> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-cli/integrations/devin.md).

# Devin

Secrets-detection hooks, the SonarQube MCP Server, and Sonar Vortex analysis and Vortex context for Devin, installed with the SonarQube CLI.

`sonar integrate devin` configures the SonarQube CLI to work alongside [Devin](https://devin.ai/). In an interactive terminal, the command shows these recommended components, then asks you to install them or customize the selection (see [Install confirmation](/sonarqube-cli/integrations/integrations.md#install-confirmation)):

* **Secrets-detection hooks**: a `PreToolUse` hook on the `read` tool that blocks a file read when the file contains a secret, and a `UserPromptSubmit` hook that blocks a prompt that contains a secret.
* **Secrets-on-read instructions** in `AGENTS.md` that tell Devin to scan a file for secrets before reading it.
* **The** [**SonarQube MCP Server**](https://docs.sonarsource.com/sonarqube-mcp-server/), which lets Devin fetch projects, issues, and rules directly.
* Vortex (when your connection has a Vortex subscription: SonarQube Cloud Team (annual) or Enterprise plan, or SonarQube Server 2026.5 or newer Enterprise and Data Center editions): installs Vortex analysis and Vortex context together. It adds:
  * A [Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md) `PostToolUse` hook on `edit` and `write` that runs fast `STANDARD` analysis after each edit. The edit is not blocked.
  * End-of-turn Vortex analysis instructions in `AGENTS.md` that tell Devin to run `DEEP` analysis on every file it modified in one command (repeat `--file` for each path, or use the git change set)
  * A `SessionStart` hook that injects [Vortex context](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-context.md) when a session starts
  * A `PreToolUse` hook on `run_subagent` that prepends the Vortex context announcement to the subagent task. The subagent is not blocked.

Choose Devin from the bare `sonar integrate` menu, or run `sonar integrate devin` directly. When Claude Code and Devin are both detected, that menu includes them in one note that names every detected agent in a conflicting pair and states that they may conflict at the hook level.

Pass `--non-interactive` to accept every offered component without prompts (see [Non-interactive install](#non-interactive-install)).

## Prerequisites

* [The SonarQube CLI is installed and authenticated](/sonarqube-cli/quickstart-guide.md).
* [Devin](https://devin.ai/) is installed.
* `sonar` is on the `PATH` that Devin uses.

## Install

Install once for this machine:

```bash
sonar integrate devin
```

The command writes hooks and config under `~/.config/devin/` on macOS and Linux, or `%APPDATA%\devin` on Windows. It applies to every Devin session on this machine. See [Project versus global scope](/sonarqube-cli/integrations/integrations.md#project-versus-global-scope).

### What the command does

The integrator runs in two phases:

1. Validation. It checks that your saved token can reach SonarQube. On SonarQube Cloud, your connection must include an organization. An invalid token stops setup and tells you to run `sonar auth login`. An unreachable server stops setup and asks you to check the server URL and your network connection.
2. Installation. The CLI shows a [What will be installed](/sonarqube-cli/integrations/integrations.md#install-confirmation) summary of the recommended components (secrets hooks, secrets-on-read instructions, MCP server, and Vortex when eligible). In an interactive terminal, choose **Install recommended** to write that set, or **Customize** to accept or decline each component and then press Enter. Components that are not available are skipped with an explanation. In non-interactive mode, every eligible component is installed without prompts. The CLI then writes the accepted components into the Devin config directory.

   A common skip reason is that your connection does not have a Vortex subscription (only available with SonarQube Cloud Team (annual) or Enterprise plan, or SonarQube Server 2026.5 or newer Enterprise and Data Center editions).

### Secrets hooks

| Devin hook                 | What it does                                                    |
| -------------------------- | --------------------------------------------------------------- |
| `PreToolUse` (`read` only) | Scans the file before Devin reads it. A secret blocks the read. |
| `UserPromptSubmit`         | Scans the prompt before it is sent. A secret blocks the prompt. |

Both hooks fail closed when you are not authenticated or the secrets analyzer is missing. The hook blocks the read or the prompt and tells you to run `sonar auth login` or re-run `sonar integrate devin`. A scan error during an otherwise healthy run does not block the operation.

A tool other than `read` is not scanned by the file hook. A prompt with no secrets is left unchanged.

The secrets-on-read instructions are a managed snippet in `AGENTS.md`. They tell Devin to run `sonar analyze secrets` on a file before reading it, and to stop when that command reports a secret. The CLI leaves the rest of `AGENTS.md` in place.

### Vortex analysis and Vortex context

When you accept Vortex, `sonar integrate devin` installs these touchpoints in the Devin config directory:

* A `PostToolUse` hook on `edit` and `write` runs fast `STANDARD` analysis (see the `--depth` option of [`sonar analyze agentic`](/sonarqube-cli/using-sonarqube-cli/commands.md#sonar-analyze-agentic)) after each edit and returns findings to Devin. The hook never blocks the edit. A missing project or a scan error stays silent. On HTTP 403, Devin can show the same unavailable notice as the other Vortex analysis hooks. See [integrations/README.md](/sonarqube-cli/integrations/integrations.md#when-vortex-is-no-longer-available).
* A managed snippet in `AGENTS.md` requires an end-of-turn `DEEP` run: one `sonar analyze agentic --depth DEEP` command covering every file Devin modified that turn. The instructions omit `--project` and `--branch` because the CLI auto-detects the current git branch and analyzes each file against the project that owns it. In a repository with several projects, they tell Devin to run that command from a directory that contains every file changed in the turn, usually the repository root. Re-run `sonar integrate devin` so an existing snippet picks up that paragraph. The edit hook analyzes the edited file against the project that owns it, and stays silent when no project of the active connection owns the file. If analysis reports that no project is configured, the instructions tell the agent to stay silent for the rest of the session instead of repeating a skip notice. See [Files and the project root](/sonarqube-cli/analysis/analyzing-local-changes.md#files-and-the-project-root).
* A `SessionStart` hook injects Vortex context when a session starts, letting Devin use project guidelines, architecture, semantic navigation, and dependency context. When context cannot load, Devin asks the agent to tell you once per session. See [When Vortex context does not load](/sonarqube-cli/integrations/integrations.md#when-vortex-context-does-not-load).
* A `PreToolUse` hook on `run_subagent` prepends that same announcement to the subagent task. The subagent is not blocked. That hook stays quiet when context cannot load. A read-only subagent profile, such as `subagent_explore`, receives the announcement but cannot run `sonar context`.

The CLI installs the Vortex context binary under `~/.sonar/sonarqube-cli/bin/`. After that, `sonar context` forwards to the binary. Hook entries are written into `config.json` and your other hooks and settings stay in place.

For overviews of these features, see [Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md) and [Vortex context](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-context.md).

### MCP server

The command adds a `sonarqube` entry under `mcpServers` in `mcp_config.json`:

```json
{
  "mcpServers": {
    "sonarqube": {
      "command": "sonar",
      "args": ["run", "mcp"]
    }
  }
}
```

Devin starts that local command. The file does not include a project key. `sonar run mcp` resolves the project when it runs. Other MCP servers in the file are kept. Removing the feature removes only the `sonarqube` entry.

When [`SONAR_USER_HOME`](/sonarqube-cli/using-sonarqube-cli/environment-variables.md#cli-home-directory) is set before you run the command, the entry also includes an `env` object with that path.

### Options

| Option              | Description                                                                                                                        |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `--non-interactive` | Non-interactive mode (no prompts).                                                                                                 |
| `--global`, `-g`    | Deprecated since 1.9.0. The install is already global; using the flag prints a warning and does not change the installation scope. |

### Where files are installed

| Location        | What is written                                                                                                                                          |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| macOS and Linux | `~/.config/devin/config.json` (hooks), `~/.config/devin/mcp_config.json` (MCP server), and `~/.config/devin/AGENTS.md` (secrets and Vortex instructions) |
| Windows         | The same file names under `%APPDATA%\devin`                                                                                                              |
| Shared binaries | `~/.sonar/sonarqube-cli/bin/` (the secrets analyzer, and the Vortex context binary when Vortex is installed)                                             |

State for the integration is recorded in `~/.sonar/sonarqube-cli/state.json`. See [State and storage](/sonarqube-cli/administration/state-and-storage.md).

## Restart Devin

Devin loads hooks and MCP configuration when it starts. Restart Devin after you install or remove them.

## Verify it works

### Test a file read

1. Create a file in your project with a fake-looking but secret-shaped value:

   ```javascript
   // secrets.js
   const API_KEY = "sqp_1aa323ae0689cd4a1abd062a2ad0a224ae8a1d13";
   ```
2. Ask Devin to read it: *"Read secrets.js."*
3. Devin should block the read and explain that the file contains a secret.

After you've confirmed the hook is active, delete the test file.

### Test a prompt

Send Devin a message that includes the same kind of fake token. Devin should block the prompt and explain that it contains a secret.

### Test the MCP server

Ask Devin to list your SonarQube projects through the MCP server. If the call fails, run `sonar auth status` to confirm the token is healthy and restart Devin.

`sonar system status` lists the Devin integration and reports MCP server status for `mcp_config.json`. When the MCP entry is invalid, status recommends `sonar integrate devin`. See [Check system status](/sonarqube-cli/administration/system-status.md).

### Test Vortex analysis

Make a code change through Devin (for example, ask it to edit a file). After the edit, Devin should receive the analysis. Before ending the turn, it should run `DEEP` analysis on the modified files. This requires a [Sonar Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md) subscription.

### Test Vortex context

After you accept Vortex, start a Devin session in a linked project. Devin should receive Vortex context at session start. When Devin starts a subagent, the subagent task should include that announcement. This requires a [Sonar Vortex context](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-context.md) subscription.

## Non-interactive install

For provisioning scripts, dotfiles, and onboarding automation:

```bash
sonar integrate devin --non-interactive
```

In non-interactive mode, the CLI does not prompt for feature selection, install confirmation, token repair, or feature removal. When you authenticate with [environment variables](/sonarqube-cli/using-sonarqube-cli/environment-variables.md), integrate commands also run in non-interactive mode even without the flag. Every component that is not explicitly skipped is installed automatically, including Vortex when your connection has a Vortex subscription. Run [`sonar auth status`](/sonarqube-cli/using-sonarqube-cli/commands.md#sonar-auth-status) afterward to confirm everything is configured correctly.

## Uninstall

Run `sonar integrate devin` again in an interactive terminal and choose **Customize**. For each installed feature, the CLI asks **Keep?**: answer No, confirm **Proceed with removal?**, and the CLI removes that feature and its state. Vortex is removed as one unit (the analysis hook, the end-of-turn instructions, the session-start hook, and the subagent announcement). See [integrations/README.md](/sonarqube-cli/integrations/integrations.md#removing-installed-features) for the full flow.

For a manual cleanup or non-interactive environments:

1. Remove the SonarQube hook entries from `config.json` in the Devin config directory (`~/.config/devin` on macOS and Linux, or `%APPDATA%\devin` on Windows). Leave your other hooks and settings in place.
2. Remove the managed secrets and Vortex snippets from `AGENTS.md`. Leave any other content in that file.
3. Remove the `sonarqube` entry under `mcpServers` in `mcp_config.json`. Leave other MCP servers in place.
4. Remove the Devin entry from `~/.sonar/sonarqube-cli/state.json` (under `integrations.installed`).

See [Uninstalling](/sonarqube-cli/administration/uninstall.md) for the full removal procedure.

## Related pages <a href="#related-pages" id="related-pages"></a>

* [Secrets detection](/sonarqube-cli/analysis/secrets-detection.md)
* [Analyzing local changes](/sonarqube-cli/analysis/analyzing-local-changes.md)
* [Commands reference](/sonarqube-cli/using-sonarqube-cli/commands.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.sonarsource.com/sonarqube-cli/integrations/devin.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.