Developer Tools

SonarCloud MCP Server

Connect your account, then chat with AI to run tools.

Let AI agents read SonarCloud organizations, projects, issues, quality gates, security hotspots, and measures — from release readiness checks to blocker triage in chat.

Best forEngineering ManagersDevOps LeadsPlatform EngineersSecurity Champions

Try this workflow

Discover org and projects

List SonarCloud organizations I can access, then show projects in my main org with their keys and last analysis status.

Start chatting
Managed
30 tools
Agent guide included

Opens MCPBundles Studio with this server selected. After sign-in, chat and run tools from the same thread.

Browse all tools

What you can do with SonarCloud

Built for

Engineering Managers, DevOps Leads, Platform Engineers, Security Champions, Staff Engineers

Example workflows

Discover org and projects

Grounds every later question in the correct organization and project keys.

Try this

List SonarCloud organizations I can access, then show projects in my main org with their keys and last analysis status.

Release gate check

Answers ship/no-ship questions without opening the SonarCloud UI.

Try this

For project myorg_myrepo on main, what is the quality gate status and summary measures for bugs, vulnerabilities, coverage, and code smells?

Blocker triage

Turns org-wide issue search into a standup-ready brief.

Try this

Search open BLOCKER and CRITICAL issues in my SonarCloud organization, grouped by project, and list the top ten by severity.

Security hotspot review

Surfaces human-review security work separate from automatic issue rules.

Try this

List TO_REVIEW security hotspots for myorg_myrepo on the main branch and summarize file paths and review status.

Context to know first

What can AI agents do with SonarCloud on MCPBundles?

Agents can discover organizations and projects, search issues and security hotspots, read quality gate status, inspect quality profiles and rules, fetch project measures, list branches and pull requests, and pull source snippets for findings — using read-only SonarCloud Web API access from your connected token.

How do I connect SonarCloud?

Sign in to MCPBundles, open the SonarCloud skill page, and paste a SonarCloud personal access token from your account security settings. MCPBundles stores the token securely and sends it on each agent request.

Do I need a SonarCloud organization before using this?

Yes. Most project, issue, and gate queries need an organization key from SonarCloud. Agents can call list_organizations first when you are not sure which key to use.

Related editorial

SonarCloud Code Quality Workflows with AI

How AI agents can triage issues, read quality gate status, review security hotspots, and summarize project measures before release.

Read article

AI Skill
SKILL.md

Domain knowledge for SonarCloud — workflow patterns, data models, and gotchas for your AI agent.

SonarCloud

SonarCloud analyzes code quality and security. Organizations scope everything; projects are analyzed repositories; issues and hotspots are findings; measures are metric values; quality gates and profiles define pass/fail and rule sets.

Auth and API

  • Read-only Web API access over HTTPS; requests use the saved connection’s bearer token on Authorization.
  • SonarCloud does not offer a third-party OAuth app for API access — the token is a personal access token from the SonarCloud account.

Capabilities

  • Account: resolve which SonarCloud user the token represents.
  • Organization: list organizations, groups, users, project tags, and favorites for an organization key.
  • Projects: list or fetch projects; browse component trees; list branches, pull requests, and analysis history.
  • Issues: search issues; list tags and authors; read issue changelog for a given issue key.
  • Metrics: list metric definitions; read current measures and measure history for components.
  • Quality gates: list gates; read project gate status; map gates to projects.
  • Quality profiles: search and compare profiles; list projects bound to a profile.
  • Rules: search or fetch rule metadata for an organization.
  • Hotspots: search security hotspots; fetch one hotspot by key.
  • Source: read source lines around a finding; show duplication blocks for a component.

Data model

  • Organization key — tenant boundary (sonarcloud.io/organizations/{key}).
  • Project key — usually {organization}_{repository}; required for project-scoped reads.
  • Component key — project, directory, or file key from the component tree.
  • Issue key — returned on issue search; required for changelog reads.
  • Hotspot key — returned on hotspot search; required for single-hotspot reads.
  • Quality gate id — numeric id from the organization’s gate list.
  • Profile key — returned when listing or searching quality profiles.

Typical workflow

  1. Resolve the authenticated user, then list organizations to obtain organization keys.
  2. List or fetch projects for the target organization; note each project_key.
  3. Search issues or security hotspots at organization or project scope.
  4. For release readiness, read quality gate status and summary measures (bugs, vulnerabilities, coverage, smells) on the branch or pull request that matters.

Gotchas

  • Discover org first when the organization key is unknown.
  • Empty project list until a repository is imported in the SonarCloud UI.
  • Project-scoped reads (branches, pull requests, hotspots, measures, source snippets) need a real project_key.
  • Branch / pull request — many reads accept optional branch or pull request parameters for non-main analysis.
  • Read-only — issue transitions, gate edits, and profile changes are not exposed; triage and explain only.

Tools in this Server (30)

Compare Quality Profiles

Compare two SonarCloud quality profiles and return rules that differ, are only on the left, or only on the right.

Get Component Tree

Return the SonarCloud component hierarchy beneath a project or module, including directories, files, and test units when requested.

Get Current User

Get the SonarCloud profile for the connected personal access token, including login, name, email, and organization group memberships.

Get Hotspot

Get full details for one SonarCloud security hotspot, including message, component location, and review status.

Get Issue Changelog

Get the SonarCloud change history for one issue, including status, severity, assignee, and comment transitions.

Get Measures

Get SonarCloud quality measures for one project. Pass metric_keys from the global metrics catalog or rely on the default quality summary set.

Get Project Quality Gate Status

Get the computed SonarCloud quality gate status for a project, branch, pull request, or specific analysis.

Get Projects

List or search SonarCloud projects for an organization, or fetch one project when project_key is set. Project keys usually look like organization_repo...

Get Quality Gate By Project

Return the SonarCloud quality gate associated with a project within an organization.

Get Quality Gates

List SonarCloud quality gates for an organization, or fetch one gate and its conditions when gate_id is provided.

Get Rules

Search SonarCloud static analysis rules for an organization, or fetch one rule when rule_key is set. Optionally scope list mode to a quality profile.

Get Source Lines

Return SonarCloud source code lines for a file component within a line range. Traverse the project component tree to discover file component keys.

List Favorites

List SonarCloud components bookmarked as favorites by the connected user within an organization.

List Issue Authors

List authors who introduced issues in a SonarCloud project. Useful before filtering issue searches by author.

List Issue Tags

List issue tags already used in a SonarCloud organization or project. Use returned tags when filtering issue searches.

List Metrics

List available SonarCloud metric definitions (coverage, complexity, issues, etc.). Returns the global metrics catalog and does not require an organiza...

List Organization Groups

List SonarCloud user groups for an organization, including member counts and default-group flags.

List Organizations

List SonarCloud organizations visible to the connected account. Use the returned organization key across project, issue, quality gate, and quality pro...

List Organization Users

List SonarCloud users and their organization-level permissions. Useful for auditing who can administer quality gates and projects.

List Project Branches

List branches SonarCloud has analyzed for a project, including main-branch and long-lived branch metadata.

List Project Tags

List project tags already used in a SonarCloud organization. Tags help filter project listings and issue searches.

List Pull Requests

List pull requests SonarCloud has analyzed for a project, including status and quality gate results when available.

List Quality Profile Projects

List SonarCloud projects associated with a quality profile within an organization.

Search Hotspots

Search SonarCloud security hotspots for a project. Hotspots are security-sensitive code locations that require human review.

Search Issues

Search SonarCloud issues for an organization or project keys. Filter by severity, type, status, branch, pull request, tags, and creation date.

Search Measure History

Search historical SonarCloud measure values for a component over a date range. Useful for trend charts of bugs, coverage, or technical debt.

Search Project Analyses

Search recent SonarCloud analyses for a project. Each analysis id can qualify a project quality gate status lookup.

Search Quality Gate Projects

Search SonarCloud projects that are linked to or excluded from a quality gate.

Search Quality Profiles

Search SonarCloud quality profiles (rule sets) for an organization. Filter by language, defaults-only, or profiles linked to a project.

Show Duplications

Return duplicated code blocks detected by SonarCloud for a file or project component.

Frequently Asked Questions

What can AI agents do with SonarCloud on MCPBundles?

Agents can discover organizations and projects, search issues and security hotspots, read quality gate status, inspect quality profiles and rules, fetch project measures, list branches and pull requests, and pull source snippets for findings — using read-only SonarCloud Web API access from your connected token.

How do I connect SonarCloud?

Sign in to MCPBundles, open the SonarCloud skill page, and paste a SonarCloud personal access token from your account security settings. MCPBundles stores the token securely and sends it on each agent request.

Do I need a SonarCloud organization before using this?

Yes. Most project, issue, and gate queries need an organization key from SonarCloud. Agents can call list_organizations first when you are not sure which key to use.

Can agents fix or close SonarCloud issues?

This integration is read-only. Agents can search and explain findings, gate status, and measures, but cannot transition issues, edit quality gates, or change profiles.

Who is this for?

Teams that already run SonarCloud in CI and want release readiness, security review, and quality summaries in the same chat where they debug production — without exporting dashboards or clicking through every project.

How do I connect SonarCloud to my AI agent?

Add the MCPBundles server URL to your MCP client configuration (Claude Desktop, Cursor, VS Code, etc.). The URL format is: https://mcp.mcpbundles.com/bundle/sonar-cloud. Authentication is handled automatically.

How many tools does SonarCloud provide?

SonarCloud provides 30 tools that can be called by AI agents, along with a SKILL.md that gives your AI agent domain knowledge about when and how to use them.

What authentication does SonarCloud require?

SonarCloud uses API Key. SonarCloud requires credentials. Connect via MCPBundles and authentication is handled automatically.

Setup Instructions

Connect SonarCloud to any MCP client in minutes

MCP URL
https://mcp.mcpbundles.com/bundle/sonar-cloud
Claude.aiCursorVS CodeVS Code InsidersGooseLM StudioCherry StudioChatGPT

One-click install:

Install on Claude.aiInstall for organization (admins)

The link prefills the Add custom connector dialog — you still review the values and click Add, then Connect to complete OAuth.

Or add manually

  1. Open claude.ai → Settings → Connectors.
  2. Click the + button and choose Add custom connector.
  3. Set Name to SonarCloud and paste the MCP URL into Remote MCP server URL.
  4. Click Add. SonarCloud will appear under Not connected — select it and click Connect to complete OAuth.
Name: SonarCloud
Remote MCP server URL: https://mcp.mcpbundles.com/bundle/sonar-cloud
Authentication: OAuth

Custom connectors at claude.ai require a paid Claude plan (Pro, Max, Team, or Enterprise).

Related MCP Servers

More developer tools integrations you might like

Simplecast

Simplecast is a podcast hosting and analytics platform that enables users to publish podcasts, acces...

9 tools
Developer Tools
UserVoice

Uservoice provides a customer feedback and product management platform that enables businesses to co...

33 tools
Developer Tools
Workable

Workable provides a recruitment software platform that helps companies manage the hiring process, fr...

4 tools
Developer Tools
BoldSign

BoldSign is an electronic signature platform that enables users to securely sign documents online, m...

13 tools
Developer Tools
PostgreSQL

Complete PostgreSQL database toolkit. All 38 tools for querying, schema management, performance anal...

38 tools
Developer Tools
LaunchDarkly

LaunchDarkly is a feature management platform that enables software teams to manage, control, and ex...

7 tools
Developer Tools

Ready to use SonarCloud?

Sign in to connect your credentials and start running tools from the chat.

SonarCloud MCP Server & Skill