> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cli/administration/state-and-storage.md). # State and storage Use this page to audit exactly what the SonarQube CLI writes to disk, where it lives, and how credentials are stored. ## On-disk layout CLI-specific data lives under `~/.sonar/sonarqube-cli/`. The stable anonymous telemetry user ID is stored one level up, at `~/.sonar/user`, so it can be shared across Sonar products on the same machine. Override the shared root with [`SONAR_USER_HOME`](/sonarqube-cli/using-sonarqube-cli/environment-variables.md#storage). | Path | Contents | | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `~/.sonar/user` | Stable anonymous telemetry user ID (shared across Sonar products). Contains a UUID only. | | `~/.sonar/sonarqube-cli/state.json` | CLI state (active connection ID, telemetry preferences, installed integrations, tool metadata). | | `~/.sonar/sonarqube-cli/telemetry/telemetry-events.ndjson` | Buffered telemetry events waiting to be flushed to SonarSource. | | `~/.sonar/sonarqube-cli/bin/` | Auxiliary binaries downloaded on demand (the secrets detection engine and SCA scanner). | | `~/.sonar/sonarqube-cli/hooks/` | Git hook scripts installed by `sonar integrate git --global`. | | `~/.sonar/sonarqube-cli/logs/` | CLI log files. | | `~/.sonar/sonarqube-cli/cli-tmp/` | Temporary files generated by the CLI (for example, PKCS#12 keystores converted for the MCP server). Removed when the MCP process exits or when you run `sonar system reset`. | If you upgraded from an earlier CLI version that stored the user ID at `~/.sonar/sonarqube-cli/user`, the CLI migrates it to `~/.sonar/user` on first use and removes the legacy file. The `sonar` binary itself is installed separately by the install script: | Operating system | `sonar` binary location | | ---------------- | -------------------------------------------- | | macOS / Linux | `~/.local/share/sonarqube-cli/bin/sonar` | | Windows | `%LOCALAPPDATA%\sonarqube-cli\bin\sonar.exe` | ## What `state.json` contains The state file contains these top-level keys: | Key | Purpose | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `version` | The state schema version. | | `lastUpdated` | ISO timestamp of the last state mutation. | | `auth` | Connection metadata (server URL, organization, active connection ID, token name). **Token values themselves are not stored here**; they live in the OS keychain. | | `config` | CLI version, throttled update-check metadata (`config.updateCheck`), and other configuration hints. | | `telemetry` | Telemetry enabled flag and installation ID. Pending events are stored in `telemetry/telemetry-events.ndjson`, not in this file. | | `tools` | Versions and paths of installed auxiliary binaries (secrets engine, SCA scanner). | | `integrations` | Registry of installed agent/Git integrations and where each feature was installed. | | `agents` | Legacy registry kept for backward compatibility with earlier CLI versions. | | `agentExtensions` | Legacy registry kept for backward compatibility with earlier CLI versions. | `cat` or `jq` this file at any time; it contains no secrets. When automatic update notices are enabled, `config.updateCheck` stores the ISO timestamp of the last remote version check (`lastCheckedAt`) and the latest stable version returned (`latestVersion`). The CLI reuses this cache for up to 24 hours so routine commands don't trigger repeated network requests. ## Where tokens are stored The CLI stores tokens in your operating system's secure credential store, not in plain files: | OS | Store | | ------- | ----------------------------------------- | | macOS | Keychain Access. | | Windows | Windows Credential Manager. | | Linux | Secret Service (GNOME Keyring / KWallet). | * **Service name:** `sonarqube-cli` * **Account name:** `` for SonarQube Server, or `:` for SonarQube Cloud (one entry per connection). To audit which tokens the CLI has saved, open your OS keychain and search for `sonarqube-cli`. To remove the active connection, run [`sonar auth logout`](/sonarqube-cli/using-sonarqube-cli/commands.md#sonar-auth-logout). Repeat after switching connections if you have saved multiple entries. > **Warning:** **WSL has no keychain.** Under Windows Subsystem for Linux, no Secret Service is available by default, so the interactive `sonar auth login` flow doesn't work. Use [Environment variables](/sonarqube-cli/using-sonarqube-cli/environment-variables.md) for authentication in WSL. ## What the CLI writes when you run a command * `state.json` is updated on most commands: connection changes, integration installs, and telemetry preference changes. * `telemetry/telemetry-events.ndjson` receives buffered telemetry events until they're flushed. * `~/.sonar/sonarqube-cli/logs/` may receive log output for debugging. * The CLI writes the auxiliary scanner binaries in `~/.sonar/sonarqube-cli/bin/` when first needed and reuses them afterwards. They're versioned and refreshed when you run `sonar update` on a standalone build. * Integration commands (`sonar integrate antigravity` / `claude` / `codex` / `copilot` / `cursor` / `git`) also write outside `~/.sonar/`: * AI agent integrations write to `~/.gemini/`, `~/.claude/`, `~/.codex/`, `~/.copilot/`, or `~/.cursor/` (global) or to your project directory (per-repo). * The Git integration writes to your repo's `.git/hooks/`, `.husky/`, or `.pre-commit-config.yaml`, or to `~/.sonar/sonarqube-cli/hooks/` for `--global`. ## Auditing a developer machine To inspect what the CLI has set up: ```bash # What's been installed and where: cat ~/.sonar/sonarqube-cli/state.json | jq '.integrations.installed' # Active SonarQube connection: sonar auth status ``` For a clean removal, see [Uninstalling](/sonarqube-cli/administration/uninstall.md). ## Related pages * [Updating the CLI](/sonarqube-cli/administration/self-update.md) * [Telemetry and privacy](/sonarqube-cli/administration/telemetry-and-privacy.md) * [Uninstalling](/sonarqube-cli/administration/uninstall.md) * [Environment variables](/sonarqube-cli/using-sonarqube-cli/environment-variables.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.sonarsource.com/sonarqube-cli/administration/state-and-storage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.