> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cli/readme.md). # SonarQube CLI The SonarQube CLI brings code quality and security analysis into your terminal, your scripts, and your AI coding sessions, without waiting for CI/CD. The SonarQube CLI (`sonar`) is a command-line companion for [SonarQube Cloud](https://docs.sonarsource.com/sonarqube-cloud/) and [SonarQube Server](https://docs.sonarsource.com/sonarqube-server/). It lets you scan for secrets, analyze local changes, query projects and issues, and wire SonarQube into AI coding assistants, all from your terminal. **Project links:** [sonarsource.com/sonarqube/cli](https://sonarsource.com/sonarqube/cli/) · [GitHub repository](https://github.com/SonarSource/sonarqube-cli) · [Command reference (HTML)](https://www.sonarsource.com/sonarqube/cli/commands#sonar-auth-login) · [Releases](https://github.com/SonarSource/sonarqube-cli/releases) ## What it does These features support both SonarQube Cloud and SonarQube Server, with some requiring a specific plan, edition, or subscription. * **Detect secrets before they leak.** Scan files, standard input, Git commits, or AI tool calls for hardcoded credentials. See [Secrets detection](/sonarqube-cli/analysis/secrets-detection.md). * **Scan dependencies for vulnerabilities, malware, and prohibited licenses.** `sonar analyze dependency-risks` runs Software Composition Analysis (SCA) on your project's dependencies. Available on SonarQube Cloud and on SonarQube Server 2026.4 or later when SonarQube Advanced Security with SCA is enabled. See [Software Composition Analysis (SCA)](/sonarqube-cli/analysis/sca.md). * **Get fast feedback on local changes.** `sonar analyze` runs every analysis the CLI supports on your uncommitted work. Secrets detection runs locally and needs no SonarQube connection. [Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md) runs with an active subscription. See [Analyzing local changes](/sonarqube-cli/analysis/analyzing-local-changes.md). * **Integrate with AI coding agents.** Install secrets detection and the SonarQube MCP server for Claude Code, GitHub Copilot CLI, Codex, Cursor, and OpenCode in one command. With a Vortex subscription, the same command adds Vortex analysis and Vortex context. Antigravity gets the same features except Vortex context, which you add with a [self-hosted MCP server](/sonarqube-mcp-server/setup/quickstart-guides/antigravity.md#set-up-a-self-hosted-mcp-server) instead of the CLI. See [Overview](/sonarqube-cli/integrations/integrations.md). * **Script and automate.** List your projects, and surface issues in JSON, CSV, TOON, or table format for dashboards, analytics, and pipelines. * **Call the SonarQube API.** Make authenticated requests to any SonarQube Web API endpoint with `sonar api`. * **Trigger AI-assisted fixes.** Send eligible issues to the [Remediation Agent](/agent-centric-development-cycle/in-your-long-living-branches-the-code-maintenance-loop/remediation-agent.md) and apply suggested fixes. See [AI remediation](/sonarqube-cli/analysis/ai-remediation.md). See the [Agent Centric Development Cycle](https://docs.sonarsource.com/agent-centric-development-cycle/) docs for conceptual overviews of Vortex context, Vortex analysis, and the Remediation Agent. For a full reference of every command, option, and example, see [Commands reference](/sonarqube-cli/using-sonarqube-cli/commands.md). ## Three ways to use the CLI **Everyone starts the same way:** follow [Quickstart guide](/sonarqube-cli/quickstart-guide.md) to install, authenticate, and run your first command. Then dig into the workflow that matches your use case: | Use case | Where to go next | | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Run commands interactively in your terminal | [Commands reference](/sonarqube-cli/using-sonarqube-cli/commands.md) (full command reference) | | Plug SonarQube into Claude Code, GitHub Copilot CLI, Codex, Cursor, Antigravity, or OpenCode | [Overview](/sonarqube-cli/integrations/integrations.md) | | Script the CLI in CI/CD or automation | [Environment variables](/sonarqube-cli/using-sonarqube-cli/environment-variables.md) + [Exit codes](/sonarqube-cli/using-sonarqube-cli/exit-codes.md) | ## SonarQube CLI vs. SonarScanner CLI These two products serve different purposes. Choose based on what you're trying to do: * The **SonarQube CLI** (`sonar`, this product) is for developers and AI agents working in their terminal. It interacts with an existing SonarQube project and exposes secrets scanning, local change analysis, AI remediation, and project/issue lookup. * The **SonarScanner CLI** (`sonar-scanner`) is the code analysis scanner used to ingest projects from CI/CD pipelines into SonarQube. See the SonarScanner CLI docs for [SonarQube Server](https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner/) or [SonarQube Cloud](/sonarqube-cloud/analyzing-source-code/scanners/sonarscanner-cli.md). ## Prerequisites * A [SonarQube Cloud](https://docs.sonarsource.com/sonarqube-cloud/) organization or a [SonarQube Server](https://docs.sonarsource.com/sonarqube-server/) instance running 2025.1 or later. * The latest release of the SonarQube CLI receives support. Each release is compatible with SonarQube Cloud and with the SonarQube Server versions that receive patches under the [SonarQube Server patch policy](https://docs.sonarsource.com/sonarqube-server/server-update-and-maintenance/update/release-cycle-model#sonarqube-server-patch-policy) at the time of that release: the latest SonarQube Server version and each LTA (Long-Term Active) version. Staying on the latest release keeps the SonarQube CLI compatible. * A SonarQube **user token** to authenticate with, not a project, global, or organization-scoped token. * A supported operating system: * Linux x86-64 or ARM64 * macOS ARM64 (Apple Silicon) * Windows x86-64 > **Warning:** **macOS Intel is not supported.** The installer only ships a `macos-arm64` binary. Apple Silicon Macs (M1/M2/M3/M4) work natively; Intel Macs are not currently supported. > **Warning:** *User tokens* are required when authenticating your SonarQube CLI with SonarQube Cloud or SonarQube Server. The CLI won't function properly if *project tokens*, *global tokens*, or *scoped organization tokens* are used during setup. ## What a session looks like A typical first run: ```bash # Install (see the quickstart for Homebrew, Mise, and Windows) brew install sonarqube-cli # or: mise use -g sonarqube-cli@latest # Install script: curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash # Authenticate (opens your browser) sonar auth login # Find a secret in a file sonar analyze secrets src/config.ts # List open issues (project key is auto-detected) sonar list issues --format table # Analyze your staged changes against SonarQube Cloud sonar analyze --staged ``` ## For AI agents reading this page If you're an AI coding assistant reading these docs, a machine-readable command reference is published at [`sonarsource.com/sonarqube/cli/llms.txt`](https://sonarsource.com/sonarqube/cli/llms.txt) and a structured JSON schema at [`sonarsource.com/sonarqube/cli/data/commands.json`](https://sonarsource.com/sonarqube/cli/data/commands.json). ## Feedback Share what's working, what is not, and what you'd like next: * **General questions and ideas:** the [Sonar Community forum](https://community.sonarsource.com/). * **Bugs and crashes:** [github.com/SonarSource/sonarqube-cli/issues](https://github.com/SonarSource/sonarqube-cli/issues). * **Feedback form:** [share your impressions](https://forms.gle/jrGic3awT5t5vf7V9). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.sonarsource.com/sonarqube-cli/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.