SonarQube MCP for Claude: Full Setup & Usage Guide

Q: What permissions does my SonarQube token need?

`Browse on Projects` is enough for read-only triage. If you want Claude to mark issues as false-positive or change severity, you'll also need `Administer Issues` on the project.

Code quality and agents are finally meeting in the middle. The official SonarQube MCP server from SonarSource gives Claude direct access to the issues, code smells, and security hotspots SonarQube finds — so instead of opening a dashboard, you ask Claude *'what are the top three issues in my last PR?'* and it answers, with file paths and severities. This is the complete guide.

About this server

SonarQube MCP

★ 541 · Official · Java · devtools · SonarSource/sonarqube-mcp-server

Install guide →

Official SonarQube MCP server (SonarSource/sonarqube-mcp-server). Connects to SonarQube Cloud or your self-hosted instance. Surfaces issues, code smells, security hotspots, and project metrics through MCP tools Claude can call.

PROS

Maintained by SonarSource — kept in sync with the SonarQube API
Works with both SonarQube Cloud and self-hosted
Returns rich issue context including rule descriptions and remediation hints

CONS

Requires a SonarQube user token
Quality of results depends on your project's SonarQube configuration

Best for: Teams already running SonarQube who want to bring its findings into their AI workflow.

Our recommendation

If you use SonarQube, install this server — there's no friction. It turns an unloved dashboard into an interactive code-review partner. The biggest win: ask Claude to triage by *fix effort* (low-hanging fruit first) and you'll close 30+ findings in an afternoon.

FAQ

Does it work with SonarCloud (now SonarQube Cloud)?

Yes. The server detects the endpoint from your URL and authenticates with a user token. Configuration is the same for self-hosted SonarQube and SonarQube Cloud.

What permissions does my SonarQube token need?

Browse on Projects is enough for read-only triage. If you want Claude to mark issues as false-positive or change severity, you'll also need Administer Issues on the project.

Can Claude actually fix the issues, or just list them?

List + recommend, by default. To actually patch the code, pair this MCP with filesystem MCP access — then Claude reads the issue, opens the file, and proposes the diff. Don't auto-apply; review first.

Is there an alternative to the official server?

There are community ports but they lag the official API. For production use, the SonarSource server is the safe choice.

How do I install it for Claude Desktop / Cursor / Cline?

See the install guide at /play/sonarqube-mcp/ — copy-paste config for every major client, plus a live demo.