Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Developer

State and storage

Where the SonarQube CLI stores its state, credentials, binaries, and logs, plus how to audit them on a developer machine.

Use this page to audit exactly what the SonarQube CLI writes to disk, where it lives, and how credentials are stored.

On-disk layout

CLI-specific data lives under ~/.sonar/sonarqube-cli/. The stable anonymous telemetry user ID is stored one level up, at ~/.sonar/user, so it can be shared across Sonar products on the same machine. Override the shared root with SONAR_USER_HOME.

Path
Contents

~/.sonar/user

Stable anonymous telemetry user ID (shared across Sonar products). Contains a UUID only.

~/.sonar/sonarqube-cli/state.json

CLI state (active connection ID, telemetry preferences, local stats preference, installed integrations, installed binary metadata).

~/.sonar/sonarqube-cli/telemetry/telemetry-events.ndjson

Buffered telemetry events waiting to be flushed to SonarSource.

~/.sonar/sonarqube-cli/db/stats/

Local stats database (stats.db). Stays on your machine and is never transmitted. Removed by sonar system reset.

~/.sonar/sonarqube-cli/bin/

Auxiliary binaries downloaded on demand (the secrets detection engine and SCA scanner).

~/.sonar/sonarqube-cli/hooks/

Git hook scripts installed by sonar integrate git.

~/.sonar/sonarqube-cli/logs/

CLI log files.

~/.sonar/sonarqube-cli/cli-tmp/

Temporary files generated by the CLI (for example, PKCS#12 keystores converted for the MCP server). Removed when the MCP process exits or when you run sonar system reset.

If you upgraded from an earlier CLI version that stored the user ID at ~/.sonar/sonarqube-cli/user, the CLI migrates it to ~/.sonar/user on first use and removes the legacy file.

The sonar binary itself is installed separately by the install script:

Operating system

sonar binary location

macOS / Linux

~/.local/share/sonarqube-cli/bin/sonar

Windows

%LOCALAPPDATA%\sonarqube-cli\bin\sonar.exe

What state.json contains

The state file contains these top-level keys:

Key
Purpose

version

The state schema version.

lastUpdated

ISO timestamp of the last state mutation.

auth

Connection metadata (server URL, organization, active connection ID, token name). Token values themselves are not stored here; they live in the OS keychain.

config

CLI version, throttled update-check metadata (config.updateCheck), Beta command warning state (config.betaCommandWarnings), and other configuration hints.

telemetry

Telemetry enabled flag and installation ID. Pending events are stored in telemetry/telemetry-events.ndjson, not in this file.

stats

Local stats collection preference (enabled). Absent until you run sonar config stats --enabled or --disabled. When the key is absent, collection stays enabled. Never transmitted.

dependencies

Versions and paths of installed auxiliary binaries (secrets engine, SCA scanner, and Sonar Vortex context engine).

tools

Legacy registry superseded by dependencies. Entries are folded into dependencies.installed on load.

integrations

Registry of installed agent/Git integrations and where each feature was installed.

agents

Legacy registry kept for backward compatibility with earlier CLI versions.

agentExtensions

Legacy registry kept for backward compatibility with earlier CLI versions.

cat or jq this file at any time; it contains no secrets.

When automatic update notices are enabled, config.updateCheck stores the ISO timestamp of the last remote version check (lastCheckedAt) and the latest stable version returned (latestVersion). The CLI reuses this cache for up to 24 hours, which means routine commands do not trigger repeated network requests.

Where tokens are stored

The CLI stores tokens in your operating system's secure credential store, not in plain files:

OS
Store

macOS

Keychain Access.

Windows

Windows Credential Manager.

Linux

Secret Service (GNOME Keyring / KWallet).

  • Service name: sonarqube-cli

  • Account name: <YourSonarQubeURL> for SonarQube Server, or <YourSonarQubeURL>:<YourOrganizationKey> for SonarQube Cloud (one entry per connection).

To audit which tokens the CLI has saved, open your OS keychain and search for sonarqube-cli. To remove an active keychain-based connection, run sonar auth logout. Repeat after switching connections if you have saved multiple entries.

When you authenticate with environment variables, the token stays in your environment and the CLI records connection metadata in state.json without writing a keychain entry. sonar auth logout does not unset those variables. If no keychain token exists, it reports that you are already logged out. If a previous sonar auth login left a keychain token, logout still removes that token.

Warning: WSL has no keychain. Under Windows Subsystem for Linux, no Secret Service is available by default. The interactive sonar auth login flow does not work as a result. Use Environment variables for authentication in WSL.

What the CLI writes when you run a command

  • state.json is updated on most commands: connection changes, integration installs, telemetry preference changes, and local stats preference changes.

  • telemetry/telemetry-events.ndjson receives buffered telemetry events until they're flushed.

  • Analyzer runs write a local stats database under db/stats/ when collection is enabled (the default). The database stays on your machine and is never transmitted.

  • ~/.sonar/sonarqube-cli/logs/ may receive log output for debugging.

  • The CLI writes the auxiliary scanner binaries in ~/.sonar/sonarqube-cli/bin/ when first needed and reuses them afterwards. They're versioned and refreshed when you run sonar update on a standalone build.

  • Integration commands (sonar integrate antigravity / claude / codex / copilot / cursor / git) also write outside ~/.sonar/:

    • AI agent integrations write to ~/.gemini/, ~/.claude/, ~/.codex/, ~/.copilot/, or ~/.cursor/.

    • The Git integration writes to ~/.sonar/sonarqube-cli/hooks/ and sets git config --global core.hooksPath. sonar integrate git --local writes into the current repository (.git/hooks/, .husky/, or .pre-commit-config.yaml) instead. If an earlier CLI version installed per-repo hooks, leftover files may remain in those same locations. They are not migrated when you upgrade; see Migrate project-scoped agent integrations.

  • sonar link writes .sonar-config.json at the git repository root (or the current directory if you are not in a git repository). This file is not stored under ~/.sonar/. Commit it so teammates share the same project binding.

Repository project binding

.sonar-config.json names one SonarQube project for the repository. The CLI reads it first during project key auto-detection. Run sonar link to create or overwrite it.

On SonarQube Cloud, the project entry stores projectKey, a relative path, region (eu or us), and organization. On SonarQube Server, it stores projectKey, path, and serverUrl instead of region and organization.

Auditing a developer machine

To inspect what the CLI has set up:

For a clean removal, see Uninstalling.

Related pages

PreviousOverview
NextTelemetry and privacy

Last updated

Was this helpful?