> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-mcp-server/reference/tools.md). # Tools Reference for the SonarQube MCP Server tools, toolsets, and supported parameters. The `SONARQUBE_TOOLSETS` environment variable accepts a comma-separated list of toolsets to enable. See the [#tool-enablement](/sonarqube-mcp-server/reference/environment-variables.md#tool-enablement) article for a list of available toolsets. ## SonarQube Cloud organization On SonarQube Cloud, these tools accept an optional `organization` argument when the organization is not fixed: * `analyze_code_snippet` * `run_advanced_code_analysis` * `search_dependency_risks` * `search_sonar_issues_in_projects` * `search_my_sonarqube_projects` * `list_quality_gates` * `show_rule` * `create_webhook` * `list_webhooks` * `architecture_get` * `architecture_set` Pass a key from [`list_organizations`](#projects). The argument applies only to that call. `list_organizations`, and tools that take only a resource identifier, do not use `organization`. When [`SONARQUBE_ORG`](/sonarqube-mcp-server/reference/environment-variables.md#sonarqube_org) fixes the organization, those tools omit `organization`. A call that includes it fails with `Organization is fixed by SONARQUBE_ORG. Remove the organization argument.` In stdio, the environment variable fixes the organization. For a token request in Streamable HTTP, a deprecated `SONARQUBE_ORG` set on the SonarQube MCP Server or a request `SONARQUBE_ORG` header does the same for that scope. An OAuth request on the [SonarQube Cloud-hosted MCP server](/sonarqube-mcp-server/setup/sonarqube-cloud-hosted.md#sign-in-with-oauth) rejects a `SONARQUBE_ORG` header with `SONARQUBE_ORG is not supported for OAuth requests. Use the tool organization argument.` Pass `organization` on the tool call. The scopes `mcp:tools:read` and `mcp:tools:write` independently control read and write tools. A call outside your scopes fails with `Insufficient OAuth scope`. If the organization is missing, the tool fails with `Organization is required. Call list_organizations first, then pass its key as organization, or configure SONARQUBE_ORG.` `analyze_code_snippet` and `run_advanced_code_analysis` return that guidance before they wait for analyzers or read files. Profile and rule lookups for `analyze_code_snippet` use the organization selected for that call. In stdio, a token that belongs to one organization uses that organization as the default. Zero or multiple organizations leave it unresolved. A tool argument does not change that default. Vortex context tools use the organization configured at startup, or the single organization detected at startup. A later `organization` argument does not retarget that proxied engine. When startup leaves the organization unresolved, the server does not start the Vortex context proxy. `run_advanced_code_analysis` is separate from that proxy. On SonarQube Cloud stdio, the server registers it when the workspace is mounted and at least one organization you can access has an active Vortex subscription, even when startup leaves the organization unresolved. [`SONARQUBE_ORG`](/sonarqube-mcp-server/reference/environment-variables.md#sonarqube_org) limits that check to the fixed organization. Each call checks the organization you select. An organization without Vortex fails with `Vortex is not enabled for the selected SonarQube Cloud organization.` ## SonarQube Cloud-hosted MCP server The embedded MCP server includes a default list of toolsets. Define a subset of this list using the `SONARQUBE_TOOLSETS` header: * `analysis`,`coverage`,`dependency-risks`,`duplications`,`quality-gates`,`issues`,`measures`,`projects`,`rules`,`security-hotspots` * Sonar Vortex analysis is not available on the SonarQube Cloud-hosted MCP server because it requires a local filesystem mount. To use [Sonar Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md), set up a local MCP Server using [Stdio](/sonarqube-mcp-server/setup/self-hosted.md#local-server-stdio). * For details about the tools in each toolset, see the relevant section below. ## Agentic Readiness Agentic Readiness tools are available only on SonarQube Cloud when the feature is enabled for your organization. In stdio mode, the server checks the feature flag at startup. In HTTP or HTTPS mode, the server does not load these tools unless you opt in explicitly. To opt in, set `SONARQUBE_TOOLSETS` on the server and include `agentic-readiness` along with every other toolset you need, because setting the variable replaces the defaults. This applies even though `agentic-readiness` is in the default toolset list. ## Branch and pull request context Many tools accept optional `branch` or `pullRequest` parameters to analyze a specific branch or pull request. **SonarQube Cloud** has three analysis contexts: * **Long-lived branches** (main, develop, release/\*): use `branch`. Discover valid names with `list_branches` (`branchTypes=LONG` or check the `type` field). * **Short-lived branches** (feature branches analyzed without pull requests): use `branch`. Discover via `list_branches` (`branchTypes=SHORT` or check the `type` field), or pass the current git branch name directly. * **Pull requests**: use `pullRequest`. Discover keys with `list_pull_requests`. **SonarQube Server** has two analysis contexts: * **Branches**: use `branch`. Discover names with `list_branches`, or pass the current git branch name directly. * **Pull requests**: use `pullRequest`. Discover keys with `list_pull_requests`. For both environments: * Don't pass a git branch name to `pullRequest` — it expects the SonarQube pull request key. * Don't provide both `branch` and `pullRequest` on the same call. * Omit both to query the default (main) branch analysis. ## Analysis | Tool | Type | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

analyze\_code\_snippet: Analyze a file or code snippet with SonarQube analyzers to identify code quality and security issues. Specify the language of the snippet to improve analysis accuracy. Optionally filter results to a specific code snippet.

Deprecated: analyze\_code\_snippet will be removed in a future release. Connect SonarQube for IDE to use analyze\_file\_list, or enable Vortex analysis for your organization to use run\_advanced\_code\_analysis (see below).

Supported Languages: Java, Kotlin, Python, Ruby, Go, JavaScript (js, jsx), TypeScript (ts, tsx), JSP, PHP, XML, HTML, CSS, CloudFormation, Kubernetes, Terraform, ARM, Ansible, Docker, Secrets detection.

|

Usage:

Parameters:

Response fields:

NOTE: The analyze\_code\_snippet tool is disabled if you are using the MCP server embedded in SonarQube Cloud. A self-hosted server connected to SonarQube Cloud over HTTP or HTTPS also does not register analysis tools. For a full overview of which tools are unavailable with the embedded server and why, see Tool availability with SonarQube Cloud.

| ### When integration with SonarQube for IDE is enabled These two tools are tagged under both the `analysis` and `ide` toolsets. | Tool | Type | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | **analyze\_file\_list**: Analyze files in the current working directory using SonarQube for IDE. This tool connects to a running SonarQube for IDE instance to perform code quality analysis on a list of files. | `file_absolute_paths` (array of strings, required): List of absolute file paths to analyze. | | **toggle\_automatic\_analysis**: Enable or disable SonarQube for IDE automatic analysis. When enabled, SonarQube for IDE automatically analyzes files as you modify them in the working directory. When disabled, automatic analysis is turned off. | `enabled` (boolean, required): Enable or disable the automatic analysis. | ### When Vortex analysis is available [Vortex analysis](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-analysis.md) is available with an active subscription when you run the MCP server in stdio mode with SonarQube Cloud, or with SonarQube Server 2026.5 and newer Enterprise or Data Center edition. The server selects one analysis path at startup. Enabled toolsets still apply. * **SonarQube Cloud:** Vortex analysis (`run_advanced_code_analysis`) when the workspace is mounted and at least one organization has an active subscription; local analysis otherwise. A call accepts only an organization with an active subscription. * **SonarQube Server:** Vortex analysis when the instance has an active subscription and the workspace is mounted. Local analysis when the instance does not have Vortex. Local analysis uses SonarQube for IDE when it is connected, or `analyze_code_snippet`. Without a workspace mount, snippet analysis requires `fileContent`. On SonarQube Cloud, `SONARQUBE_ORG` limits the subscription check to that organization. To analyze snippets for every organization, set [`SONARQUBE_FORCE_LOCAL_ANALYSIS`](/sonarqube-mcp-server/reference/environment-variables.md#sonarqube_force_local_analysis) to `true`, enable the `analysis` toolset, and restart. That setting registers `analyze_code_snippet` even when SonarQube for IDE is connected. It has no effect on SonarQube Server or on SonarQube Cloud over HTTP or HTTPS. Over HTTP and HTTPS, SonarQube Server supports snippet analysis when a startup `SONARQUBE_TOKEN` is set. SonarQube Cloud exposes no analysis tools. > Requires having the workspace mounted at `/app/mcp-workspace` When the server selects Vortex analysis, it does not register `analyze_code_snippet` or the SonarQube for IDE bridge tools (`analyze_file_list`, `toggle_automatic_analysis`). | Tool | Type | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **run\_advanced\_code\_analysis**: Run Vortex analysis on a single file. On SonarQube Cloud, pass optional `organization` when `SONARQUBE_ORG` does not fix the organization. Call `list_organizations` when the organization is ambiguous (see [SonarQube Cloud organization](#sonarqube-cloud-organization)). The call checks that organization's subscription and fails with `Vortex is not enabled for the selected SonarQube Cloud organization.` when Vortex is not enabled. SonarQube Server uses the nil UUID placeholder. Requires the workspace to be mounted at `/app/mcp-workspace`. Unlike `analyze_code_snippet` with a workspace mount, this tool uses full CI-level analysis context collected from a previous SonarQube scan for higher-precision results. |

organization (string, optional): Organization key. Use only when SONARQUBE\_ORG is unset; call list\_organizations if ambiguous. Defaults to the configured organization, or to the single organization detected at startup.

projectKey (key, required): The key of your project. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

branch (string, required): Branch name used to retrieve the latest analysis context.

filePath (string, required): Project-relative path of the file to analyze (e.g., src/main/java/MyClass.java).

fileScope (string, optional): Defines in which scope the file originates from: MAIN or TEST. Default: MAIN.

| ## Vortex context The following tools are available with an active Sonar Vortex subscription. For more information, see [Sonar Vortex context](/agent-centric-development-cycle/inside-your-agent-the-agentic-loop/sonar-vortex-context.md). ### Semantic navigation | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **search\_by\_signature\_patterns:** Find code elements (classes, methods, interfaces) by their declaration signatures using regex patterns. | | | **search\_by\_body\_patterns:** Find code elements by their implementation body using regex patterns. Useful for locating where APIs or patterns are actually used. | | | **get\_upstream\_call\_flow:** Trace what functions call a given function. Useful for finding all callers and entry points, and understanding what breaks if a signature changes. | | | **get\_downstream\_call\_flow:** Trace what functions a given function calls. Useful for impact analysis and understanding execution flow. | | | **get\_source\_code** - Get complete source code (signature and body) for a code element by its fully qualified name. | | | **get\_type\_hierarchy** - Get the full inheritance hierarchy for a class-like structure (class, interface, enum, record, exception, struct). Essential for understanding inheritance trees and refactoring. | | | **get\_references** - Get direct inbound and outbound code references for a class or module. Returns only direct (non-transitive) references. | | ### Architecture | Tool | Type | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **get\_current\_architecture** - Get a hierarchical architecture graph filtered by path prefix and depth. Useful for exploring module structure and high-level dependencies. | | | **get\_intended\_architecture** - Get user-defined architectural constraints specifying which modules are allowed to depend on others. | | ### Guidelines | Tool | Type | | ---------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **get\_guidelines** - Get coding guidelines based on SonarQube project issues, catalog categories, or a combination of both. | | ### Dependencies > **Note:** Third-party dependency tools are only available when [SCA](/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca.md) is enabled for your SonarQube Cloud organization. | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **check\_dependency** - Check a third-party dependency for security vulnerabilities, supply-chain malware, and license compliance before adding or updating it. Covers npm, Maven, PyPI, Go, NuGet, Cargo, Composer (PHP), RubyGems, and more. Must be called before modifying any dependency manifest or lockfile (e.g. `package.json`, `pom.xml`, `build.gradle`, `requirements.txt`, `Cargo.toml`). | | ## Coverage | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **search\_files\_by\_coverage**: Search for files in a project sorted by coverage (ascending, worst coverage first). Use this tool to identify files that are candidates for test coverage improvements. |

projectKey (string, required): The project key to search in. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

maxCoverage (number, optional): Maximum coverage threshold (0–100). Only returns files with coverage less than or equal to this value.

pageIndex (number, optional): Page index (1-based). Default: 1.

pageSize (number, optional): Page size. Default: 100. Max: 500.

| | **get\_file\_coverage\_details**: Get line-by-line coverage information for a specific file, including which exact lines are uncovered and which have partially covered branches. Use this tool after identifying low-coverage files with `search_files_by_coverage` to pinpoint where to add test coverage. |

key (string, required): File key (e.g., my\_project:src/foo/Bar.java).

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

from (number, optional): First line to return (1-based). Default: 1.

to (number, optional): Last line to return (inclusive). If not specified, all lines are returned.

| ## Dependency risks > **Note:** Dependency risks require SonarQube Advanced Security. On SonarQube Cloud, enable [Advanced Security](/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca.md) for the organization. On SonarQube Server, use version 2025.4 Enterprise edition or higher with [SonarQube Advanced Security](/sonarqube-server/2025.4/advanced-security.md) enabled. | Tool | Type | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **search\_dependency\_risks**: Search for software composition analysis issues (dependency risks) of a SonarQube project, paired with releases that appear in the analyzed project, application, or portfolio. |

projectKey (string): Project key. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

pageIndex (integer, optional): Page index. Default: 1.

pageSize (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100.

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| ## Duplications | Tool | Type | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **search\_duplicated\_files**: Search for files with code duplications in a SonarQube project. By default, automatically fetches all duplicated files across all pages (up to 10,000 files max). Returns only files with duplications. |

projectKey (string, required): Project key. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

pageSize (integer, optional): Optional number of results per page for manual pagination. Max: 500. If not specified, auto-fetches all duplicated files.

pageIndex (integer, optional): Optional page number for manual pagination. Starts at 1. If not specified, auto-fetches all duplicated files.

| | **get\_duplications**: Get duplications for a file. Require Browse permission on file's project. |

key (string, required): File key.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

| ## Enterprises > **Note:** Enterprise tools are only available when connecting to SonarQube Cloud Enterprise. | Tool | Type | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | **list\_enterprises**: List the enterprises available in SonarQube Cloud that you have access to. Use this tool to discover enterprise IDs that can be used with other tools. | `enterpriseKey` (string, optional): Enterprise key to filter results. | ## Issues | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **change\_sonar\_issue\_status**: Change the status of a SonarQube issue to "accept", "falsepositive" or to "reopen" an issue. |

key (string, required): Issue key

status (enum, required): New issue's status. Required Enum {"accept", "falsepositive", "reopen"}

comment (string, optional): Optional comment explaining the status change.

| | **search\_sonar\_issues\_in\_projects**: Search for SonarQube issues in your organization's projects. |

issueStatuses (array of strings, optional): List of issue statuses to filter by. Possible values: OPEN, CONFIRMED, FALSE\_POSITIVE, ACCEPTED, FIXED, IN\_SANDBOX.

tags (array of strings, optional): List of issue tags to filter by. Tags are lowercase.

inNewCodePeriod (boolean, optional): Only return issues in the new code period. Requires exactly one entry across projectKeys and files.

issueKey (string, optional): Issue key used to fetch a specific issue.

impactSoftwareQualities (array of strings, optional): List of software qualities to filter by. Possible values: MAINTAINABILITY, RELIABILITY, SECURITY.

pageIndex (integer, optional): 1-based page index. Default: 1.

projectKeys (array of strings, optional): Optional list of SonarQube project keys.

pageSize (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

severities (array of strings, optional): List of severities to filter by. Possible values: INFO, LOW, MEDIUM, HIGH, BLOCKER.

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| ## Languages | Tool | Type | | ----------------------------------------------------------------------------------------- | -------------------------------------------------- | | **list\_languages**: List all programming languages supported in this SonarQube instance. | `q`: Pattern to match language keys/names against. | ## Measures | Tool | Type | | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **get\_component\_measures**: Get SonarQube measures for a component (project, directory, file). |

projectKey (string, required): The project key. Required when SONARQUBE\_PROJECT\_KEY is not configured.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

metricKeys (array of strings, optional): Metric keys to retrieve (for example: ncloc, complexity, violations, coverage, new\_violations).

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

New Code metrics (typically new\_\*) return their New Code period value in value.

Response fields:

| ## Metrics | Tool | Type | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **search\_metrics**: Search for SonarQube metrics. |

pageIndex (integer, optional): 1-based page index. Default: 1.

pageSize (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100.

| ## Portfolios | Tool | Type | | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **list\_portfolios**: List enterprise portfolios available in SonarQube with filtering and pagination options. |

For SonarQube Server:

q (string, optional): Search query to filter portfolios by name or key.

favorite (boolean): If true, returns favorite portfolios.

pageIndex (integer, optional): Optional 1-based page number. Default: 1.

pageSize (integer, optional): Optional page size, max 500. Default: 100.

For SonarQube Cloud:

enterpriseId (string): Enterprise uuid. Can be omitted only if the favorite parameter is supplied with value true.

q (string, optional): Search query to filter portfolios by name.

favorite (boolean, required): Required to be true if the enterpriseId parameter is omitted. If true, returns portfolios favorited by the logged-in user. Cannot be true when draft is true.

draft (boolean): If true, returns drafts created by the logged-in user. Cannot be true when favorite is true.

pageIndex (integer, optional): Index of the page to fetch. Default: 1,

pageSize (integer, optional): Size of the page to fetch. Default: 50.

| ## Projects | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **list\_organizations**: List SonarQube Cloud organizations that you're a member of, including each organization's key, name, ID, and UUID. Use a returned key as `organization` on organization-aware tools. Available on SonarQube Cloud only. The tool does not take an `organization` argument. |

No parameters.

Response fields:

| | **search\_my\_sonarqube\_projects**: Find SonarQube projects. The response is paginated. |

pageIndex (integer, optional): 1-based page index. Default: 1.

pageSize (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 500.

q (string, optional): Search query to filter projects by name (partial match) or key (exact match).

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| | **list\_branches**: List analyzed branches for a project. **SonarQube Cloud**: returns long-lived (`LONG`) and short-lived (`SHORT`) branches with `type` and `mergeBranch` fields. Optional `branchTypes` filter: `ALL` (default), `LONG`, or `SHORT`. **SonarQube Server**: returns all analyzed branches (name, quality gate, analysis date). No `type`, `mergeBranch`, or `branchTypes` filter. Use returned branch names as the `branch` parameter on other tools. For pull request analysis, use `list_pull_requests` instead. |

projectKey (string, required): Project key. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

branchTypes (enum, optional, SonarQube Cloud only): Filter branches by type. ALL (default), LONG, or SHORT.

| | **list\_pull\_requests**: List all pull requests for a project. Use this tool to discover pull requests for PR-decorated analysis (coverage, issues, quality gate). Returns the pull request key/ID which can be used with other tools. For branch-based analysis without pull requests, use `list_branches` instead. | `projectKey` (string, required): Project key. Ignored when `SONARQUBE_PROJECT_KEY` is defined. | ## Quality gates | Tool | Type | | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **get\_project\_quality\_gate\_status**: Get the quality gate status for the SonarQube project. |

analysisId (string, optional): Analysis ID.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

projectId (string, optional): Project ID.

projectKey (string, optional): Project key.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

| | **list\_quality\_gates**: List all quality gates in my SonarQube. | `organization` (string, optional): SonarQube Cloud organization key. Use only when `SONARQUBE_ORG` is unset. Call `list_organizations` if the organization is ambiguous. | ## Rules | Tool | Type | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **show\_rule**: Shows detailed information about a SonarQube rule. |

key (string, required): Rule key.

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| ## Sources | Tool | Type | | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **get\_raw\_source**: Get source code as raw text from SonarQube. Requires the *See Source Code* permission on file. |

key (string, required): File key.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

| | **get\_scm\_info**: Get SCM information of SonarQube source files. Requires the *See Source Code* permission on the file's project. |

key (string, required): File key.

commits\_by\_line (string): If the value is false, group lines by SCM commit; else display commits for each line.

from (number): First line to return. Starts at 1.

to (inclusive): Last line to return.

| ## Security Hotspots | Tool | Type | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **search\_security\_hotspots** - Search for Security Hotspots in a SonarQube project. |

projectKey (string): Project or application key. Ignored when SONARQUBE\_PROJECT\_KEY is defined.

hotspotKeys (array of strings): Comma-separated list of specific Security Hotspot keys to retrieve.

branch (string, optional): Optional branch name for branch-based analysis. Use list\_branches to discover valid names.

pullRequest (string, optional): Optional pull request key/ID. Use list\_pull\_requests to discover valid keys.

files (array of strings, optional): List of file paths to filter.

status (string, optional): Optional status filter: TO\_REVIEW, REVIEWED.

resolution (string, optional): Optional resolution filter: FIXED, SAFE, ACKNOWLEDGED.

sinceLeakPeriod (boolean): Filter hotspots created since the leak period (new code).

onlyMine (boolean): Show only hotspots assigned to me.

pageIndex (integer, optional): 1-based page index. Default: 1.

pageSize (integer, optional): Page size. Must be greater than 0 and less than or equal to 500. Default: 100.

| | **show\_security\_hotspot** - Get detailed information about a specific Security Hotspot, including rule details, code context, flows, and comments. | `hotspotKey` - Security Hotspot key - *Required String* | | **change\_security\_hotspot\_status** - Review a Security Hotspot by changing its status. When marking as REVIEWED, you must specify a resolution (FIXED, SAFE, or ACKNOWLEDGED). |

hotspotKey (string, required): Security Hotspot key.

status (enum, required): New status. Required Enum {"TO\_REVIEW", "REVIEWED"}.

resolution (enum): Resolution when status is REVIEWED. Enum {"FIXED", "SAFE", "ACKNOWLEDGED"}.

comment (string, optional): Optional review comment.

| ## System > **Note:** System tools are only available when connecting to SonarQube Server. | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | **get\_system\_health**: Get the health status of SonarQube Server instance. Returns GREEN (fully operational), YELLOW (usable but needs attention), or RED (not operational). | | | **get\_system\_info**: Get detailed information about SonarQube Server system configuration including JVM state, database, search indexes, and settings. Requires 'Administer' permissions. | | | **get\_system\_logs**: Get SonarQube Server system logs in plain-text format. Requires system administration permission. | `name` (string, optional): Name of the logs to get. Possible values: access, app, ce, deprecation, es, web. Default: app. | | **ping\_system**: Ping the SonarQube Server system to check if it's alive. Returns 'pong' as plain text. | | | **get\_system\_status**: Get state information about SonarQube Server. Returns status (STARTING, UP, DOWN, RESTARTING, DB\_MIGRATION\_NEEDED, DB\_MIGRATION\_RUNNING), version, and id. | | ## Webhooks | Tool | Type | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **create\_webhook**: Create a new webhook for the SonarQube organization or project. Requires *Administrator* permissions on the specified project, or *Global Administrator* permissions. |

name (string, required): Webhook name.

url (string, required): Webhook URL.

projectKey (string, optional): Project key for project-specific webhook.

secret (string, optional): Webhook secret for securing the webhook payload.

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| | **list\_webhooks**: List all webhooks for the SonarQube organization or project. Requires *Administrator* permissions on the specified project, or *Global Administrator* permissions. |

projectKey (string, optional): Project key to list project-specific webhooks.

organization (string, optional): SonarQube Cloud organization key. Use only when SONARQUBE\_ORG is unset. Call list\_organizations if the organization is ambiguous.

| ## Architecture > **Note:** On SonarQube Cloud, the architecture tools require a Team or Enterprise plan. Add `architecture` to [`SONARQUBE_TOOLSETS`](/sonarqube-mcp-server/reference/environment-variables.md#available-toolsets) to enable these tools in stdio, HTTP, or HTTPS mode. The toolset is not enabled by default. SonarQube Server registers current architecture only. Intended reads and writes stay on SonarQube Cloud until a public API can resolve a project UUID from a project key. On SonarQube Cloud, pass `organization` only when none is configured or detected. A current read fails without a resolved organization. For details, see the [SonarQube Cloud organization](#sonarqube-cloud-organization) article. `architecture_get` reads current dependencies or intended groups and constraints. A current view shows at most 150 nodes, 20 dependencies, and 5 feedback pairs across languages. Narrow the view with `component` or `language`. Omitted siblings can remain undiscoverable, which means a capped view is not a complete graph export. Current graph reads allow two concurrent calls for each tool instance. Further calls wait up to five seconds, then fail with `Architecture reads are busy. Try again shortly.` Each accepted call still downloads and processes the full selected graph. * `target` (required): `current` or `intended` on SonarQube Cloud; `current` on SonarQube Server * `projectKey` (required string): Project key, ignored when `SONARQUBE_PROJECT_KEY` is defined * `organization` (optional string, SonarQube Cloud): Organization key when none is configured or detected; a `current` read fails without a resolved organization * `component` (optional string): Exact key from this tool, with no wildcards (Java current keys use `module:package`; intended keys join group labels with `/`); top level when omitted * `depth` (optional number): Levels below the start (default 1 for `current`, all levels for `intended`); must be 1 or more * `language` (optional): `java`, `cs`, `js`, `ts`, or `py` (all languages when omitted) `architecture_set` replaces the whole intended model on SonarQube Cloud. Start from an unfiltered `architecture_get` response with `target` set to `intended`, and set `dryRun` to `true` to review the diff before you apply it. SonarQube Server does not register this tool. It's hidden when [`SONARQUBE_READ_ONLY`](/sonarqube-mcp-server/reference/environment-variables.md#sonarqube_read_only) is `true`. An OAuth call needs both `mcp:tools:read` and `mcp:tools:write`. A call outside those scopes fails with `Insufficient OAuth scope`. The call removes any perspective or group you omit. Keep labels, descriptions, and imported pattern links from the exported model. Imported patterns stay references: the public export does not expand their groups or constraints, and you cannot edit those imported contents. A group that imports a pattern cannot declare child groups. The call rejects partial views and an empty model. Supply the whole response to enable the revision check. A bare `models` array without `revision` cannot detect changes since the export. Concurrent edits can still race the check, and a mismatch changes nothing. The server returns a definite client rejection directly. When the saved state cannot be verified, the error includes a recovery export and the server does not roll back automatically. A successful call returns `mode` as `dry-run`, `unchanged`, `created`, or `replaced`, plus a `diff` of removed, added, and changed entries. * `target` (required): `intended` * `projectKey` (required string): Project key, ignored when `SONARQUBE_PROJECT_KEY` is defined * `organization` (optional string, SonarQube Cloud): Organization key when none is configured or detected * `model` (required string): Whole JSON response, or its `models` array, from an unfiltered `architecture_get` with `target` `intended` (partial views are rejected) * `dryRun` (required boolean): `true` to validate and list the changes, `false` to write them * `revision` (optional string): Revision from `architecture_get` (defaults to the revision on the whole response); a mismatch prevents the write --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.sonarsource.com/sonarqube-mcp-server/reference/tools.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.