sonarqube-mcp-py
A Python MCP server for SonarQube — query projects, issues, quality gates, coverage, and security hotspots directly from any MCP-compatible AI agent.
Inspired by the official SonarQube MCP Server (Java/Kotlin), reimplemented in Python for lightweight deployment without JVM dependency.
Install
uvx sonarqube-mcp-py
# or
pip install sonarqube-mcp-py
Configuration
Set environment variables:
export SONARQUBE_URL=https://your-sonarqube-instance
export SONARQUBE_TOKEN=squ_your_token_here
export SONARQUBE_VERIFY_SSL=false # optional, for self-signed certs
Transport
- stdio (default): for
mcp.jsonintegration with Claude Desktop, Cursor, Kiro CLI, etc. - HTTP: set
MCP_TRANSPORT=streamable-httpand optionallyMCP_PORT=8959
Available Tools
| Tool | Description |
|---|---|
search_sonarqube_projects |
Search for projects |
get_project_quality_gate_status |
Get quality gate status (OK/ERROR) |
get_component_measures |
Get metrics (bugs, coverage, code smells, etc.) |
list_quality_gates |
List all quality gate definitions |
search_sonar_issues |
Search issues by severity and status |
search_security_hotspots |
Find security hotspots to review |
show_security_hotspot |
Get hotspot details |
show_rule |
Get rule description and examples |
search_metrics |
List all available metrics |
list_pull_requests |
List analyzed pull requests |
get_file_coverage_details |
Get per-file coverage data |
search_files_by_coverage |
Find files with lowest coverage |
get_duplications |
Get code duplication details |
MCP Client Configuration
stdio (mcp.json)
{
"sonarqube": {
"command": "sonarqube-mcp-py",
"env": {
"SONARQUBE_URL": "https://your-instance",
"SONARQUBE_TOKEN": "squ_xxx"
}
}
}
HTTP (standalone service)
{
"sonarqube": {
"url": "http://localhost:8959/mcp"
}
}
Start in HTTP mode:
MCP_TRANSPORT=streamable-http MCP_PORT=8959 sonarqube-mcp-py
License
MIT
Metadata
Release files for sonarqube-mcp-py 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sonarqube_mcp_py-0.2.0.tar.gz | 101.7 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| sonarqube_mcp_py-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 107.9 kB
Release files / sonarqube_mcp_py-0.2.0.tar.gz
| Download URL | sonarqube_mcp_py-0.2.0.tar.gz |
|---|---|
| Size | 101.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
758e77e640d5164f57a9dcaaa0004eb1342ba82c2b7e29533ce98fa2dc28b702
|
|
BLAKE2b-256 checksum How to use checksums |
f3854067ae5d7f6c8ef1f55b4c077ea9ac73a72426bbd37c87a42435aa9b2371
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 15, 2026.
Transparency logRelease files / sonarqube_mcp_py-0.2.0-py3-none-any.whl
| Download URL | sonarqube_mcp_py-0.2.0-py3-none-any.whl |
|---|---|
| Size | 6.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4659a711a866223b4195011f8e04f3c042aff0ae7fee66ef2a23628443505d0b
|
|
BLAKE2b-256 checksum How to use checksums |
b31196108451365538f9d034c3fde2091d85fdaa28c0cda12799485e9efd8b64
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 15, 2026.
Transparency log