Google Antigravity

Install secrets-detection hooks, the SonarQube MCP server, and Sonar Vortex's agentic analysis and context augmentation features for Google Antigravity with the SonarQube CLI.

sonar integrate antigravity configures the SonarQube CLI to work alongside Google Antigravity. In an interactive terminal, the command prompts you to install each component:

• A secrets-detection hook: a PreToolUse handler on view_file that scans files for secrets before Antigravity reads them.
• Prompt-secrets rules that tell the agent to refuse working with exposed tokens: a workspace rule in .agents/rules/sonar-prompt-secrets.md for project installs, or a managed snippet in ~/.gemini/GEMINI.md for global installs.
• The SonarQube MCP server in your user-level Antigravity MCP configuration so Antigravity can fetch projects, issues, and rules directly.
• Sonar Vortex agentic analysis rules (SonarQube Cloud only, project-level installs only, when your organization is entitled): an always-on rule in .agents/rules/sonar-agentic-analysis.md that tells Antigravity to run sonar analyze agentic on files you modified before ending the turn.
• A Sonar Vortex context augmentation skill (SonarQube Cloud only, project-level installs only, when your organization is entitled on an eligible SonarQube Cloud plan) so Antigravity can retrieve project guidelines, architecture, semantic navigation, and dependency context through the CLI integration.

Pass --non-interactive to accept every offered component without prompts (see Non-interactive install).

Prerequisites

• The SonarQube CLI is installed and authenticated.
• Google Antigravity is installed.
• You're working inside a project directory (or you're installing globally with --global).

Install

Run inside the project you want to integrate, with the project key:

sonar integrate antigravity --project <YourProjectKey>

Or install once for your whole machine:

sonar integrate antigravity --global

Note: In an interactive terminal, if you omit both --global and --project, the CLI asks whether to install for this project or globally before continuing. See Project versus global scope.

Warning: --project and --global are mutually exclusive. Passing both causes the command to fail with an "invalid options" error (exit code 2).

Note: Agentic analysis is project-scoped. It's skipped when you run sonar integrate antigravity --global; rerun the command without --global from a project directory to install agentic analysis rules for that project.

Note: Context augmentation is project-scoped. It's skipped when you run sonar integrate antigravity --global; rerun the command without --global from a project directory to install the context augmentation skill there.

To configure Antigravity without context augmentation, pass --skip-context:

sonar integrate antigravity --project <YourProjectKey> --skip-context

What the command does

The integrator runs in three phases:

1. Discovery and validation. It locates your project's config (sonar-project.properties, .sonarlint/connectedMode.json, the git origin remote when the repository is bound on SonarQube, or the explicit --project flag) and verifies the token.
2. Health check and repair. It calls SonarQube to confirm the token, organization, and project are valid. If the token is broken and you're running interactively, it offers to refresh it.
3. Installation. For each component (secrets hook, prompt-secrets rules, MCP server, agentic analysis rules, and context augmentation when eligible), the CLI either prompts you to install it, skips it with an explanation, or accepts it automatically in non-interactive mode. Before writing files, it shows a What will be installed summary of accepted features. In interactive mode, press Enter to confirm. Then it installs accepted components into either the project directory or your home directory, depending on --global.

   Common skip reasons include:

   • A global secrets hook is already configured (the project-level hook is skipped to avoid duplicate scans).
   • Agentic analysis isn't available on your connection (SonarQube Server), your organization isn't entitled, or you used --global (it's project-scoped).
   • Context augmentation isn't available for your organization (requires an eligible SonarQube Cloud plan), you passed --skip-context, or you used --global.

   If global Antigravity prompt-secrets rules already exist and you run a project install, the CLI asks whether you also want a project-local copy of the prompt-secrets workspace rule.

Options

Option	Description
--project, -p	SonarQube project key. Mutually exclusive with --global.
--global, -g	Install hooks and config globally under ~/.gemini/config/ instead of the project directory.
--non-interactive	Non-interactive mode (no prompts).
--skip-context	Skip the context augmentation skill install.

Where files are installed

Antigravity uses project-scoped files under .agents/ and user-level files under ~/.gemini/config/. The MCP server entry is always written to the user-level MCP configuration file, because Antigravity supports only one MCP config location.

Scope	Hook & config location
--global	~/.gemini/config/ (hooks, MCP config, skills); prompt-secrets snippet in ~/.gemini/GEMINI.md
Project (default)	.agents/ in the repository (hooks, rules, skills); MCP config in ~/.gemini/config/mcp_config.json
Shared binaries	~/.sonar/sonarqube-cli/bin/

State for installed integrations is recorded in ~/.sonar/sonarqube-cli/state.json. See State and storage.

Restart Antigravity

Antigravity reads hooks, rules, and MCP configuration at startup. Restart Antigravity for the integration to take effect.

Sonar Vortex: agentic analysis and context augmentation features

When you run sonar integrate antigravity against a SonarQube Cloud project, the command writes an always-on rule in .agents/rules/sonar-agentic-analysis.md that tells Antigravity to run sonar analyze agentic --project <key> --depth DEEP on every file it modified that turn in a single command (repeat --file for each path, or fall back to the git change set). Antigravity's hook model doesn't support injecting analysis findings back into the conversation the way Claude Code and Codex hooks do, so the CLI uses the same rules-based pattern as GitHub Copilot CLI and Cursor.

For overviews of these features, see Sonar Vortex agentic analysis and Sonar Vortex context augmentation.

Verify it works

Test the secrets hook

1. Create a file in your project with a fake-looking but secret-shaped value:

   // secrets.js
   const API_KEY = "sqp_1aa323ae0689cd4a1abd062a2ad0a224ae8a1d13";

2. Ask Antigravity to read it: "Read secrets.js."
3. Antigravity should block the read and explain that the file contains a secret.

Once you've confirmed the hook is active, delete the test file.

You can also run sonar system status to confirm the Antigravity integration reports Secrets Hook: CONFIGURED. If the hook entry exists but the backing script is missing or malformed, status shows CONFIGURED / INVALID CONFIG and recommends re-running sonar integrate antigravity. See Check system status.

Test the MCP server

Ask Antigravity to list your SonarQube projects via the MCP server. If the call fails, run sonar auth status to confirm the underlying token is healthy and restart Antigravity.

Test agentic analysis (SonarQube Cloud only)

Make a code change through Antigravity (for example, ask it to edit a file). Before ending the turn, Antigravity should run agentic analysis on the modified files per the installed rules. This requires SonarQube Cloud and the agentic analysis entitlement on your organization.

Non-interactive install

For provisioning scripts, dotfiles, and onboarding automation:

sonar integrate antigravity --global --non-interactive

In non-interactive mode, the CLI doesn't prompt for scope selection, feature selection, install confirmation, token repair, or feature removal. Scope defaults to project when you omit --global, and it installs every component that isn't explicitly skipped. When you authenticate with environment variables, integrate commands also run in non-interactive mode even without the flag. Run sonar auth status afterward to confirm everything is configured correctly.

Uninstall

Run sonar integrate antigravity again in an interactive terminal. For each installed feature, the CLI asks Keep? — answer No, confirm Proceed with removal?, and the CLI removes hooks, rules, and state for that feature. See integrations/README.md for the full flow.

For a manual cleanup or non-interactive environments:

1. Delete the SonarQube hook files and rules written under your Antigravity configuration directories.
2. Remove the SonarQube MCP server entry from your Antigravity configuration.
3. Remove the integration entry from ~/.sonar/sonarqube-cli/state.json (under integrations.installed).

See Uninstalling for the full removal procedure.

Migrate from Gemini CLI

Antigravity replaces Gemini CLI. If you previously used the SonarQube Gemini extension, migrate your platform configuration first, then run:

agy plugin import gemini       # converts legacy extensions and MCP config to native Antigravity format
sonar integrate antigravity    # adds hooks, rules, and CAG (new vs. Gemini)

agy plugin import gemini scans your existing Gemini directories and migrates the SonarQube MCP entry into mcp_config.json. After verifying Antigravity works, remove any duplicate legacy extension install if the import created a copy.

For a fresh install on a machine that never had Gemini, use the steps in Install above.

Related pages

• Overview

• Analyzing local changes

• Commands reference