Output formats

Guidance on choosing a SonarQube CLI output format for humans, scripts, spreadsheets, and AI agents.

SonarQube CLI commands output their results in different formats. Pick the one that matches what's consuming the output.

Available formats

Format	Best for	Notes
json	Scripts, dashboards, downstream tools.	A JSON array or object. Default for sonar list issues and sonar list projects. Pass --format json for sonar list orgs, which defaults to table.
table	Reading in your terminal.	A human-friendly aligned table. Adds no headers or borders that would break copy/paste.
csv	Spreadsheets, BI tools, archives.	Comma-separated values with a header row.
toon	AI coding agents and LLM consumption.	Token-Oriented Object Notation (TOON), a token-efficient, LLM-friendly serialization. Use it when piping data into Claude Code, Copilot, Codex, Cursor, or Antigravity.
text	Reading a status or analysis report.	Native human-readable output. Used by sonar analyze, sonar analyze agentic, sonar auth status, sonar system status, and sonar update status.

Which command supports which format

Command	Supported formats	Default
sonar list issues	json, toon, table, csv	json
sonar list projects	json, table	json
sonar list orgs	json, table	table
sonar quality-gate status	json, table	table
sonar analyze / analyze agentic	text, json	text
sonar analyze dependency-risks	json, toon, table	table
sonar analyze secrets	(no --format; text only)	-
sonar remediate	(no --format; interactive)	-
sonar api	Raw response body	-
sonar auth status	text, json	text
sonar config get	text, json	text
sonar config list	text, table, json	text
sonar system status	text, json	text
sonar update status	text, json	text

sonar system status --json has been deprecated since 1.9. Use --format json.

sonar config get --format json and sonar config list --format json include value only for a non-sensitive key that is set. A sensitive key reports sensitive and set, and omits value. sonar config get prints one object. sonar config list prints an array, and --only-set limits that array to keys that have a value. Text output, and sonar config list --format table, print *** for a sensitive key that is set and (not set) when nothing is stored. A terminal prints those placeholders in gray.

Choosing a format

• When you're reading output in your terminal: use table for sonar list issues, sonar list projects, and sonar list orgs (list projects defaults to json; list orgs defaults to table), or keep the default text for analysis, sonar auth status, sonar config get, sonar config list, sonar system status, and sonar update status. Pass --format table when you want a KEY and VALUE table from sonar config list.

• If you're writing a script: use json. Every SonarQube CLI command that supports it parses cleanly with jq and standard JSON libraries in any language, with no custom parsing logic required. For sonar analyze, JSON combines secrets and agentic results in one object (see Analyzing local changes). For sonar analyze dependency-risks, progress prints to stderr and the payload prints to stdout: jq and other parsers see only the results.

• When you're piping into a spreadsheet or BI tool: use csv.

• When you're piping into an AI agent (Claude Code, Copilot, Codex, Cursor, or Antigravity): use toon. It packs the same information into far fewer tokens than JSON, letting the agent see more of the data inside its context window.

Examples

Human-readable issues list:

sonar list issues -p my-project --format table

Pipe issues into jq:

sonar list issues -p my-project --format json | jq '.issues[] | select(.severity=="BLOCKER")'

Export issues to a spreadsheet:

sonar list issues -p my-project --format csv > issues.csv

Feed issues to an AI agent:

sonar list issues -p my-project --format toon

Feed dependency risks to an AI agent:

sonar analyze dependency-risks -p my-project --format toon

Check quality gate status in your terminal:

sonar quality-gate status -p my-project --format table

Pipe quality gate JSON into jq:

sonar quality-gate status -p my-project --format json | jq '.qualityGate.status'

When a coverage, duplications, issues, security, or dependency-risks condition fails, JSON includes a breakdown on that condition (up to --top, default 500). Each breakdown includes a category (coverage, duplications, issues, security, or dependency-risks). Coverage and duplications list the worst files; issues and security list the worst issues (file, line, key, rule, message). Duplications entries also include blockCount and duplicatesWith when that detail is available. Dependency-risks entries list unresolved risks (package, version, severity, type, key, and vulnerabilityId when present). An auto-detected analyzed branch uses qualityGate.branch the same way an explicit --branch does. Auto-detected pull requests use qualityGate.pullRequest the same way an explicit --pull-request does:

sonar quality-gate status -p my-project --format json | jq '.qualityGate.conditions[] | select(.breakdown != null)'

When you pass a file or directory path, JSON uses qualityGate.file instead of qualityGate.project. qualityGate.status is OK, ERROR, NOT_COMPUTED, or NOT_APPLICABLE (no conditions apply to that path):

sonar quality-gate status src/checkout.ts -p my-project --format json | jq '.qualityGate | {status, file}'

Read a project list in the terminal:

sonar list projects --format table

List the organizations you can access as JSON:

sonar list orgs --format json | jq '.organizations[] | select(.isActive)'

Check authentication as JSON:

sonar auth status --format json

Capture system status as JSON:

sonar system status --format json

Check for a CLI update as JSON:

sonar update status --format json

Read a stored config value as JSON:

sonar config get log.level --format json

List every config key as JSON:

sonar config list --format json

Related pages

• Commands reference

• Exit codes