Gitar is joining Sonar
Ctrlk
AC/DC
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Developer

Kiro

Install the SonarQube Power in Kiro to bring SonarQube code quality and security analysis into your AI coding sessions.

The SonarQube Power for Kiro connects Amazon's AI coding IDE to SonarQube's code quality and security data through the About the MCP Server. SonarQube does the analysis; Kiro calls the MCP tools and acts on the results. Once installed and configured, Kiro's agent can run SonarQube analysis on code snippets, retrieve information about issues, check quality gates, fetch coverage and duplication information, pull dependency risks, and synchronize project context for better-informed code changes.

The Power works with SonarQube Cloud or SonarQube Server.

Features

The Power gives Kiro's agent access to the full set of Tools exposed by the SonarQube MCP Server, including:

  • Code analysis: analyze code snippets and files in the agent context.

  • Issues: search, review, and update code issues.

  • Quality gates: check the quality gate status for a project.

  • Security hotspots: search and review security hotspots.

  • Coverage: find under-covered files and review line-by-line coverage.

  • Dependencies: check third-party dependencies for SCA issues.

Note: The Kiro Power doesn't install hooks, so secrets detection, agentic analysis, and context augmentation aren't configured automatically. You can still access each one:

  • Secrets detection: Secrets detection is built into the SonarQube CLI. After installing the CLI as directed during Power setup, run sonar analyze secrets <path> from your terminal.

  • Agentic analysis: Available through the SonarQube MCP Server with the analysis toolset enabled. See Vortex with the MCP server for toolset setup steps.

  • Context augmentation: Requires a local MCP Server running in a container runtime with a volume mount and the cag toolset. See Vortex with the MCP server for toolset setup steps.

Prerequisites

  • A SonarQube Cloud organization or SonarQube Server instance.

  • Kiro installed.

  • The SonarQube CLI. Kiro will guide you through the installation as part of your Power setup. The MCP Server uses your sonar auth login session to connect.

Install

The SonarQube Power is published on the Kiro Powers marketplace. Find SonarQube and click Add to Kiro — the MCP Server configuration is applied automatically.

Configuration

Log in so the MCP Server can connect:

Use the command for your scenario:

Scenario
Command

SonarQube Cloud (EU)

sonar auth login -o <YourOrganizationKey>

SonarQube Cloud (US)

sonar auth login -o <YourOrganizationKey> -s https://sonarqube.us

SonarQube Server

sonar auth login -s <YourServerURL>

Your browser opens to complete login, and the token is stored in your system keychain. Check your authentication anytime with sonar auth status.

Verify that it works

In Kiro's chat, ask: "List my SonarQube projects." Kiro should call the SonarQube MCP Server and return your project list. If it doesn't, check Kiro's MCP settings to confirm the SonarQube Power is enabled, then run sonar auth status to confirm the underlying token is healthy and restart Kiro.

Test Sonar Vortex

Vortex adds context augmentation and agentic analysis. To confirm both are working, see Checking that Vortex works properly.

Related pages

PreviousGitHub Copilot CLI

Last updated

Was this helpful?