SonarQube CLI in agentic workflows

Use SonarQube CLI with agents to perform various actions.

The SonarQube CLI supports every loop of the Agent Centric Development Cycle. sonar integrate connects the CLI with your AI coding agent in one command, installing secrets-detection hooks, the SonarQube MCP server, Sonar Vortex analysis, and Sonar Vortex context. Individual CLI commands let you and your agent run analyses, query issues, and request fixes directly from the terminal.

Supported agents

The following integrations are available:

Agent	Command
Claude Code	sonar integrate claude
Codex CLI	sonar integrate codex
GitHub Copilot CLI	sonar integrate copilot
Cursor	sonar integrate cursor
Antigravity	sonar integrate antigravity

For detailed setup instructions, see the corresponding agent plugin page in agent-plugins/.

What the integration installs

For each supported agent, sonar integrate installs:

• Secrets detection: Hooks, instructions, or both that prevent the agent from reading files containing secrets or including them in prompts. The exact mechanism varies by agent.
• Sonar Vortex analysis: Instructions or hooks that tell the agent to run sonar analyze agentic after edits.
• Sonar Vortex context: A skill that lets the agent pull project guidelines, architecture, semantic navigation, and dependency context as it works.
• SonarQube MCP server: Configured so the agent can fetch projects, issues, and rules directly.

To install the Vortex features, see Installing Vortex.

Analyzing local changes

Beyond the automatic hooks installed by sonar integrate, run Sonar Vortex analysis directly from the terminal at any time:

sonar analyze agentic            # analyze uncommitted changes
sonar analyze agentic --staged   # analyze only staged changes
sonar analyze --staged           # secrets scan plus agentic analysis

This is the same command the integration runs automatically. Call it directly to trigger a check on demand or pass different flags. See Analyzing local changes in the SonarQube CLI docs for the full reference.

Note: Agentic analysis requires a SonarQube Cloud organization with agentic analysis enabled.

Listing and remediating issues

sonar list issues fetches issues from your SonarQube project with filters for severity, type, and status. Pass --format toon for a token-efficient format to pass to an AI agent:

sonar list issues --project <YourProjectKey> --format toon

sonar remediate sends eligible issues to the Remediation Agent and returns a proposed fix:

sonar remediate --project <YourProjectKey>

See AI remediation in the SonarQube CLI docs.

Note: sonar remediate requires a SonarQube Cloud organization entitled to the Remediation Agent. sonar list issues works with both SonarQube Cloud and SonarQube Server.

For AI agents

If you're an AI agent reading these docs, machine-readable references for the SonarQube CLI are available at:

• Command reference (LLM-friendly text): sonarsource.com/sonarqube/cli/llms.txt
• Structured JSON schema: sonarsource.com/sonarqube/cli/data/commands.json

List of commands

For the full list of SonarQube CLI commands, see Commands on the SonarQube CLI website, an interactive reference where you can browse every command with its arguments, options, and examples.

If you prefer the documentation, see the Commands reference page.