Sonar's plugin puts SonarQube in your agent's coding loop: quality gates, issues, coverage, dependency risks and secrets scanning.
by sonarsource· SecurityUnclaimed · Yours? Claim it
4 images
About
Sonar's own plugin brings SonarQube into your coding agent. It adds skills and a reviewer agent that check quality gates, issues, coverage, duplication and dependency risks, and it wires up the SonarQube MCP Server and the SonarQube CLI, so the code your agent writes is checked against the same rules as your team's. What its skills do - Set everything up with /sonarqube:sonar-integrate: install or update the SonarQube CLI, sign in, and connect the MCP server and hooks - List your projects, and search issues by project, branch, pull request or severity - Fix a specific issue by its rule key and location - Show a quality gate's status, with each condition and the worst offenders - Analyze a file for quality and security issues - Find files with low test coverage and the lines left uncovered, and find duplicated code - Search dependency risks, and triage them by whether the CVE is reachable, with optional package fixes - A sonarqube-reviewer agent combines these into one review of a pull request or diff, without editing code itself How to install it In Claude Code, run /plugin install sonarqube@claude-plugins-official, then /sonarqube:sonar-integrate. Sonar also publishes it for GitHub Copilot CLI, Cursor, Codex, Antigravity, Factory Droid and Kiro, and as a Gemini CLI extension, which Sonar now calls legacy in favour of Antigravity. How it connects It needs a SonarQube account (SonarQube Cloud, Server or Community Build), the SonarQube CLI (sonar), and Docker, Podman or Nerdctl for the MCP server image. Sign in once with sonar auth login, which opens your browser and keeps your credentials in your OS keychain; the MCP server uses that login. In Claude Code, the integration also adds hooks for secrets scanning and, when your SonarQube Cloud organization has Vortex analysis, analysis after each edit. Good to know - The plugin's session-start hook needs Node.js. - Some features, such as Vortex analysis, depend on your SonarQube Cloud organization's settings. - It's licensed under Sonar's SSAL-1.0.
Once it’s added
“Analyze my code for issues.”
“Show open SonarQube findings for this project.”
“Is the quality gate passing on main?”
“Check my coverage and show the files with the least.”
“Fix python:S2077 in src/auth/login.py at line 34.”
“Review my changes with SonarQube before I merge.”
Before you add it
Reads only
Quality gate status for projects, branches and pull requests · Issues, coverage, duplications and dependency risks · Analysis results for the files you're working on
Makes changes · your agent can ask first
Fixes SonarQube issues in your code · Installs the SonarQube CLI, MCP server and hooks when you run its setup skill · Can bundle package fixes for confirmed dependency risks
From people who use it
Step by step
Nothing new reaches your agent until a person has looked at it.
No reviews yet. Used SonarQube plugin? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
/plugin marketplace add anthropics/claude-plugins-official /plugin install sonarqube@claude-plugins-official
Runs on your machine.
gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins
Scanned and passed · checked 6 h ago
Nobody has shared how they use SonarQube plugin yet.
Plugins people install alongside SonarQube plugin.
Scanned on every change, and again when our rules improve.
Claude CodeSupported
Gemini CLISupportedTell us and a person on the trust team will look at it. Or email [email protected].
Plugins people install alongside SonarQube plugin.
Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.
Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.
Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.
Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.
Security scan
Passed
Safe to install in every agent it supports. Claude plugins, Extensions.
