sertaykabuk/sonarqube-mcp

SonarQube MCP Server

This project packages a Model Context Protocol (MCP) server for AI coding agents that need to investigate and remediate SonarQube issues. The server is built with FastMCP and wraps the official SonarQube REST API to deliver:

• High-signal issue search results that highlight severity, ownership, and file locations.
• Detailed remediation context for a specific SonarQube issue, including the associated rule description and fix suggestions.
• Direct access to rule metadata for bespoke workflows.

🧠 Goal: Provide enough structured context for an agent to understand an issue, locate the offending code, and apply the recommended fix without visiting the SonarQube UI.

Requirements

• Python 3.12+
• Access to a SonarQube instance (cloud or self-hosted) with an API token that can read issues and rules.
• The fastmcp package is already included; no MCP client is bundled.

Configuration

You must configure the base URL of your SonarQube instance. Authentication can be provided in two ways:

1. Per-user Bearer token via an Authorization: Bearer HTTP header when using the HTTP/SSE transports (recommended – allows each user/agent to have least-privilege access).
2. A static environment variable token (SONARQUBE_TOKEN) used as a fallback when no header is present (needed for stdio transport where HTTP headers are not available).

Set the following environment variables before starting the server:

You can store these in a .env file or provide them through your process manager.

Installation

uv sync

For development and testing dependencies:

uv sync --extra test

Running the server

By default the server runs over stdio, which is ideal for local MCP clients:

uv run python -m src.main

To expose an HTTP transport, add the appropriate options when you run it:

uv run python -m src.main --transport http --host 0.0.0.0 --port 8765

Supported transports mirror the ones from FastMCP (stdio, http, sse). When using http/sse, send an Authorization header with each request so the server can perform SonarQube calls on behalf of that user:

Authorization: Bearer squ_XXXXXXXXXXXXXXXXXXXXXXXXXXXX

If the header is omitted the server will fall back to SONARQUBE_TOKEN.

Header-based auth example

The server internally inspects incoming headers (via FastMCP’s get_http_headers) on every tool call. A simplified example: