SonarScanner CLI

When your build system lacks a dedicated scanner, the SonarScanner CLI is the go-to tool for initiating an analysis with SonarQube Cloud.

SonarScanner — 8.0.1 | Issue Tracker

8.0.1 ^{_2025-12-05 Update embedded JREs to Java 21} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.3 ^{_2025-10-06 Support z/OS as an Operating System to execute Scanners} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.2 ^{_2025-07-21 Restore ability to run the scanner with Java 11, update dependencies} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.1 ^{_2025-03-21 Support for SonarQube Cloud regions} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.0.2 ^{_2025-02-14 Bug fix to support SONAR_TOKEN on old SonarQube versions} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.0.1 ^{_2025-02-03 Support empty truststore password} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

7.0 ^{_2025-01-20 Non-latin character support in properties files, ISO-8859-1 support dropped} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

6.2.1 ^{_2024-10-01 FIPS support and improved SSL configuration} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

6.2 ^{_2024-09-17 Support PKCS12 truststore generated with OpenSSL} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

6.1 ^{_2024-06-27 macOS and Linux AArch64 distributions} Download scanner for: Linux x64 Linux AArch64 Windows x64 macOS x64 macOS AArch64 Docker Any (Requires a pre-installed JVM) Release notes

---

6.0 ^{_2024-06-04 New bootstrapping mechanism and JRE provisioning with SonarQube 10.6+ and SonarCloud} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

5.0.2 ^{_2025-06-02 Security fix} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

5.0.1 ^{_2023-08-04 Bug fix to the JRE binaries for Linux} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

5.0 ^{_2023-07-31 Update embedded JRE to Java 17} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.8.1 ^{_2023-08-14 Security fix} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.8 ^{_2022-02-06 Update embedded JRE 11 to the latest, bug fixes} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.7 ^{_2022-02-02 Ease import of custom certificates with the Docker image, update embedded JRE 11} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.6.2 ^{_2021-05-07 Update dependencies, bug fix} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.6.1 ^{_2021-04-30 Update dependencies} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.6 ^{_2021-01-13 Support for Bitbucket Pipelines with SonarQube 8.7+} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.5 ^{_2020-10-05 Fix a bug preventing the analysis in some environments} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.4 ^{_2020-07-03 New supported Docker image, bug fix} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.3 ^{_2019-03-09 Use SonarScanner name and better handle SonarCloud case in logs} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.2 ^{_2019-10-01 Support SONAR_HOST_URL environment variable to configure the server URL} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

---

4.1 ^{_2019-09-09 Improve the use of a custom project configuration file} Download scanner for: Linux x64 Windows x64 macOS x64 Docker Any (Requires a pre-installed JVM) Release notes

The SonarScanner CLI is the scanner to use when there is no specific scanner for your build system. It supports ARM architecture for macOS and Linux.

Prerequisites

• Java 21 or later, Java 17 has been deprecated. See Java runtime environment (JRE) for more details.

• With JRE auto-provisioning:

  • Java 11 or later from SonarScanner CLI version 7.2

  • Java 17 or later before SonarScanner CLI version 7.2

See General requirements for more information.

Installation

• Expand the downloaded file into the directory of your choice. We’ll refer to it as $install_directory in the next step.

• Add the $install_directory/bin directory to your path.

• Verify your installation by opening a new shell and executing the command sonar-scanner -h(sonar-scanner.bat -h on Windows). You should get an output like this:

usage: sonar-scanner [options]

Options:
  -D,--define <arg>     Define property
  -h,--help             Display help information
  -v,--version          Display version information
  -X,--debug            Produce execution debug output

If you need more debug information you can add one of the following to your command line:

-X, --verbose, or -Dsonar.verbose=true.

Use

• Create a configuration file in the root directory of the project: sonar-project.properties

# Organization and project keys are displayed in the right sidebar of the project homepage
sonar.organization=my_organization
sonar.projectKey=my_project
sonar.host.url=https://sonarcloud.io

# --- optional properties ---

# defaults to project key
#sonar.projectName=My project
# defaults to 'not provided'
#sonar.projectVersion=1.0

# Path is relative to the sonar-project.properties file. Defaults to .
#sonar.sources=.

# Encoding of the source code. Default is default system encoding
#sonar.sourceEncoding=UTF-8

• Set the environment variable SONAR_TOKEN with the Scoped Organization Token (SOT) (recommended from the Team plan) or Personal Access Token (PAT). Note that the token can also be set through the command line argument -Dsonar.token. To generate the token, see Managing Scoped Organization Tokens or Managing Personal Access Tokens.

• Run the command sonar-scanner, or sonar-scanner.bat on Windows, from the project base directory to run the analysis.

sample-projects

To help you get started, simple project samples are available for most languages on GitHub. They can be browsed or downloaded.

Alternatives to the sonar-project.properties file

If the sonar-project.properties file cannot be created in the root directory of the project, the alternatives are:

• The properties can be specified directly through the command line. Example:

sonar-scanner -Dsonar.organization=my_organization -Dsonar.projectKey=my_project -Dsonar.sources=src

• The property project.settings can be used to specify the path to the project configuration file (this option is incompatible with the sonar.projectBaseDir.property).

• The root folder of the project to analyze can be set through the sonar.projectBaseDir property. This folder must contain a sonar-project.properties file if the sonar.projectKey is not specified on the command line. Additional analysis parameters can be defined in this project configuration file or through command line parameters.

Alternate analysis directory

If the files to be analyzed are not in the directory where the analysis starts from, use the sonar.projectBaseDir property to move analysis to a different directory. For example, when an analysis begins from jenkins/jobs/myjob/workspace but the files to be analyzed are in ftpdrop/cobol/project1.

sonar.projectBaseDir=/home/ftpdrop/cobol/project1
sonar.sources=src
sonar.cobol.copy.directories=/copy

For more, see the listing of Analysis parameters.

Troubleshooting

Java heap space error or java.lang.OutOfMemoryError

Increase the memory using SONAR_SCANNER_JAVA_OPTS environment variable for SonarScanner CLI version 6.0 and higher. For the previous versions use SONAR_SCANNER_OPTS:

export SONAR_SCANNER_JAVA_OPTS="-Xmx512m"

In Windows environments, avoid using double-quotes, since they get misinterpreted, with the result that the two parameters are combined into a single one.

set SONAR_SCANNER_JAVA_OPTS=-Xmx512m

"java" cannot be opened because the developer cannot be verified

The SonarScanner CLI is not yet Apple verified therefore, when using the macOS AArch64 version, you may get an OS security window displaying this message. A solution us to run:

sudo xattr -dr com.apple.quarantine /path/to/sonar-scanner-version-macosx-aarch64

Unsupported major.minor version

Install the last version of SonarScanner CLI (from version 6.0, no JRE installation is required). Otherwise, upgrade the version of Java being used for analysis or use one of the core packages that embed its own Java runtime.

Property sonar.cs.analyzer.projectOutPaths is missing

No protobuf files will be loaded for this project. SonarScanner is not able to analyze .NET projects. Please use the SonarScanner for .NET.