sonarqube-mcp

This skill provides patterns for integrating SonarQube and SonarCloud into the agent workflow through the SonarQube Model Context Protocol (MCP) server. It addresses the need to enforce code quality without leaving the development loop: checking quality gate status before merges or deployments, discovering and triaging issues by severity and project, analyzing code snippets locally before committing (shift-left), and understanding why specific Sonar rules fired.

The skill documents the MCP tool surface and how to use it: getting quality gate status, searching issues across projects, analyzing code snippets, showing rule documentation with compliant and noncompliant examples, and retrieving component measures such as bugs, vulnerabilities, coverage, and ratings. It includes common agent patterns (PR review combining gate plus issues, pre-commit shift-left analysis, project triage by severity, and release gate checks). Notably, it emphasizes safe practice: the change_sonar_issue_status tool is documented with a warning never to call it without explicit user confirmation and a documented reason. The plugin ships a .mcp.json that starts the server via Docker, and setup documents the required environment variables (SONARQUBE_TOKEN, and SONARQUBE_URL or SONARQUBE_ORG) as standard configuration.

It targets developers and teams who use SonarQube or SonarCloud and want quality-gate monitoring, issue triage, and rule education directly in their agent workflow. The skill declares only the Read tool; its operations are predominantly read-only analysis and reporting, with the single state-changing operation gated behind explicit confirmation.