SonarQube MCP Server

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server or Cloud for code quality and security. It also supports the analysis of code snippet directly within the agent context.

Quick setup

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

• Avoid hardcoding tokens in command-line arguments – they get saved in shell history
• Use environment variables – set tokens in environment variables before running commands

When using configuration files:

• Never commit tokens to version control
• Use environment variable substitution in config files when possible

🚀 Generate your configuration

The fastest way to get started is the SonarQube MCP Server Configuration Generator – an interactive tool that produces a ready-to-use configuration for your preferred AI agent client.

Manual setup

If you prefer to configure things yourself, the simplest method is to use our container image at sonarsource/sonarqube-mcp. Use sonarsource/sonarqube-mcp for automatic updates (with --pull=always), or pin to a version tag (e.g., sonarsource/sonarqube-mcp:1.19.0.2785) for reproducible deployments. Read below if you want to build it locally.

Note: While the examples below use docker, any OCI-compatible container runtime works (e.g., Podman, nerdctl). Simply replace docker with your preferred tool.

SonarQube MCP Server is available in the Antigravity MCP Store. Follow these instructions:

1. Open the Agent Side Panel
2. Click the three dots (...) at the top right and select MCP Servers
3. Search for SonarQube and select Install
4. Provide the required SonarQube User token. You can also provide your organization key for SonarQube Cloud or the SonarQube URL if connecting to SonarQube Server.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Alternatively, you can manually configure the server via mcp_config.json:

• To connect with SonarQube Cloud:

In the Agent Side Panel, click the three dots (...) -> MCP Store -> Manage MCP Servers -> View raw config, and add the following:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      }
    }
  }
}

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

• To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      }
    }
  }
}

• To connect with SonarQube Cloud:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG sonarsource/sonarqube-mcp

For SonarQube Cloud US, add --env SONARQUBE_URL=https://sonarqube.us to the command.

• To connect with SonarQube Server:

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL sonarsource/sonarqube-mcp

Manually edit the configuration file at ~/.codex/config.toml and add the following configuration:

• To connect with SonarQube Cloud:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_USER_TOKEN>", "SONARQUBE_ORG" = "<YOUR_ORG>" }

For SonarQube Cloud US, add "SONARQUBE_URL" = "https://sonarqube.us" to the env section and "-e", "SONARQUBE_URL" to the args array.

• To connect with SonarQube Server:

[mcp_servers.sonarqube]
command = "docker"
args = ["run", "--init", "--pull=always", "--rm", "-i", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_URL", "sonarsource/sonarqube-mcp"]
env = { "SONARQUBE_TOKEN" = "<YOUR_TOKEN>", "SONARQUBE_URL" = "<YOUR_SERVER_URL>" }

• To connect with SonarQube Cloud:

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

• To connect with SonarQube Server:

Note: The Gemini CLI extension has moved to the sonarqube-agent-plugins repository. Please install it from there going forward.

You can install our MCP server extension by using the following command:

gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins

You will need to set the required environment variables before starting Gemini:

Environment Variables Required:

• For SonarQube Cloud:

  • SONARQUBE_TOKEN - Your SonarQube Cloud token
  • SONARQUBE_ORG - Your organization key
  • SONARQUBE_URL - (Optional) Set to https://sonarqube.us for SonarQube Cloud US

• For SonarQube Server:

  • SONARQUBE_TOKEN - Your SonarQube Server USER token
  • SONARQUBE_URL - Your SonarQube Server URL

Once installed, the extension will be installed under <home>/.gemini/extensions/sonarqube/gemini-extension.json.

After starting Copilot CLI, run the following command to add the SonarQube MCP server:

/mcp add

You will have to provide different information about the MCP server, you can use tab to navigate between fields.

• To connect with SonarQube Cloud:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_ORG, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_TOKEN>,SONARQUBE_ORG=<YOUR_ORG>
Tools: *

For SonarQube Cloud US, add -e, SONARQUBE_URL to Arguments and SONARQUBE_URL=https://sonarqube.us to Environment Variables.

• To connect with SonarQube Server:

Server Name: sonarqube
Server Type: Local (Press 1)
Command: docker
Arguments: run, --init, --pull=always, --rm, -i, -e, SONARQUBE_TOKEN, -e, SONARQUBE_URL, sonarsource/sonarqube-mcp
Environment Variables: SONARQUBE_TOKEN=<YOUR_USER_TOKEN>,SONARQUBE_URL=<YOUR_SERVER_URL>
Tools: *

The configuration file is located at ~/.copilot/mcp-config.json.

GitHub Copilot coding agent can leverage the SonarQube MCP server directly in your CI/CD.

To add the secrets to your Copilot environment, follow the Copilot documentation. Only secrets with names prefixed with COPILOT_MCP_ will be available to your MCP configuration.

In your GitHub repository, navigate under Settings -> Copilot -> Coding agent, and add the following configuration in the MCP configuration section:

• To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_TOKEN",
        "SONARQUBE_ORG": "COPILOT_MCP_SONARQUBE_ORG"
      },
      "tools": ["*"]
    }
  }
}

For SonarQube Cloud US, add "-e", "SONARQUBE_URL" to the args array and "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL" to the env section, then set the secret COPILOT_MCP_SONARQUBE_URL=https://sonarqube.us.

• To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "--rm",
        "-i",
        "-e",
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "COPILOT_MCP_SONARQUBE_USER_TOKEN",
        "SONARQUBE_URL": "COPILOT_MCP_SONARQUBE_URL"
      },
      "tools": ["*"]
    }
  }
}

Create a .kiro/settings/mcp.json file in your workspace directory (or edit if it already exists), add the following configuration:

• To connect with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_ORG",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_TOKEN>",
        "SONARQUBE_ORG": "<YOUR_ORG>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

For SonarQube Cloud US, add "-e", "SONARQUBE_URL" to the args array and "SONARQUBE_URL": "https://sonarqube.us" to the env section.

• To connect with SonarQube Server:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": [
        "run",
        "--init",
        "--pull=always",
        "-i",
        "--rm",
        "-e", 
        "SONARQUBE_TOKEN",
        "-e",
        "SONARQUBE_URL",
        "sonarsource/sonarqube-mcp"
      ],
      "env": {
        "SONARQUBE_TOKEN": "<YOUR_USER_TOKEN>",
        "SONARQUBE_URL": "<YOUR_SERVER_URL>"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

You can use the following buttons to simplify the installation process within VS Code.

For SonarQube Cloud US, manually add "SONARQUBE_URL": "https://sonarqube.us" to the env section in your MCP configuration after installation.

SonarQube MCP Server is available as a Windsurf plugin. Follow these instructions:

1. Open Windsurf Settings > Cascade > MCP Servers and select Open MCP Marketplace
2. Search for sonarqube on the Cascade MCP Marketplace
3. Choose the SonarQube MCP Server and select Install
4. Add the required SonarQube User token. Then add the organization key if you want to connect with SonarQube Cloud, or the SonarQube URL if you want to connect to SonarQube Server or Community Build.

For SonarQube Cloud US, set the URL to https://sonarqube.us.

Navigate to the Extensions view in Zed and search for SonarQube MCP Server. When installing the extension, you will be prompted to provide the necessary environment variables:

• When using SonarQube Cloud:

{
  "sonarqube_token": "YOUR_SONARQUBE_TOKEN",
  "sonarqube_org": "SONARQUBE_ORGANIZATION_KEY",
  "docker_path": "DOCKER_PATH"
}

For SonarQube Cloud US, add "sonarqube_url": "https://sonarqube.us" to the configuration.

• When using SonarQube Server:

{
  "sonarqube_token": "YOUR_SONARQUBE_USER_TOKEN",
  "sonarqube_url": "YOUR_SONARQUBE_SERVER_URL",
  "docker_path": "DOCKER_PATH"
}

The docker_path is the path to a docker executable. Examples:

Linux/macOS: /usr/bin/docker or /usr/local/bin/docker

Windows: C:\Program Files\Docker\Docker\resources\bin\docker.exe

💡 Tip: We recommend pulling the latest image regularly or before reporting issues to ensure you have the most up-to-date features and fixes.

Manual installation

You can manually install the SonarQube MCP server by copying the following snippet in the MCP servers configuration file:

• To connect with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>"
    }
  }
}

• To connect with SonarQube Server:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_URL",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_URL": "<url>"
    }
  }
}

Integration with SonarQube for IDE

The SonarQube MCP Server can integrate with SonarQube for IDE to further enhance your development workflow, providing better code analysis and insights directly within your IDE.

When using SonarQube for IDE, the SONARQUBE_IDE_PORT environment variable should be set with the correct port number. SonarQube for VS Code includes a Quick Install button, which automatically sets the correct port configuration.

For example, with SonarQube Cloud:

{
  "sonarqube": {
    "command": "docker",
    "args": [
      "run",
      "--init",
      "--pull=always",
      "-i",
      "--rm",
      "-e",
      "SONARQUBE_TOKEN",
      "-e",
      "SONARQUBE_ORG",
      "-e",
      "SONARQUBE_IDE_PORT",
      "sonarsource/sonarqube-mcp"
    ],
    "env": {
      "SONARQUBE_TOKEN": "<token>",
      "SONARQUBE_ORG": "<org>",
      "SONARQUBE_IDE_PORT": "<64120-64130>"
    }
  }
}

When running the MCP server in a container on Linux, the container cannot access the SonarQube for IDE embedded server running on localhost. To allow the container to connect to the SonarQube for IDE server, add the --network=host option to your container run command.

Configuration

Depending on your environment, you should provide specific environment variables.

Base

You should add the following variable when running the MCP Server:

Environment variable	Description
STORAGE_PATH	Mandatory absolute path to a writable directory where SonarQube MCP Server will store its files (e.g., for creation, updates, and persistence), it is automatically provided when using the container image
SONARQUBE_PROJECT_KEY	Optional default project key. When set, all tools that require a project key will use this value automatically — the projectKey parameter is removed from their schema entirely. Useful when working on a single project.
SONARQUBE_IDE_PORT	Optional port number between 64120 and 64130 used to connect SonarQube MCP Server with SonarQube for IDE.
SONARQUBE_DEBUG_ENABLED	When set to true, enables debug logging. Debug logs are written to both the log file and STDERR. Useful for troubleshooting connectivity or configuration issues. Default: false.
SONARQUBE_LOG_TO_FILE_DISABLED	When set to true, disables writing logs to disk entirely. No log files will be created under STORAGE_PATH/logs/. Useful in containerized or ephemeral environments where file logging is undesirable. Default: false.

Workspace Mount (Reducing Context Bloat)

By default, analysis tool analyze_code_snippet requires the agent to pass the full file content as a fileContent argument. For large files or when analyzing many files in a session, this significantly increases context window usage and cost.

Solution: mount your project directory into the container at /app/mcp-workspace. When this mount is detected, the server reads files directly from disk using the project-relative filePath argument — file content never passes through the agent context.

{
  "args": [
    "run", "-i", "--rm", "--init", "--pull=always",
    "-e", "SONARQUBE_TOKEN",
    "-e", "SONARQUBE_ORG",
    "-v", "/path/to/your/project:/app/mcp-workspace",
    "sonarsource/sonarqube-mcp"
  ]
}

When the mount is active:

• run_advanced_code_analysis becomes available if your organization is entitled to it
• analyze_code_snippet: filePath is required and fileContent is not used — the server resolves the file the same way

Selective Tool Enablement

By default, only important toolsets are enabled to reduce context overhead. You can enable additional toolsets as needed.

Environment variable	Description
SONARQUBE_TOOLSETS	Comma-separated list of toolsets to enable. When set, only these toolsets will be available. If not set, default important toolsets are enabled (analysis, issues, projects, quality-gates, rules, duplications, measures, security-hotspots, dependency-risks, coverage, cag). Note: The projects toolset is always enabled as it's required to find project keys for other operations. Context Augmentation tools are only available in stdio mode and require organization entitlement. In Streamable HTTP mode, clients can send a SONARQUBE_TOOLSETS HTTP header to narrow this further per-request, but cannot enable toolsets beyond what the server was launched with (see Streamable HTTP transport below).
SONARQUBE_READ_ONLY	When set to true, enables read-only mode which disables all write operations (changing issue status for example). This filter is cumulative with SONARQUBE_TOOLSETS if both are set. Default: false. In Streamable HTTP mode, clients can send a SONARQUBE_READ_ONLY HTTP header to further restrict individual requests to read-only, but cannot lift a server-level read-only restriction (see Streamable HTTP transport below).

Toolset	Key	Description
Analysis	analysis	Code analysis tools (local analysis and advanced remote analysis)
Issues	issues	Search and manage SonarQube issues
Security Hotspots	security-hotspots	Search and review Security Hotspots
Projects	projects	Browse and search SonarQube projects
Quality Gates	quality-gates	Access quality gates and their status
Rules	rules	Browse and search SonarQube rules
Sources	sources	Access source code and SCM information
Duplications	duplications	Find code duplications across projects
Measures	measures	Retrieve metrics and measures (includes both measures and metrics tools)
Languages	languages	List supported programming languages
Portfolios	portfolios	Manage portfolios and enterprises (Cloud and Server)
System	system	System administration tools (Server only)
Webhooks	webhooks	Manage webhooks
Dependency Risks	dependency-risks	Analyze dependency risks and security issues (SCA)
Coverage	coverage	Test coverage analysis and improvement tools
Context Augmentation	cag	Context Augmentation tools (stdio mode only, requires org entitlement)
Agentic Readiness	agentic-readiness	Agentic Readiness Assessment tools (SonarQube Cloud, requires org entitlement)

Examples

Enable analysis, issues, and quality gates toolsets (using Docker with SonarQube Cloud):

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_TOOLSETS="analysis,issues,quality-gates" \
  sonarsource/sonarqube-mcp

Note: The projects toolset is always enabled automatically, so you don't need to include it in SONARQUBE_TOOLSETS.

Enable read-only mode (using Docker with SonarQube Cloud):

docker run --init --pull=always -i --rm \
  -e SONARQUBE_TOKEN="<token>" \
  -e SONARQUBE_ORG="<org>" \
  -e SONARQUBE_READ_ONLY="true" \
  sonarsource/sonarqube-mcp

SonarQube Cloud

To enable full functionality, the following environment variables must be set before starting the server:

Environment variable	Description	Required
SONARQUBE_TOKEN	Your SonarQube Cloud token	Yes
SONARQUBE_ORG	Your SonarQube Cloud organization key	Yes
SONARQUBE_URL	Custom SonarQube Cloud URL (defaults to https://sonarcloud.io). Use this for SonarQube Cloud US: https://sonarqube.us	No

Examples:

• SonarQube Cloud: Only SONARQUBE_TOKEN and SONARQUBE_ORG are needed
• SonarQube Cloud US: Set SONARQUBE_TOKEN, SONARQUBE_ORG, and SONARQUBE_URL=https://sonarqube.us

SonarQube Server

Environment variable	Description	Required
SONARQUBE_TOKEN	Your SonarQube Server USER token	Yes
SONARQUBE_URL	Your SonarQube Server URL	Yes

⚠️ Connection to SonarQube Server requires a token of type USER and will not function properly if project tokens or global tokens are used.

💡 Configuration Tip (stdio mode): The presence of SONARQUBE_ORG determines whether you're connecting to SonarQube Cloud or Server. If SONARQUBE_ORG is set, SonarQube Cloud is used; otherwise, SonarQube Server is used.

Transport Modes

The MCP specification defines two transport mechanisms: Stdio and Streamable HTTP. The SonarQube MCP Server supports both:

MCP transport	Server mode	Typical use
Stdio	Default (no SONARQUBE_TRANSPORT)	Local MCP clients that launch the server as a subprocess (Cursor, Claude Code, VS Code, etc.)
Streamable HTTP	SONARQUBE_TRANSPORT=http or https	Remote or multi-user deployments; clients connect to /mcp over HTTP(S) (e.g. Windsurf with a self-hosted server URL)

Note: Streamable HTTP is the current MCP network transport. The older SSE-only HTTP transport from earlier MCP versions is deprecated and not supported.

1. Stdio (Default - Recommended for Local Development)

The recommended mode for local development and single-user setups, used by most MCP clients.

Example - Docker with SonarQube Cloud:

{
  "mcpServers": {
    "sonarqube": {
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "<your-token>",
        "SONARQUBE_ORG": "<your-org>"
      }
    }
  }
}

2. HTTP (Streamable HTTP)

Unencrypted Streamable HTTP transport. Use HTTPS instead for multi-user deployments.

⚠️ Not Recommended: Use Stdio for local development or HTTPS (Streamable HTTP) for multi-user production deployments.

Environment variable	Description	Default
SONARQUBE_TRANSPORT	Set to http to enable Streamable HTTP transport	Not set (stdio)
SONARQUBE_HTTP_PORT	Port number (1024-65535)	8080
SONARQUBE_HTTP_HOST	Host to bind (defaults to localhost for security)	127.0.0.1
SONARQUBE_HTTP_ALLOWED_ORIGINS	Comma-separated browser origins allowed for CORS (e.g. https://my-app.example.com)	Not set
SONARQUBE_MCP_IN_CONTAINER	Set to true when running inside a container. The official Docker image sets this automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.).	false

Note: In Streamable HTTP mode (HTTP or HTTPS), the server is stateless — each client request must include an Authorization: Bearer <token> header carrying the user's own SonarQube token. For SonarQube Cloud, the organization is resolved as follows:

• If SONARQUBE_ORG is set at server startup, all requests are routed to that organization. Clients must not send a SONARQUBE_ORG header — doing so will result in an error.
• If SONARQUBE_ORG is not set at server startup, each client must supply a SONARQUBE_ORG header on every request. Clients can also narrow the visible tools per-request by supplying SONARQUBE_TOOLSETS and/or SONARQUBE_READ_ONLY headers; these apply additional filtering on top of the server-level configuration — they can only reduce the scope, never expand it. No session state is maintained between requests.

Deprecated: The SONARQUBE_TOKEN request header is still accepted for backward compatibility but will be removed in a future version. Migrate to Authorization: Bearer <token>.

3. HTTPS (Streamable HTTP over TLS) (Recommended for Multi-User Production Deployments)

Secure Streamable HTTP transport with TLS encryption. Requires SSL certificates.

✅ Recommended for Production: Use HTTPS when deploying the MCP server for multiple users over Streamable HTTP. The server binds to 127.0.0.1 (localhost) by default for security.

Environment variable	Description	Default
SONARQUBE_TRANSPORT	Set to https to enable Streamable HTTP transport over TLS	Not set (stdio)
SONARQUBE_HTTP_PORT	Port number (typically 8443 for HTTPS)	8080
SONARQUBE_HTTP_HOST	Host to bind (defaults to localhost for security)	127.0.0.1
SONARQUBE_HTTP_ALLOWED_ORIGINS	Comma-separated browser origins allowed for CORS (e.g. https://my-app.example.com)	Not set
SONARQUBE_MCP_IN_CONTAINER	Set to true when running inside a container. The official Docker image sets this automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.).	false

SSL Certificate Configuration (Optional):

Environment variable	Description	Default
SONARQUBE_HTTPS_KEYSTORE_PATH	Path to keystore file (.p12 or .jks)	/etc/ssl/mcp/keystore.p12
SONARQUBE_HTTPS_KEYSTORE_PASSWORD	Keystore password	sonarlint
SONARQUBE_HTTPS_KEYSTORE_TYPE	Keystore type (PKCS12 or JKS)	PKCS12

Example - Docker with SonarQube Cloud:

Note: When running in a container, set SONARQUBE_HTTP_HOST=0.0.0.0 so the container listens on all interfaces and the runtime's port mapping works, and set SONARQUBE_MCP_IN_CONTAINER=true to tell the server it is inside a container. The official Docker image sets the latter automatically; set it yourself when using other OCI runtimes (Podman, Kubernetes, Nomad, etc.). The host-side port flag controls who can reach the server from outside the container. SONARQUBE_HTTP_HOST=0.0.0.0 only controls where the server listens inside the container — browser CORS still allows localhost origins by default.

For a server running locally on your machine (accessible only from localhost):

docker run --init --pull=always -p 127.0.0.1:8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  -e SONARQUBE_TOKEN="<init-token>" \
  -e SONARQUBE_ORG="<your-org>" \
  sonarsource/sonarqube-mcp

For a server accessible from the network (remote deployments):

docker run --init --pull=always -p 8443:8443 \
  -v $(pwd)/keystore.p12:/etc/ssl/mcp/keystore.p12:ro \
  -e SONARQUBE_TRANSPORT=https \
  -e SONARQUBE_HTTP_HOST=0.0.0.0 \
  -e SONARQUBE_HTTP_PORT=8443 \
  -e SONARQUBE_TOKEN="<init-token>" \
  -e SONARQUBE_ORG="<your-org>" \
  sonarsource/sonarqube-mcp

Client Configuration (SonarQube Cloud):

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_ORG": "<your-org>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Client Configuration (SonarQube Server):

{
  "mcpServers": {
    "sonarqube-https": {
      "url": "https://your-server:8443/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>",
        "SONARQUBE_TOOLSETS": "issues,quality-gates",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Note: SONARQUBE_TOOLSETS and SONARQUBE_READ_ONLY are optional per-request headers that narrow the server-level tool set for that specific request. They can only reduce scope — they cannot enable toolsets or lift restrictions beyond what the server was launched with.

Note: For local development, use Stdio transport instead (the default). HTTPS Streamable HTTP is intended for multi-user production deployments with proper SSL certificates.

Service Endpoints

When running in Streamable HTTP mode (http or https), the server exposes a few unauthenticated service endpoints in addition to the MCP endpoint at /mcp. These are intended for service-to-service use (monitoring, orchestration, client compatibility checks) and do not require an Authorization header.

Endpoint	Method	Description	Example response
/health	GET	Liveness probe. Returns 200 OK with an empty body once the server is accepting requests.	(empty body)
/info	GET	Returns the MCP server version as JSON. Useful for verifying the deployed server version.	{"version":"1.16.0"}

These endpoints are not available when running with the Stdio transport.

Custom Certificates

If your SonarQube Server uses a self-signed certificate or a certificate from a private Certificate Authority (CA), you can add custom certificates to the container that will automatically be installed.

Using Volume Mount

Mount a directory containing your certificates when running the container:

docker run --init --pull=always -i --rm \
  -v /path/t