SonarQube

Read-only access to the SonarQube Web API through the managed gateway. Six MCP tools cover the common "inspect code quality" surface: search_issues, search_hotspots, get_component_measures, get_quality_gate_status, search_projects, and get_source. All are gated by a single sonar:read scope.

Authentication

SonarQube has no IdP-passthrough or token-exchange path for its Web API — it accepts only native SonarQube tokens. This connector supports two auth modes, chosen per managed resource at install time via the Authentication field:

• Per-user token (user_secret, default, recommended) — each user links their own SonarQube token once, through a PolicyArc-hosted browser page reached by MCP URL elicitation on the first call. The token posts only to the AS (never through the MCP client or the model), is stored encrypted per (subject, resource), and is sent as Authorization: Bearer <token> on that user's calls — so SonarQube attributes every action to the real user. If the token later expires, the upstream 401 triggers a re-link prompt.
• Shared service token (static) — every call uses one operator-held SonarQube token (from the token_env secret) as Authorization: Bearer <token>. SonarQube attributes all calls to that one service account.

Either way, PolicyArc still enforces per-user authorization at the gateway via the sonar:read scope and policy. See Per-user upstream credentials for how the user_secret collection flow works.

Whichever token is used needs Browse permission on the projects you want to inspect.

Requirements

• SonarQube Server ≥ 9.9 LTS (including all Community Build / 2025.x / 2026.x lines) or SonarQube Cloud. These document Authorization: Bearer for the Web API. Server ≤ 8.9 LTS (which only accepts the token as the HTTP Basic username) is not supported.
• No paid edition required for project-wide queries. All six tools work on Community Edition against the main branch. Pull-request / branch scoping (the pullRequest / branch tool inputs — see below) is a Developer Edition+ feature; on Community Edition those inputs have no effect.

Setup

• base_url — SonarQube Cloud: leave as https://sonarcloud.io. SonarQube Server: your instance host, e.g. https://sonar.example.com.
• upstream_auth.type — user_secret (default) or static.
• token_env — static mode only — a secret holding the shared SonarQube token. Hidden when user_secret is selected (each user links their own).

SonarQube Cloud: the organization parameter

SonarQube Cloud requires an organization key on most Web API calls; SonarQube Server does not have organizations. This connector exposes organization as an optional per-call tool input — Cloud callers pass it on each call, Server callers omit it. (Tell your agent the org once in its instructions.)

Scoping to a merge request or branch

The read tools (search_issues, get_quality_gate_status, search_hotspots, get_component_measures, get_source) accept two optional, mutually-exclusive per-call inputs that scope results exactly the way SonarQube's own PR/branch analysis does:

• pullRequest — a merge/pull-request key (the GitLab MR IID, e.g. 105). Returns only that MR's new-code findings, with line numbers against the MR's diff. This is the accurate way to review one MR: e.g. get_quality_gate_status(projectKey, pullRequest="105") is the authoritative "does this MR pass" signal, and search_issues(componentKeys, pullRequest="105", resolved="false") lists exactly what the MR introduced (no whole-project noise, correct lines).
• branch — a non-default branch name, to query that branch's own analysis.

Both require SonarQube Developer Edition+ with the matching analysis already run by CI (sonar.pullRequest.* / sonar.branch.*). Omit both to query the project's main branch.

Troubleshooting

• 401 Unauthorized — the token is missing, invalid, or expired. In user_secret mode the gateway re-prompts the user to reconnect; in static mode check the token_env secret.
• 403 Forbidden — the token's user lacks Browse permission on the requested project.

Manifest reference

• ID: identos.sonarqube
• Version: 1.0.0
• Resource type: urn:connector:identos:sonarqube
• Capabilities: mcp

Supported auth modes

Type	Details
user_secret	—
static	scheme bearer; setup fields: token_env

Setup fields

ID	Label	Default	Secret?	Notes
base_url	SonarQube base URL	https://sonarcloud.io	no	placeholder: https://sonar.example.com / SonarQube Cloud: leave as https://sonarcloud.io. SonarQube Server: your instance host (e.g. https://sonar.example.com).
upstream_auth.type	Authentication	user_secret	no	user_secret (recommended) has each user link their own SonarQube token, so actions are attributed to the real user. static uses one shared token for everyone.
token_env	SonarQube token	—	yes	Used only for the static method. A secret containing a SonarQube user token. Sent as Authorization: Bearer <token>. The token's user needs Browse permission on the inspected projects. / shown when upstream_auth.type == 'static'

Scopes

Scope
sonar:read

Routes

Method	Pattern	Scope	Resource template
GET	/api/issues/search	sonar:read	sonarqube://issues
GET	/api/hotspots/search	sonar:read	sonarqube://hotspots
GET	/api/measures/component	sonar:read	sonarqube://measures
GET	/api/qualitygates/project_status	sonar:read	sonarqube://quality_gate
GET	/api/components/search_projects	sonar:read	sonarqube://projects
GET	/api/sources/raw	sonar:read	sonarqube://source

MCP tools

Name	Scope	Description
search_issues	sonar:read	Search SonarQube issues (bugs, vulnerabilities, code smells). On SonarQube Cloud, pass organization.
search_hotspots	sonar:read	Search security hotspots for a project. On SonarQube Cloud, pass organization.
get_component_measures	sonar:read	Get metric measures (coverage, bugs, vulnerabilities, etc.) for a component. On SonarQube Cloud, pass organization.
get_quality_gate_status	sonar:read	Get the quality gate status (OK/ERROR) for a project. On SonarQube Cloud, pass organization.
search_projects	sonar:read	Search projects visible to the token. On SonarQube Cloud, pass organization.
get_source	sonar:read	Get the raw source of a file by its component key. On SonarQube Cloud, pass organization.