Homepage

The SonarQube CLI is a developer interface for managing projects, viewing issues, and scanning for secrets. Distinct from the SonarScanner CLI, a code analysis scanner for CI/CD pipelines.

This product is in Beta stage and breaking changes may be released. The documentation here matches the release version listed in the table of contents.

Purpose-built for the era of agentic development, SonarQube CLI scans every code snippet an AI agent produces in real time. From a code security standpoint it automatically intercepts session tokens, API keys, and other sensitive credentials before they reach an LLM provider.

This page documents the SonarQube CLI: a developer interface for managing projects, viewing issues, and scanning for secrets.

It is a distinct product from the SonarScanner CLI, a code analysis scanner for CI/CD pipelines invoked with the sonar-scanner command, available for SonarQube Server and SonarQube Cloud.

As a software engineer, you can use the SonarQube CLI as your unified command-line interface to interact with the Sonar ecosystem, including SonarQube Server and SonarQube Cloud.

The SonarQube CLI provides you with essential commands to streamline your workflow:

• Integrate with AI tools like Claude Code and others.

• Analyze your code for common pitfalls, including Secrets scanning.

• View and manage the list of reported issues and projects.

Setup your SonarQube CLI

Check out our Quickstart guide to get started. You'll find the installation commands and a list of guides designed around your AI agent.

Command list

For a full list of available commands, see Commands page.

Do you need help with flags and usage? See the Help page.

Secrets scanning

Scan your source code and configuration files with Sonar’s Secrets Detection Engine to identify and remediate exposed credentials, API keys, and tokens.

Check out the Secrets scanning page for details and the Quickstart secrets detection guide for a quick setup.