Commands reference

A complete reference for SonarQube CLI commands, with arguments, options, defaults, and examples.

This page documents every SonarQube CLI command. Find the full SonarQube CLI command reference, including options and examples, at sonarsource.com/sonarqube/cli. A machine-readable version of the command reference is also available as JSON at sonarsource.com/sonarqube/cli/data/commands.json.

Each entry includes a description, the arguments and options it accepts (with types, defaults, and whether they are required), and runnable examples.

For longer guides on how to use these commands, see the Overview, Overview, and Overview pages.

Commands at a glance

Group	Commands
Authentication	sonar auth login, logout, status
Integrations	sonar integrate, integrate claude, copilot, codex, cursor, antigravity, git
Analysis	sonar analyze, analyze secrets, analyze agentic, analyze dependency-risks, remediate
Information	sonar list issues, list projects, api, context
Configuration	sonar config telemetry
Maintenance	sonar system status, system reset, self-update (standalone builds only)

Command	Description
sonar auth	Manage authentication tokens and credentials.
sonar api	Make authenticated API requests to SonarQube.
sonar integrate	Set up SonarQube integration for AI coding agents, git, and others.
sonar list	List issues and projects from SonarQube.
sonar context	Augment AI agents with context from your codebase.
sonar remediate	Trigger AI agent remediation for eligible issues (SonarQube Cloud only).
sonar analyze	Run secrets scanning and Sonar Vortex agentic analysis on the local change set (default when no subcommand is given); subcommands cover SCA and targeted scans.
sonar config	Configure CLI settings.
sonar system	System diagnostics and maintenance (status, reset).
sonar self-update	Update SonarQube CLI to the latest version (standalone builds only).

---

sonar auth

Manage authentication tokens and credentials.

sonar auth login

Authenticate via browser and save credentials in the system keychain. Must be run manually; AI agents can't complete this flow. For CI/CD and automation, use environment variables instead.

Options:

Option	Type	Required	Description	Default
--server, -s	string	No	Your SonarQube Server URL, SonarQube Cloud EU (https://sonarcloud.io), or SonarQube Cloud US (https://sonarqube.us). When omitted, the CLI prompts you to choose server and region.	-
--org, -o	string	No	Your SonarQube Cloud organization key. If omitted when authenticating to SonarQube Cloud, the CLI auto-selects your organization when you belong to exactly one, or prompts you to choose when you belong to multiple organizations.	-

Examples:

Interactive login (prompts for server type, region, and organization):

sonar auth login

Interactive login with a pre-selected server (skips the server and region prompts):

# SonarQube Server (self-hosted)
sonar auth login --server <YourSonarQubeServerURL>
# Also works with SonarCloud EU or US region URLs
sonar auth login --server "https://sonarcloud.io"
sonar auth login --server "https://sonarqube.us"

For CI/CD pipelines and headless environments, use environment variables instead of sonar auth login.

---

sonar auth logout

Remove the active connection token from the keychain. The CLI also best-effort revokes the token server-side when it was created via the interactive browser flow.

Examples:

sonar auth logout

---

sonar auth status

Show the active authentication connection and verify the token against the server. When the server cannot be reached, the command prints the underlying network or TLS error (for example, a connection timeout) alongside the remediation hint.

Examples:

sonar auth status

---

sonar integrate

Set up SonarQube integration for AI coding agents, Git, and other tools. For step-by-step setup guides, see Overview.

Running sonar integrate with no subcommand prompts you to select one integration (Claude Code, Copilot, Codex, Cursor, Antigravity, or Git), then runs that integration's interactive setup flow. To configure another tool, run sonar integrate again. You can also call a subcommand directly (for example, sonar integrate claude).

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key. Mutually exclusive with --global.	-
--global, -g	boolean	No	Install the selected integration globally instead of in the project directory.	-

Note: --project and --global are mutually exclusive. Passing both fails with an invalid-options error (exit code 2).

When neither --global nor --project is set, interactive runs prompt for install scope (project vs global) after you select a tool. Non-interactive runs default to project scope. See Project versus global scope.

Examples:

sonar integrate
sonar integrate -p my-project
sonar integrate -g

sonar integrate claude

Installs secrets-detection hooks and the SonarQube MCP server. On SonarQube Cloud, also sets up Sonar Vortex agentic analysis and context augmentation. See Claude Code.

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key. Ignored when --global is used.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--global, -g	boolean	No	Install hooks and config globally to ~/.claude instead of project directory.	-
--skip-context	boolean	No	Skip the Sonar Vortex context augmentation install and skill setup.	-

Examples:

sonar integrate claude -p my-project
sonar integrate claude -g
sonar integrate claude -p my-project --skip-context

---

sonar integrate copilot

Set up the SonarQube integration for GitHub Copilot. Installs secrets-detection hooks and the SonarQube MCP server. On SonarQube Cloud, also sets up Sonar Vortex agentic analysis and context augmentation.

Options:

Option	Type	Required	Description	Default
--global, -g	boolean	No	Install hooks and config globally to ~/.copilot instead of project directory.	-
--project, -p	string	No	Project key. Mutually exclusive with --global.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--skip-context	boolean	No	Skip the Sonar Vortex context augmentation install and skill setup.	-

Examples:

sonar integrate copilot -p my-project
sonar integrate copilot -g
sonar integrate copilot -p my-project --skip-context

---

sonar integrate codex

Set up the SonarQube integration for OpenAI Codex. Installs a UserPromptSubmit secrets hook, secrets-on-read instructions, and MCP configuration. On SonarQube Cloud with an active entitlement, also installs a Sonar Vortex agentic analysis PostToolUse hook and Sonar Vortex context augmentation. See OpenAI Codex.

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key. Mutually exclusive with --global.	-
--global, -g	boolean	No	Install hook and config globally to ~/.codex instead of project directory.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--skip-context	boolean	No	Skip Sonar Vortex context augmentation install and skill setup.	-

Examples:

sonar integrate codex -p my-project
sonar integrate codex -g
sonar integrate codex -p my-project --skip-context

---

sonar integrate cursor

Set up the SonarQube integration for Cursor. Installs beforeSubmitPrompt, beforeReadFile, and preToolUse secrets hooks, and MCP configuration. On SonarQube Cloud with an active entitlement, also installs Sonar Vortex agentic analysis instructions and Sonar Vortex context augmentation. See Cursor.

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key. Mutually exclusive with --global.	-
--global, -g	boolean	No	Install hooks and config globally to ~/.cursor instead of project directory.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--skip-context	boolean	No	Skip Sonar Vortex context augmentation install and skill setup.	-

Examples:

sonar integrate cursor -p my-project
sonar integrate cursor -g
sonar integrate cursor -p my-project --skip-context

---

sonar integrate antigravity

Set up the SonarQube integration for Google Antigravity. Installs a PreToolUse secrets hook, prompt-secrets rules, and MCP configuration. On SonarQube Cloud with an active entitlement, also installs Sonar Vortex agentic analysis rules and Sonar Vortex context augmentation. See Google Antigravity.

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key. Mutually exclusive with --global.	-
--global, -g	boolean	No	Install hooks and config globally under ~/.gemini/config/ instead of the project directory.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--skip-context	boolean	No	Skip Sonar Vortex context augmentation install and skill setup.	-

Examples:

sonar integrate antigravity -p my-project
sonar integrate antigravity -g
sonar integrate antigravity -p my-project --skip-context

---

sonar integrate git

Install a Git pre-commit hook that scans staged files for secrets and dependency risks before each commit, or a Git pre-push hook that scans committed files for secrets before each push. On project-scoped installs, auto-detects the SonarQube project key when you omit -p (see Git hooks). In an interactive terminal, prompts separately for each code scanning hook type.

Options:

Option	Type	Required	Description	Default
--hook	string	No	Hook to install: pre-commit (scan staged files) or pre-push (scan files in unpushed commits).	-
--force	boolean	No	Overwrite an existing hook if it isn't from sonar integrate git.	-
--non-interactive	boolean	No	Non-interactive mode (no prompts).	-
--global	boolean	No	Install hook globally for all repositories (sets git config --global core.hooksPath).	-
--dependency-risks	boolean	No	Also install a pre-commit dependency-risks scan when SCA is available on the connection (requires a project key; not supported with --global).	-
--project, -p	string	No	SonarQube project key (overrides auto-detected project; required with --dependency-risks when no key is detected).	-

Examples:

sonar integrate git
sonar integrate git --hook pre-push
sonar integrate git --global
sonar integrate git --global --non-interactive
sonar integrate git --hook pre-push --global --non-interactive
sonar integrate git --hook pre-commit --dependency-risks -p my-project --non-interactive

---

Analysis

sonar analyze

Run every analysis the CLI supports on your local change set: secrets scanning first, then agentic analysis (SonarQube Cloud only). This is the recommended command before a commit or pull request. See Analyzing local changes.

Options:

Option	Type	Required	Description	Default
--file	string	No	Analyze specific file(s) instead of the git change set (repeatable).	-
--staged	boolean	No	Analyze staged files only (git diff --cached).	-
--base	string	No	Analyze files changed vs a branch or ref (e.g. main).	-
--depth	string	No	Analysis depth (STANDARD, DEEP). Default: STANDARD for one --file; DEEP otherwise.	-
--project, -p	string	No	SonarQube Cloud project key (overrides auto-detected project).	-
--force	boolean	No	Skip the large change-set confirmation prompt.	-
--format	string	No	Output format (text, json).	text

Note: --branch is available on sonar analyze agentic but not on the bare sonar analyze command. Use sonar analyze agentic when you need to set branch context.

Examples:

sonar analyze
sonar analyze --staged
sonar analyze --file src/a.ts --file src/b.ts
sonar analyze --base main --format json
sonar analyze --project my-org_my-app

---

sonar analyze secrets

Scan files or standard input for hardcoded secrets.

Arguments:

Argument	Description
[paths…]	File or directory paths to scan for secrets.

Options:

Option	Type	Required	Description	Default
--stdin	boolean	No	Read from standard input instead of paths.	-

Exit behavior: exits with code 51 when secrets are found, 0 when none are found. See Exit codes.

Examples:

Scan a file:

sonar analyze secrets src/config.ts

Scan a directory:

sonar analyze secrets src/

Scan stdin:

cat .env | sonar analyze secrets --stdin

Custom secret rules from SonarQube Server

When the SonarQube CLI is authenticated, sonar analyze secrets automatically downloads and executes custom secret rules (instances of rule template S6784) defined on the connected SonarQube Server instance. Rules are cached locally and refreshed on each run. If the download fails, the SonarQube CLI falls back to a stale cache with a warning. No CLI flag is required. Custom secret rules are not yet available on SonarQube Cloud; support is planned.

---

sonar analyze agentic

Run server-side Sonar Vortex agentic analysis on local changes (SonarQube Cloud only). Limitations apply; see Agentic analysis on sonarsource.com.

Options:

Option	Type	Required	Description	Default
--file	string	No	Analyze specific file(s) instead of the git change set (repeatable).	-
--staged	boolean	No	Analyze staged files only (git diff --cached).	-
--base	string	No	Analyze files changed vs a branch or ref (e.g. main).	-
--branch	string	No	Branch name for analysis context.	-
--depth	string	No	Analysis depth (STANDARD, DEEP). Default: STANDARD for one --file; DEEP otherwise.	-
--project, -p	string	No	SonarQube Cloud project key (overrides auto-detected project).	-
--force	boolean	No	Skip the large change-set confirmation prompt.	-
--format	string	No	Output format (text, json).	text

Notes:

• The CLI prompts for confirmation when the change set exceeds 50 files. Pass --force to skip the prompt, or use --format json (which suppresses the prompt automatically).
• Agentic analysis sends your change set in a single multi-file request so a DEEP analysis can catch cross-file issues. If the request is too large, the CLI splits the files into smaller batches and sends them automatically (which can reduce cross-file context for that run).

Exit behavior: exits with code 51 when issues are reported. See Exit codes.

Examples:

sonar analyze agentic                       # local change set (DEEP)
sonar analyze agentic --file src/app.ts     # single file (STANDARD)
sonar analyze agentic --file src/a.ts --file src/b.ts  # multi-file (DEEP)
sonar analyze agentic --depth DEEP --file src/app.ts  # force DEEP on one file
sonar analyze agentic --staged              # staged files only
sonar analyze agentic --base main           # changes vs main

---

sonar analyze dependency-risks

Run Software Composition Analysis (SCA) against the project's dependencies and report unresolved dependency risks (vulnerabilities, malware, and prohibited licenses). This command is in beta and subject to change. Requires SonarQube Advanced Security with SCA enabled on the project (SonarQube Cloud). For the full workflow, see Software Composition Analysis (SCA).

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	Project key (auto-detected when omitted).	-
--format	string	No	Output format (table, json, toon); see Output formats.	table
--statuses	string	No	Filter by status. Accepts presets (active → NEW,OPEN,CONFIRM; to_fix → NEW,OPEN,CONFIRM,ACCEPT; all → NEW,OPEN,CONFIRM,ACCEPT,SAFE,FIXED) and raw statuses (NEW, OPEN, CONFIRM, ACCEPT, SAFE, FIXED). Comma-separated; case-insensitive; result is the union of every token.	active
--min-severity	string	No	Minimum severity to include (BLOCKER, HIGH, MEDIUM, LOW, INFO). Risks below the threshold are excluded. Case-insensitive.	all severities

Exit behavior: exits with code 51 when unresolved risks are found, 1 on analysis errors, 0 otherwise. See Exit codes.

Note: First run downloads scanner binaries. SonarQube CLI fetches the sca-scanner-cli and sonar-secrets binaries from binaries.sonarsource.com and caches them under ~/.sonar/sonarqube-cli/bin/. Subsequent runs reuse the cached binaries.

Note: Dependency manifest files (for example, package-lock.json or pom.xml) are uploaded to SonarQube for analysis. Before the SCA scan, manifest files are pre-scanned for hardcoded secrets; if any are found, the command aborts. See sonar analyze dependency-risks --help for the upload notice and Supported languages and package managers in the SonarQube Advanced Security documentation.

Examples:

sonar analyze dependency-risks                                        # auto-detect project, active risks
sonar analyze dependency-risks -p my-project                          # explicit project, table output
sonar analyze dependency-risks -p my-project --format json            # JSON for scripts
sonar analyze dependency-risks -p my-project --format toon            # TOON for AI agents
sonar analyze dependency-risks -p my-project --statuses to_fix        # only what needs fixing
sonar analyze dependency-risks -p my-project --statuses all           # include accepted and safe
sonar analyze dependency-risks -p my-project --min-severity HIGH      # HIGH and BLOCKER only

---

sonar remediate

Trigger AI-agent remediation for eligible issues (SonarQube Cloud only). Eligibility is determined server-side: only issues the Remediation Agent can fix are surfaced.

Options:

Option	Type	Required	Description	Default
--project, -p	string	No	SonarQube Cloud project key (overrides auto-detected project).	-
--issues	string	No	Comma-separated issue keys to remediate non-interactively (max 20). Required when stdin is not a TTY.	-

Examples:

Pick issues interactively:

sonar remediate -p my-project

Non-interactively remediate specific issues (suitable for scripts):

sonar remediate -p my-project --issues issue-key-1,issue-key-2

Exit behavior: exits with code 0 when your organization is not eligible for or has not enabled the Remediation Agent (the CLI prints an informational message instead of failing). Exits with code 1 on other errors. See AI remediation and Exit codes.

---

Information

sonar list issues

Search for issues in a SonarQube project.

Options:

Option	Type	Required	Description	Default
--project, -p	string	Yes	Project key.	-
--statuses	string	No	Filter by status (comma-separated list of: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED).	-
--severities	string	No	Filter by severity. Valid values depend on the connected server's mode—Multi-Quality Rule (MQR) mode: INFO, LOW, MEDIUM, HIGH, BLOCKER; Standard Experience mode: INFO, MINOR, MAJOR, CRITICAL, BLOCKER.	-
--format	string	No	Output format (json, toon, table, csv); see Output formats.	json
--branch	string	No	Branch name.	-
--pull-request	string	No	Pull request ID.	-
--page-size	number	No	Page size (1-500).	500
--page	number	No	Page number.	1

Examples:

List issues in a project:

sonar list issues -p my-project

Output issues in TOON format for AI agents:

sonar list issues -p my-project --format toon

---

sonar list projects

Search for projects the active token can access.

Options:

Option	Type	Required	Description	Default
--query, -q	string	No	Search query to filter projects by name or key.	-
--page	number	No	Page number.	1
--page-size	number	No	Page size (1-500).	500

Output is always JSON. Pipe through jq if you need to transform it.

Examples:

sonar list projects
sonar list projects -q my-project
sonar list projects --page 2 --page-size 50

---

sonar api

Make authenticated requests to any SonarQube Web API endpoint. Useful for advanced workflows that aren't covered by other commands.

Arguments:

Argument	Description
<method>	HTTP method (get, post, patch, put, delete).
<endpoint>	API endpoint path. Must start with / and can contain query parameters.

Options:

Option	Type	Required	Description	Default
--data, -d	string	No	JSON string for the request body. See request body encoding below.	-
--verbose, -v	boolean	No	Print request and response details for debugging.	-

Note: Request body encoding. The CLI picks an encoding based on the endpoint path:

• Endpoints starting with /api/v2/, or endpoints that don't start with /api/, receive a JSON body (Content-Type: application/json).
• All other endpoints (the SonarQube Web API v1, paths under /api/) receive URL-encoded form data (Content-Type: application/x-www-form-urlencoded).

This matches what each Web API endpoint expects. You don't need to override it.

Examples:

List favorite projects:

sonar api get "/api/favorites/search"

Search for rules in an organization:

sonar api get "/api/rules/search?organization=my-org&languages=ts"

Generate a new user token:

sonar api post "/api/user_tokens/generate" --data '{"name":"my-new-token"}'

Accept an issue:

sonar api post "/api/issues/do_transition" --data '{"issue":"AYx1z2","transition":"accept"}'

Debug a request:

sonar api get "/api/system/status" --verbose

Get the current analysis engine JAR info (V2 API):

sonar api get "/analysis/engine"

Revoke a user token:

sonar api post "/api/user_tokens/revoke" --data '{"name":"my-token"}'

---

sonar context

Augment AI agents with context from your codebase. Forwards all arguments to the locally-installed sonar-context-augmentation binary. Install the binary first via sonar integrate claude, sonar integrate copilot, or another sonar integrate command. If Sonar Vortex context augmentation is not installed, the CLI prints an error and points you back to sonar integrate.

Arguments:

Argument	Description
[action]	Action forwarded to sonar-context-augmentation.
[args...]	Additional arguments forwarded to sonar-context-augmentation.

Examples:

sonar context help
sonar context init

---

Configuration

sonar config telemetry

Enable or disable the collection of anonymous usage statistics and crash reports. See Telemetry and privacy for what's collected.

Options:

Option	Type	Required	Description	Default
--enabled	boolean	No	Enable collection of anonymous usage statistics.	-
--disabled	boolean	No	Disable collection of anonymous usage statistics.	-

Examples:

sonar config telemetry --enabled
sonar config telemetry --disabled

---

System

System diagnostics and maintenance commands for the SonarQube CLI installation. See Check system status and Reset the CLI for guides.

sonar system status

Show a diagnostic overview of authentication, resolved network configuration (proxy, custom CA certificate, and client certificate), installed binaries, cache directories, integrations, MCP server health, and Antigravity secrets hook health. Does not require authentication. See Check system status for details.

Options:

Option	Type	Required	Description	Default
--json	boolean	No	Output as JSON for machine consumption.	-

Examples:

sonar system status
sonar system status --json

---

sonar system reset

Reset the CLI to factory defaults: remove saved tokens, downloaded binaries, sonar integrate installs, and CLI caches. Telemetry preferences are preserved. Does not remove the sonar binary. See Reset the CLI for details.

Options:

Option	Type	Required	Description	Default
--force	boolean	No	Skip the interactive confirmation prompt (required for scripts).	-

Examples:

sonar system reset
sonar system reset --force

---

Maintenance

sonar self-update

Update SonarQube CLI to the latest version. Re-uses the install script that put sonar on your system; your saved state and credentials are preserved. See Updating the CLI for details.

Options:

Option	Type	Required	Description	Default
--status	boolean	No	Check for a newer version without installing.	-
--force	boolean	No	Install the latest version even if already up to date.	-

Examples:

sonar self-update
sonar self-update --status
sonar self-update --force

Related pages

• Environment variables

• Output formats

• Exit codes