GitHub Copilot CLI

Install the SonarQube plugin in GitHub Copilot CLI to bring SonarQube code quality and security analysis into your AI coding sessions, powered by the SonarQube MCP Server.

The SonarQube plugin for GitHub Copilot CLI connects your AI coding agent to SonarQube's code quality and security data. Once installed and configured, Copilot CLI can analyze code, list and fix issues, check quality gates, inspect coverage and duplication, and run Sonar Vortex: agentic analysis through the SonarQube CLI. The plugin's secrets-detection capabilities keep credentials out of your prompts and the files the agent reads or writes.

The plugin works with SonarQube Cloud or SonarQube Server.

This page covers the GitHub Copilot CLI terminal agent. For GitHub Copilot Chat in VS Code, see GitHub Copilot in VS Code.

Features

The plugin gives the Copilot CLI agent access to the full set of Tools exposed by the SonarQube MCP Server, including:

• Code analysis: analyze code snippets and files in the agent context.
• Issues: search, review, and update code issues.
• Quality gates: check the quality gate status for a project.
• Security hotspots: search and review security hotspots.
• Coverage: find under-covered files and review line-by-line coverage.
• Dependencies: check third-party dependencies for SCA issues.

The plugin also installs:

• Secrets detection: a secrets detection hook that blocks Copilot CLI from reading or writing files containing exposed credentials. The plugin also installs custom instructions that tell the agent to refuse working with exposed tokens, since GitHub Copilot CLI doesn't currently support a prompt-time hook.
• Agentic analysis (SonarQube Cloud only, project-level installs): instructions that tell Copilot CLI to verify the files it edits.
• Context augmentation (SonarQube Cloud only, project-level installs): a skill that tells Copilot CLI to pull project guidelines before editing code, check dependencies before changing a manifest, and use SonarQube's architecture and semantic-navigation context as it works.

Prerequisites

• A SonarQube Cloud organization or SonarQube Server instance.
• A container runtime (Docker, Podman, or nerdctl) to run the SonarQube MCP Server image.

Install

Install the SonarQube plugin from the awesome-copilot marketplace, which is registered by default in GitHub Copilot CLI:

• From your shell, run copilot plugin install sonarqube@awesome-copilot.
• Or inside an interactive Copilot CLI session, run /plugin install sonarqube@awesome-copilot.

For details on plugin marketplaces and installation, see Finding and installing plugins for GitHub Copilot CLI.

Configuration

After installing the plugin, finish setup by running the guided integration skill:

/sonar-integrate

The skill does the following:

1. Install the SonarQube CLI if not already present, or update it with sonar self-update.
2. Authenticate with SonarQube Cloud or your SonarQube Server instance via sonar auth login. Your browser opens to complete login; the token is stored in your system keychain.
3. Run sonar integrate copilot, which prompts you to install each component: the secrets-detection hook, the prompt-secrets instructions, the SonarQube MCP Server, and, for SonarQube Cloud project installs, the agentic analysis instructions and context augmentation skill.

Sonar Vortex: agentic analysis and context augmentation features

When you run sonar integrate copilot, the command configures Copilot CLI to use the Sonar Vortex: agentic analysis and Sonar Vortex: context augmentation features. Both run through the SonarQube CLI:

• Agentic analysis: instructions tell Copilot CLI to check the files it edits and return any findings in its response. Unlike the Claude Code and Codex hooks, Copilot CLI can't inject findings back into the conversation.
• Context augmentation: gives Copilot CLI your project's coding guidelines, dependency health, architecture, and semantic-navigation context as it works.

Both features are project-scoped and skipped on a global install. Run sonar integrate copilot --project <YourProjectKey> from a project directory to install them, or pass --skip-context to opt out of context augmentation.

To enable these features and configure Copilot CLI to use them effectively, see Make your agent verify its code.

Verify that it works

Test the secrets hook

1. Create a file with a fake-looking but secret-shaped value:

   // secrets.js
   const API_KEY = "sqp_1aa323ae0689cd4a1abd062a2ad0a224ae8a1d13";

2. Ask Copilot CLI to read it: "Read secrets.js."
3. Copilot CLI should block the read and explain that the file contains a secret.

Once you've confirmed the hook is active, delete the test file.

Test the MCP server

Ask Copilot CLI to list your SonarQube projects via the MCP server. If the call fails, run sonar auth status to confirm the underlying token is healthy and restart Copilot CLI.

Test agentic analysis (SonarQube Cloud only)

Make a code change through Copilot CLI, for example ask it to edit a file. After Copilot CLI applies the change, it should run sonar analyze agentic and surface any new findings. This requires SonarQube Cloud and the agentic analysis entitlement on your organization.

Test context augmentation (SonarQube Cloud only)

Ask Copilot CLI: "What is the current architecture of the project? Limit the answer to the top-level blocks." Copilot CLI uses the context augmentation skill to retrieve the current architecture and presents a high-level overview of the project. This requires SonarQube Cloud and a project-level install.

Non-interactive install

For provisioning scripts and onboarding automation, skip the interactive skill and run the SonarQube CLI directly:

sonar integrate copilot --global --non-interactive

In non-interactive mode the CLI does not prompt. A --global install wires up the SonarQube MCP Server and the secrets-detection hook, but skips the project-scoped agentic analysis instructions and context augmentation skill. Run sonar auth status afterward to confirm the integration is wired up. See GitHub Copilot CLI in the SonarQube CLI docs for full details.

Usage

After setup, invoke SonarQube skills in GitHub Copilot CLI using slash commands or natural language. Both options are shown for each skill.

List projects

/sonar-list-projects                    # all accessible projects
/sonar-list-projects my-project         # search by name or key

Or in natural language:

• "List my SonarQube projects."
• "Search for projects with auth in the name."

List issues

/sonar-list-issues                                        # issues in the current project
/sonar-list-issues my-project --severity CRITICAL

Or in natural language:

• "List the issues in my-project."
• "Show me critical issues in my-project."
• "Search issues in my-project on branch main."

Fix an issue

/sonar-fix-issue java:S1481 src/main/java/MyClass.java
/sonar-fix-issue python:S2077 src/auth/login.py:34

Or in natural language:

• "Fix the issue java:S1481 in src/main/java/MyClass.java."
• "Help me fix python:S2077 on line 34 of src/auth/login.py."

Quality gate

/sonar-quality-gate
/sonar-quality-gate my-project --branch main

Or in natural language:

• "Check the quality gate status for my-project."
• "Show me the quality gate for my-project on pull request 42."

Analyze a file

/sonar-analyze
/sonar-analyze src/auth/login.py

Or in natural language:

• "Analyze src/auth/login.py for code quality and security issues."
• "Run analysis on the current file."

Coverage

/sonar-coverage
/sonar-coverage my-project --max 50
/sonar-coverage my-project --file src/auth/login.py

Or in natural language:

• "What files in my-project have less than 50% coverage?"
• "Show me line-by-line coverage for src/auth/login.py."

Duplication

/sonar-duplication
/sonar-duplication my-project --pr 42
/sonar-duplication my-project --file src/auth/login.py

Or in natural language:

• "Find duplicated files in my-project."
• "Show duplications in my-project on pull request 42."

Dependency risks

Dependency risks require SonarQube Advanced Security.

/sonar-dependency-risks
/sonar-dependency-risks my-project --pr 42

Or in natural language:

• "List dependency risks in my-project."
• "Show me SCA issues on pull request 42."

Security hotspots

Security hotspots are surfaced through the same sonar-list-issues skill:

/sonar-list-issues my-project

Or in natural language:

• "Search security hotspots in my-project."
• "Show hotspots in my-project that are still to review."

For the full reference of what the agent can call, see the Tools page.

Uninstall

To remove the SonarQube plugin from GitHub Copilot CLI:

• From your shell, run copilot plugin uninstall sonarqube.
• Or inside an interactive Copilot CLI session, run /plugin uninstall sonarqube.

Uninstalling the plugin removes the MCP wiring the plugin registered with Copilot CLI. To also remove the underlying CLI integration files written by the sonar-integrate skill (the SonarQube MCP server entry, state record), see Uninstall on the SonarQube CLI integration page.

GitHub Copilot in VS Code

GitHub Copilot Chat in VS Code is a separate product from GitHub Copilot CLI. The GitHub Copilot Chat extension runs inside VS Code and integrates directly with the SonarQube VS Code extension, with no plugin installation, MCP server, or Docker required.

The SonarQube VS Code extension exposes Copilot tools that give Copilot Chat per-file diagnostic access in agent mode:

• #sonarqube_analyzeFile: analyze a file for code quality and security issues
• #sonarqube_getPotentialSecurityIssues: list security issues and taint vulnerabilities in a file
• #sonarqube_setUpConnectedMode: guided connected mode setup with SonarQube Server or Cloud
• #sonarqube_excludeFiles: exclude files and folders from analysis

To add instruction-file-based guidance on top of these tools (secrets scanning rules, issue querying, and SonarQube CLI commands), run sonar integrate copilot inside your project. This generates instruction files similar to those installed by the SonarQube plugin for GitHub Copilot CLI. Note that the pre-tool secrets-scanning hook does not fire in Copilot Chat; it is wired for the Copilot CLI terminal agent only.

More information about using the GitHub Copilot extension is available in the SonarQube for VS Code documentation.

Related pages

• GitHub Copilot CLI

• GitHub Copilot CLI