# SonarQube plugin

> Sonar's plugin puts SonarQube in your agent's coding loop: quality gates, issues, coverage, dependency risks and secrets scanning.

Sonar's own plugin brings SonarQube into your coding agent. It adds skills and a reviewer agent that check quality gates, issues, coverage, duplication and dependency risks, and it wires up the SonarQube MCP Server and the SonarQube CLI, so the code your agent writes is checked against the same rules as your team's.

What its skills do
- Set everything up with /sonarqube:sonar-integrate: install or update the SonarQube CLI, sign in, and connect the MCP server and hooks
- List your projects, and search issues by project, branch, pull request or severity
- Fix a specific issue by its rule key and location
- Show a quality gate's status, with each condition and the worst offenders
- Analyze a file for quality and security issues
- Find files with low test coverage and the lines left uncovered, and find duplicated code
- Search dependency risks, and triage them by whether the CVE is reachable, with optional package fixes
- A sonarqube-reviewer agent combines these into one review of a pull request or diff, without editing code itself

How to install it
In Claude Code, run /plugin install sonarqube@claude-plugins-official, then /sonarqube:sonar-integrate. Sonar also publishes it for GitHub Copilot CLI, Cursor, Codex, Antigravity, Factory Droid and Kiro, and as a Gemini CLI extension, which Sonar now calls legacy in favour of Antigravity.

How it connects
It needs a SonarQube account (SonarQube Cloud, Server or Community Build), the SonarQube CLI (sonar), and Docker, Podman or Nerdctl for the MCP server image. Sign in once with sonar auth login, which opens your browser and keeps your credentials in your OS keychain; the MCP server uses that login. In Claude Code, the integration also adds hooks for secrets scanning and, when your SonarQube Cloud organization has Vortex analysis, analysis after each edit.

Good to know
- The plugin's session-start hook needs Node.js.
- Some features, such as Vortex analysis, depend on your SonarQube Cloud organization's settings.
- It's licensed under Sonar's SSAL-1.0.

- Type: Plugin
- Made by: sonarsource
- Category: Security
- Formats: Claude plugins, Extensions
- Version: latest
- Website: https://www.sonarsource.com/
- Source: https://github.com/sonarsource/sonarqube-agent-plugins
- Page: https://pluginboard.ai/plugins/sonarqube-plugin

## Works with

- Claude
- GitHub Copilot
- Claude Code
- Gemini CLI
- OpenClaw

## Install

### Claude

In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter anthropics/claude-plugins-official, then add sonarqube

### Claude Code

In Claude Code:

```text
/plugin marketplace add anthropics/claude-plugins-official
/plugin install sonarqube@claude-plugins-official
```

### Gemini CLI

Run in your terminal:

```shell
gemini extensions install https://github.com/SonarSource/sonarqube-agent-plugins
```

---
From Pluginboard (https://pluginboard.ai).