To enable these features and configure GitHub Copilot CLI to use them effectively, see [Make your agent verify its code](/agent-centric-development-cycle/how-to-guides/verify-your-code/make-your-agent-verify-its-code.md). ## Verify that it works ### Test the secrets hook 1. Create a file with a fake-looking but secret-shaped value: ```javascript // secrets.js const API_KEY = "sqp_1aa323ae0689cd4a1abd062a2ad0a224ae8a1d13"; ``` 2. Ask Copilot to read it: *"Read secrets.js."* 3. Copilot should block the read and explain that the file contains a secret. Once you've confirmed the hook is active, delete the test file. ### Test the MCP server Ask Copilot to list your SonarQube projects via the MCP server. If the call fails, run `sonar auth status` to confirm the underlying token is healthy and restart Copilot. ### Test Agentic Analysis (SonarQube Cloud only) In Copilot, ask: *"Run `sonar verify --staged` and summarize new issues."* Copilot should invoke the CLI and report findings. This requires SonarQube Cloud and the Agentic Analysis entitlement on your organization. ## Non-interactive install For provisioning scripts and onboarding automation, skip the interactive skill and run the SonarQube CLI directly: ```bash sonar integrate copilot --global --non-interactive ``` In non-interactive mode the CLI does not prompt. Run `sonar auth status` afterward to confirm the integration is wired up. See [GitHub Copilot](/sonarqube-cli/integrations/github-copilot.md) in the SonarQube CLI docs for full details. ## Usage After setup, invoke SonarQube skills in GitHub Copilot CLI using slash commands or natural language. Both options are shown for each skill. ### List projects ``` /sonar-list-projects # all accessible projects /sonar-list-projects my-project # search by name or key ``` Or in natural language: * "List my SonarQube projects." * "Search for projects with `auth` in the name." ### List issues ``` /sonar-list-issues # issues in the current project /sonar-list-issues my-project --severity CRITICAL ``` Or in natural language: * "List the issues in `my-project`." * "Show me critical issues in `my-project`." * "Search issues in `my-project` on branch `main`." ### Fix an issue ``` /sonar-fix-issue java:S1481 src/main/java/MyClass.java /sonar-fix-issue python:S2077 src/auth/login.py:34 ``` Or in natural language: * "Fix the issue `java:S1481` in `src/main/java/MyClass.java`." * "Help me fix `python:S2077` on line 34 of `src/auth/login.py`." ### Quality gate ``` /sonar-quality-gate /sonar-quality-gate my-project --branch main ``` Or in natural language: * "Check the quality gate status for `my-project`." * "Show me the quality gate for `my-project` on pull request 42." ### Analyze a file ``` /sonar-analyze /sonar-analyze src/auth/login.py ``` Or in natural language: * "Analyze `src/auth/login.py` for code quality and security issues." * "Run analysis on the current file." ### Coverage ``` /sonar-coverage /sonar-coverage my-project --max 50 /sonar-coverage my-project --file src/auth/login.py ``` Or in natural language: * "What files in `my-project` have less than 50% coverage?" * "Show me line-by-line coverage for `src/auth/login.py`." ### Duplication ``` /sonar-duplication /sonar-duplication my-project --pr 42 /sonar-duplication my-project --file src/auth/login.py ``` Or in natural language: * "Find duplicated files in `my-project`." * "Show duplications in `my-project` on pull request 42." ### Dependency risks Dependency risks require SonarQube Advanced Security. ``` /sonar-dependency-risks /sonar-dependency-risks my-project --pr 42 ``` Or in natural language: * "List dependency risks in `my-project`." * "Show me SCA issues on pull request 42." ### Security hotspots Security hotspots are surfaced through the same `sonar-list-issues` skill: ``` /sonar-list-issues my-project ``` Or in natural language: * "Search security hotspots in `my-project`." * "Show hotspots in `my-project` that are still to review." For the full reference of what the agent can call, see the [MCP Server tools reference](broken://pages/ea46038af875afd47c74801363a8a22f726ee654) page. ## Uninstall To remove the SonarQube plugin from GitHub Copilot CLI: * From your shell, run `copilot plugin uninstall sonarqube`. * Or inside an interactive Copilot CLI session, run `/plugin uninstall sonarqube`. Uninstalling the plugin removes the MCP wiring the plugin registered with Copilot. To also remove the underlying CLI integration files written by the `sonar-integrate` skill (the SonarQube MCP server entry, state record), see [Uninstall](/sonarqube-cli/integrations/github-copilot.md#uninstall) on the SonarQube CLI integration page. ## Related pages * [GitHub Copilot](/sonarqube-cli/integrations/github-copilot.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.sonarsource.com/agent-centric-development-cycle/developer-tools/agent-plugins/github-copilot.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.