Tools

This page documents a set of tools for SonarQube MCP Server to use when interacting with SonarQube (Server, Cloud), such as analysis, issues, metrics, projects, quality gates, and more.

Note also the SONARQUBE_TOOLSETS environment variable that accepts a comma-separated list of toolsets to enable. See the Tool enablement article for a list of available toolsets.

Analysis

Tool

Type

analyze_code_snippet: Analyze a file or code snippet with SonarQube analyzers to identify code quality and security issues. Specify the language of the snippet to improve analysis accuracy. Optionally filter results to a specific code snippet. Supported Languages: Java, Kotlin, Python, Ruby, Go, JavaScript, TypeScript, JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, Azure Resource Manager, Ansible, Docker, Secrets detection.

Usage: Pass complete fileContent for full file analysis (reports all issues). Add optional codeSnippet to filter results. Only issues within the snippet will be reported (snippet location auto-detected) Parameters: codeSnippet (string, optional): - Code snippet to filter issues (must match content in fileContent). fileContent (string, required): Complete file content as a string. language (string, optional): Language of the code snippet. For example, 'java', 'python', 'javascript'. projectKey (string, required): The SonarQube project key. scope - (string, optional): Scope of the file: MAIN or TEST. Default: MAIN.

When integration with SonarQube for IDE is enabled

Tool	Type
analyze_file_list: Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files.	file_absolute_paths (array of strings, required): List of absolute file paths to analyze.
toggle_automatic_analysis: Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE will automatically analyze files as they are modified in the working directory. When disabled, automatic analysis is turned off.	enabled (boolean, required): Enable or disable the automatic analysis.

When advanced analysis is enabled

Advance analysis is available for Analysis for Agents with SonarQube Cloud.

Tool

Type

run_advanced_code_analysis: Run advanced code analysis on SonarQube Cloud for a single file. Organization is inferred from the MCP configuration.

projectKey (key, required): The key of your project. branchName (string, required): Branch name used to retrieve the latest analysis context. filePath (string, required): Project-relative path of the file to analyze (example: src/main/java/MyClass.java) fileContent (string, required): The original content of the file to analyze fileScope (string, optional): Defines in which scope the file originates from: MAIN or TEST. Default: MAIN

Dependency risks

Dependency risks are only available when connecting to SonarQube Server 2025.4 Enterprise edition or higher with SonarQube Advanced Security enabled.

Tool	Type
search_dependency_risks: Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio.	projectKey (string): Project key. branchKey (string): Branch key. pullRequestKey (string, optional): Pull request key.

Duplications

Tool	Type
search_duplicated_files: Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications.	projectKey (string, required): Project key. pullRequest (string, optional): Optional pull request id. pageSize (integer, optional): Optional number of results per page for manual pagination. Max: 500. If not specified, auto-fetches all duplicated files. pageIndex (integer, optional): Optional page number for manual pagination. Starts at 1. If not specified, auto-fetches all duplicated files.
get_duplications: Get duplications for a file. Require Browse permission on file's project.	key (string, required): pullRequest (string, optional): Optional pull request id.

Enterprises

Enterprise tools are only available when connecting to a SonarQube Cloud Enterprise edition.

Tool	Type
list_enterprises: List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools.	enterpriseKey (string, optional): Enterprise key to filter results.

Issues

Tool	Type
change_sonar_issue_status: Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue.	key (string, required): Issue key status (enum, required): New issue's status. Required Enum {"accept", "falsepositive", "reopen"}
search_sonar_issues_in_projects: Search for SonarQube issues in my organization's projects.	issueStatuses (array of strings, optional): List of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE_POSITIVE, ACCEPTED, FIXED, IN_SANDBOX. issueKey (string, optional): Issue key used to fetch a specific issue. impactSoftwareQualities (array of strings, optional): List of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY. p (integer, optional): Page number. Default: 1. projects (array of strings, optional): Optional list of Sonar projects. ps (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100. pullRequestId (string, optional): Pull Request's identifier. severities (array of strings, optional): List of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER.

Languages

Tool	Type
list_languages: List all programming languages supported in this SonarQube instance.	q: Pattern to match language keys/names against.

Measures

Tool	Type
get_component_measures: Get SonarQube measures for a component (project, directory, file).	component (string, optional): Component key to get measures. metricKeys (array of strings, optional): Metric keys to retrieve (for example: ncloc, complexity, violations, coverage). pullRequest (string, optional): Optional pull request identifier to analyze for measures - String

Metrics

Tool	Type
search_metrics: Search for SonarQube metrics.	p (integer, optional): Page number. Default: 1. ps (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100.

Portfolios

Tool

Type

list_portfolios: List enterprise portfolios available in SonarQube with filtering and pagination options.

For SonarQube Server: q (string, optional): Search query to filter portfolios by name or key. favorite (boolean): If true, returns favorite portfolios. pageIndex (integer, optional): Optional 1-based page number. Default: 1. pageSize (integer, optional): Optional page size, max 500. Default: 100. For SonarQube Cloud: enterpriseId (string): Enterprise uuid. Can be omitted only if the favorite parameter is supplied with value true. q (string, optional): Search query to filter portfolios by name. favorite (boolean, required): Required to be true if the enterpriseId parameter is omitted. If true, returns portfolios favorited by the logged-in user. Cannot be true when draft is true. draft (boolean): If true, returns drafts created by the logged-in user. Cannot be true when favorite is true. pageIndex (integer, optional): Index of the page to fetch. Default: 1, pageSize (integer, optional): Size of the page to fetch. Default: 50.

Projects

Tool	Type
search_my_sonarqube_projects: Find SonarQube projects. The response is paginated.	page (string, optional): Optional page number.
list_pull_requests: List all pull requests for a project. Use this tool to discover available pull requests before analyzing their coverage, issues, or quality. Returns the pull request key/ID which can be used with other tools (For example: search_files_by_coverage, get_file_coverage_details).	projectKey (string, required): Project key.

Quality gates

Tool	Type
get_project_quality_gate_status: Get the quality gate status for the SonarQube project.	analysisId (string, optional): Analysis ID. projectId (string, optional): Project ID. projectKey (string, optional): Project key. pullRequest (string, optional): Pull request ID.
list_quality_gates: List all quality gates in my SonarQube.

Rules

Tool	Type
show_rule: Shows detailed information about a SonarQube rule.	key (string, required): Rule key.

Sources

Tool	Type
get_raw_source: Get source code as raw text from SonarQube. Requires the See Source Code permission on file.	key (string, required): File key. pullRequest (string, optional): Pull request id.
get_scm_info: Get SCM information of SonarQube source files. Requires the See Source Code permission on the file's project.	key (string, required): File key. commits_by_line (string): If the value is false, group lines by SCM commit; else display commits for each line. from (number): First line to return. Starts at 1. to (inclusive): Last line to return.

Security Hotspots

Tool	Type
search_security_hotspots - Search for Security Hotspots in a SonarQube project.	projectKey (string): Project or application key. hotspotKeys (array of strings): Comma-separated list of specific Security Hotspot keys to retrieve. branch (string, optional):- Optional branch key. pullRequest (string, optional): Optional pull request key. files (array of strings, optional): List of file paths to filter. status (string, optional): Optional status filter: TO_REVIEW, REVIEWED. resolution (string, optional): Optional resolution filter: FIXED, SAFE, ACKNOWLEDGED. sinceLeakPeriod (boolean): Filter hotspots created since the leak period (new code). onlyMine (boolean): Show only hotspots assigned to me. p (integer, optional): - Optional page number. Default: 1. ps (integer, optional): Optional page size. Must be greater than 0 and less than or equal to 500. Default: 100.
show_security_hotspot - Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments.	hotspotKey - Security Hotspot key - Required String
change_security_hotspot_status - Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED).	hotspotKey (string, required): Security Hotspot key. status (enum, required): New status. Required Enum {"TO_REVIEW", "REVIEWED"}. resolution (enum): Resolution when status is REVIEWED. Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}. comment (string, optional): Optional review comment.

System

System tools are only available when connecting to SonarQube Server.

Tool	Type
get_system_health: Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational).
get_system_info: Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions.
get_system_logs: Get SonarQube Server system logs in plain-text format. Requires system administration permission.	name (string, optional): Name of the logs to get. Possible values: access, app, ce, deprecation, es, web. Default: app.
ping_system: Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text.
get_system_status: Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DB_MIGRATION_NEEDED, DB_MIGRATION_RUNNING), version, and id.

Webhooks

Tool	Type
create_webhook: Create a new webhook for the SonarQube organization or project. Requires Administrator permissions on the specified project, or Global Administrator permissions.	name (string, required): Webhook name. url (string, required): Webhook URL. projectKey (string, optional): Project key for project-specific webhook. secret (string, optional): Webhook secret for securing the webhook payload.
list_webhooks: List all webhooks for the SonarQube organization or project. Requires Administrator permissions on the specified project, or Global Administrator permissions.	projectKey (string, optional): Project key to list project-specific webhooks.