Devin Desktop

Set up the SonarQube MCP Server in Devin Desktop and start using Sonar tools with your agent.

Devin Desktop is an agentic IDE from Cognition. Use this MCP server setup when you want Sonar tools available within the Cascade AI agent in Devin Desktop.

Devin Desktop lists the SonarQube MCP Server as a security-focused extension.

If you prefer using the SonarQube-hosted MCP server instead, see below.

Use the configuration generator

Use the official SonarQube MCP Server configuration generator to get a configuration code snippet for your setup:

Identify the target MCP Client.
Find your #common-variables.
Choose a hosting method.
Enter the information into the configuration generator.
Paste the generated configuration into your configuration file.

Manual setup

Environment variables

The following common variables are required. SONARQUBE_TOKEN applies to stdio transport only. For HTTP, HTTPS, or the embedded SonarQube Cloud MCP server, use the Authorization: Bearer <YourSonarQubeUserToken> header instead.

SONARQUBE_TOKEN: Your SonarQube user token (stdio transport).
SONARQUBE_ORG: Your SonarQube Cloud organization key. Required for SonarQube Cloud only.
SONARQUBE_URL: Your SonarQube Server or Community Build URL. Also required for SonarQube Cloud in the US region (https://sonarqube.us). Not needed for SonarQube Cloud in the EU region.

Important: Your SonarQube token is a sensitive credential. Use environment variables to pass tokens rather than hardcoding them in configuration files. Never commit tokens to version control.

Transport options

The SonarQube MCP Server supports three transport modes. Use Stdio for local development and most use cases, HTTPS for production and team deployments, and HTTP only on trusted internal networks.

Stdio (recommended)

Use Stdio for local development or when you're the only user. It's also the transport mode used in your Sonar Vortex analysis and Sonar Vortex context workflows.

Automatic MCP configuration

When you're using an AI-enabled IDE such as Cursor, Devin Desktop, or VS Code with Copilot enabled, and have already completed your connected mode setup in SonarQube for IDE with SonarQube Server or SonarQube Cloud, a quick select button is available.

Select the icon, Configure MCP Server from the CONNECTED MODE view window to use your connected mode credentials to start using the SonarQube MCP Server. The same workflow is available in the AI AGENTS CONFIGURATION view.

If you've connected to a SonarQube Cloud organization in the US region, the configuration details will be shared.

Watch the Windsurf (currently known as Devin Desktop) and SonarQube MCP Server integration demo on YouTube.

Watch on YouTube

Note: Devin Desktop subscribers on Team and Enterprise plans should add the SonarQube MCP Server to the list of allowed servers. See the Devin Desktop documentation about Admin Controls.

Manual configuration

The SonarQube MCP Server is available in the MCP Marketplace for the Cascade MCP client. Follow these instructions:

Open Devin Settings > Cascade > MCP Servers.
Search for sonarqube on the MCP Marketplace.
Choose the SonarQube MCP Server and select Install.
Add the required SonarQube user token. Then add an organization key if you want to connect with SonarQube Cloud, or the SonarQube URL if you want to connect to SonarQube Server or SonarQube Community Build. For SonarQube Cloud in the US region, also set the URL to https://sonarqube.us.

Warning: User tokens are required when setting up connected mode or your SonarQube MCP server with SonarQube (Server, Cloud). Your binding won't function properly if you use project tokens, global tokens, or scoped organization tokens during setup.

Note: SONARQUBE_URL should be defined as https://sonarqube.us each time you use a SonarQube Cloud configuration (SONARQUBE_TOKEN + SONARQUBE_ORG) and want to connect to a US-region instance. See the Connecting to SonarQube Cloud in the US region section for details.

Tip: To verify the connection, ask your AI agent to call the SonarQube MCP ping_system tool. For example: "Ping the SonarQube MCP server."

Note: Restart Devin Desktop for the new MCP server configuration to take effect.

HTTPS

Use HTTPS when connecting Devin Desktop to a shared MCP server deployed for a team. This requires an HTTPS transport server to be running and accessible.

Add the following to your Devin Desktop MCP configuration file:

{
  "mcpServers": {
    "sonarqube": {
      "type": "https",
      "url": "https://<YourSonarQubeMCPServer>:8443/mcp",
      "headers": {
        "Authorization": "Bearer <YourSonarQubeUserToken>"
      }
    }
  }
}

Tip: To verify the connection, ask your AI agent to call the SonarQube MCP ping_system tool. For example: "Ping the SonarQube MCP server."

Note: Restart Devin Desktop for the new MCP server configuration to take effect.

HTTP

Important: The HTTP transport mode is not recommended. Use Stdio for local development or HTTPS for multi-user production deployments.

Use HTTP only on a trusted internal network or for local testing. This requires an HTTP transport server to be running.

Add the following to your Devin Desktop MCP configuration file:

{
  "mcpServers": {
    "sonarqube": {
      "type": "http",
      "url": "http://<YourSonarQubeMCPServer>:8080/mcp",
      "headers": {
        "Authorization": "Bearer <YourSonarQubeUserToken>"
      }
    }
  }
}

Tip: To verify the connection, ask your AI agent to call the SonarQube MCP ping_system tool. For example: "Ping the SonarQube MCP server."

Note: Restart Devin Desktop for the new MCP server configuration to take effect.

Sonar Vortex: agentic analysis and context augmentation features

To set up agentic analysis and context augmentation, the recommended methods are the SonarQube plugin or SonarQube CLI. See Sonar Vortex analysis and Sonar Vortex context.

When using these features, your SONARQUBE_TOKEN lets your local MCP server configured for Stdio mode authenticate to the SonarQube Cloud API. See Sonar Vortex analysis and Sonar Vortex context for more information.

SonarQube-hosted MCP server

To avoid running and maintaining your own MCP infrastructure while always using the current server version, connect to a SonarQube-hosted MCP server:

SonarQube Cloud-hosted: the MCP server embedded in SonarQube Cloud. It exposes a smaller, fixed subset of tools. See the SonarQube Cloud-hosted page.
SonarQube Server-hosted: the MCP server installed as an extension on SonarQube Server (Developer, Enterprise, and Data Center editions), available on SonarQube Server 2026.3 and later. See the SonarQube Server-hosted page.

Use Sonar tools from Devin Desktop

Once connected, use the tools provided by the SonarQube MCP Server in Devin Desktop agent mode. See the tools page for the full list of available tools.

See also the Devin Desktop documentation for information on adding explicit context.

PreviousKiro NextZed

Last updated 11 days ago

Was this helpful?