SonarQube Cloud MCP server

Endpoint: https://api.sonarcloud.io/mcp · Authentication: Bearer token

Reads SonarQube Cloud issues, quality gates, measures, coverage, security hotspots, and dependency risks. Requires a SonarQube Cloud user token as a bearer token and an organization key header.

Test it live Run the release-readiness report

How do I authenticate?

Create a scoped provider token and supply it using the credential header and value format documented in the client setup below. Keep credentials out of shared URLs and logs.

Authentication and connection guide

Connection specification

Remote endpoint: https://api.sonarcloud.io/mcp
Browser access: Not yet measured
Declared MCP transport: Streamable HTTP
Live-validated MCP transport: Not yet verified — Latest validation did not verify a transport
Declared authentication: Bearer token
Detected authentication: Bearer token detected or retained from publisher evidence
Alternative endpoint: https://api.sonarqube.us/mcp — Use for SonarQube Cloud US region organizations (Bearer token)
Protocol lifecycle: Not yet negotiated
Required header: Authorization — SonarQube Cloud user token: Bearer <SONARQUBE_TOKEN>
Required header: SONARQUBE_ORG — SonarQube Cloud organization key
Category: Security

Product documentation · Source repository · Official listing documentation

More Security MCP servers · Browse all MCP servers · Test this endpoint in the MCP Playground

Authorization setup

bearer token required

Use the publisher-documented bearer token route. Keep the credential in protected client storage and replace only the named placeholder at connection time.

Safe header template: Bearer <SONARQUBE_TOKEN>. Replace only the named placeholder in protected client configuration.

Publisher documentation

Connect it

Live-validated endpoint: https://api.sonarcloud.io/mcp · Streamable HTTP. Bearer token authentication uses a named environment placeholder.

Agent prompt for Claude Code or Codex

Add the SonarQube Cloud MCP server to my MCP client configuration and verify that it works.

What it is: Reads SonarQube Cloud issues, quality gates, measures, coverage, security hotspots, and dependency risks. Requires a SonarQube Cloud user token as a bearer token and an organization key header.
Server URL: https://api.sonarcloud.io/mcp
Transport: Streamable HTTP (remote MCP server, no local install).
Authentication: Bearer token. Bearer token authentication uses a named environment placeholder.
Tools: not yet observed by mcptest; tools/list will show them.
Reference: https://mcptest.io/servers/sonarqube-cloud/

Steps:
1. Work out which MCP client I use (Claude Code, Codex, Cursor, VS Code or another) and add the server under the name "sonarqube-cloud" in that client's MCP configuration, user scope unless I ask otherwise.
   Claude Code: claude mcp add --transport http --scope user --header 'Authorization: Bearer '"${SONARQUBE_TOKEN}" --header 'SONARQUBE_ORG: '"${SONARQUBE_ORG_KEY}" 'sonarqube-cloud' 'https://api.sonarcloud.io/mcp'
   Other clients: use the setup for that client on the reference page.
2. Never write a credential value into a file that could be committed; reference an environment variable or the client's secret store, and ask me for any value you need.
3. Verify: connect to the server and call tools/list. Confirm the tools above are listed, and report any sign-in step I still have to complete.

Claude Code setup

Run in a terminal. This user-scoped entry is available across projects.

claude mcp add --transport http --scope user --header 'Authorization: Bearer '"${SONARQUBE_TOKEN}" --header 'SONARQUBE_ORG: '"${SONARQUBE_ORG_KEY}" 'sonarqube-cloud' 'https://api.sonarcloud.io/mcp'

Store SONARQUBE_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <SONARQUBE_TOKEN>.
Set SONARQUBE_ORG_KEY to the publisher-required value for the SONARQUBE_ORG header.

Codex CLI setup

Add to ~/.codex/config.toml, then set SONARQUBE_TOKEN_HEADER to the complete Authorization header value, including the required syntax Bearer <credential>; SONARQUBE_ORG_KEY_HEADER to the raw credential value, which is the complete SONARQUBE_ORG header value.

[mcp_servers.sonarqube-cloud]
url = "https://api.sonarcloud.io/mcp"
env_http_headers = { "Authorization" = "SONARQUBE_TOKEN_HEADER", "SONARQUBE_ORG" = "SONARQUBE_ORG_KEY_HEADER" }

Store SONARQUBE_TOKEN_HEADER in your operating system keychain, secret manager, or protected environment; never commit the value. Set it to the complete Authorization header value, including the required syntax Bearer <credential>.
Store SONARQUBE_ORG_KEY_HEADER in your operating system keychain, secret manager, or protected environment; never commit the value. Set it to the raw credential value, which is the complete SONARQUBE_ORG header value.

Cursor setup

Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.

{
  "mcpServers": {
    "sonarqube-cloud": {
      "url": "https://api.sonarcloud.io/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SONARQUBE_TOKEN}",
        "SONARQUBE_ORG": "${env:SONARQUBE_ORG_KEY}"
      }
    }
  }
}

Store SONARQUBE_TOKEN in your operating system keychain, secret manager, or protected environment; never commit the value. The Authorization header syntax is Bearer <SONARQUBE_TOKEN>.
Set SONARQUBE_ORG_KEY to the publisher-required value for the SONARQUBE_ORG header.

VS Code setup

Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.

{
  "servers": {
    "sonarqube-cloud": {
      "type": "http",
      "url": "https://api.sonarcloud.io/mcp",
      "headers": {
        "Authorization": "Bearer ${input:sonarqube_token}",
        "SONARQUBE_ORG": "${input:sonarqube_org_key}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "sonarqube_token",
      "description": "SONARQUBE_TOKEN for SonarQube Cloud",
      "password": true
    },
    {
      "type": "promptString",
      "id": "sonarqube_org_key",
      "description": "SONARQUBE_ORG_KEY for SonarQube Cloud",
      "password": false
    }
  ]
}

VS Code requests SONARQUBE_TOKEN as a masked input; use a secret manager and do not put a default value in mcp.json. The Authorization syntax remains Bearer <SONARQUBE_TOKEN>.
VS Code requests the publisher-required SONARQUBE_ORG value through the SONARQUBE_ORG_KEY input.

Claude setup

Add the endpoint above in Claude:

Customize > Connectors > Add custom connector
Team/Enterprise: Organization settings > Connectors > Add > Custom > Web

Claude Desktop setup

Add the endpoint above in Claude Desktop:

Remote: Customize > Connectors (same as claude.ai)
Local: Settings > Developer > Edit Config, or Settings > Extensions for .mcpb files
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), local servers only

ChatGPT setup

Add the endpoint above in ChatGPT:

ChatGPT web: Plugins > Add custom MCP server, then configure authentication and accept the risk warning

Windsurf setup

Add the endpoint above in Windsurf:

~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), serverUrl or url
Cascade panel > ... > MCPs > Open MCP config file

Gemini CLI setup

Add the endpoint above in Gemini CLI:

gemini mcp add --transport http <name> <url>
~/.gemini/settings.json (user) or .gemini/settings.json (project), mcpServers

MCP SDK setup

Add the endpoint above in MCP SDK:

Programmatic: new Client(...).connect(new StreamableHTTPClientTransport(url))

Notes for every client

Required header SONARQUBE_ORG: SonarQube Cloud organization key
Alternative endpoint: https://api.sonarqube.us/mcp — Use for SonarQube Cloud US region organizations.

Client compatibility

Client	Status	Why
Claude Code	Supported	Claude Code supports Streamable HTTP servers and bearer-token headers.
Codex	Supported	Codex supports Streamable HTTP servers and bearer-token headers.
Cursor	Supported	Cursor supports Streamable HTTP servers and bearer-token headers.
VS Code	Supported	VS Code supports Streamable HTTP servers and bearer-token headers.
Claude	Partial	Claude supports bearer-token headers only in limited availability. Request-header authentication is in beta and available to a limited set of organizations.
Claude Desktop	Partial	Claude Desktop supports bearer-token headers only in limited availability. Request-header authentication is in beta and available to a limited set of organizations.
ChatGPT	Not supported	ChatGPT does not support bearer-token headers. Only the OAuth-issued token is sent; ChatGPT cannot present custom API keys.
Windsurf	Supported	Windsurf supports Streamable HTTP servers and bearer-token headers.
Gemini CLI	Supported	Gemini CLI supports Streamable HTTP servers and bearer-token headers.
MCP SDK	Supported	MCP SDK supports Streamable HTTP servers and bearer-token headers.

Computed from this server's validated transport, protocol and authentication against documented client support. Checks the catalog has not observed are not counted.

Similar servers

Semgrep — A fast, open-source, static analysis tool for finding bugs and enforcing code standards. OAuth 2.1
Cloudflare Audit Logs — Queries Cloudflare account audit logs and summarizes configuration changes for review. Requires Cloudflare OAuth. OAuth 2.1
WorkOS — Manages WorkOS environment resources such as organizations, users, SSO connections, and directories, limited to the signed-in dashboard role. Requires OAuth through WorkOS Connect. OAuth 2.1
Stytch — Manages Stytch project configuration such as redirect URLs, email templates, and other workspace settings. Requires Stytch sign-in through OAuth. OAuth 2.1
Vanta — Lists failing Vanta compliance tests and reads controls, frameworks, evidence, vendors, risks, and vulnerable assets. Requires Vanta sign-in through OAuth. OAuth 2.1
GitGuardian — Scans code for hardcoded secrets and lists and manages GitGuardian secret incidents. Requires GitGuardian sign-in through OAuth. OAuth 2.1

Guides for this server

Watch this server for breaking changes

Share and embed

Maintain SonarQube Cloud? Embed this badge in your README. It follows the latest catalog validation result and links to this server profile.

Markdown

[![Tested on mcptest.io](https://mcptest.io/badge/server/sonarqube-cloud.svg)](https://mcptest.io/servers/sonarqube-cloud/)

HTML

<a href="https://mcptest.io/servers/sonarqube-cloud/"><img src="https://mcptest.io/badge/server/sonarqube-cloud.svg" alt="Tested on mcptest.io"></a>

reStructuredText

.. image:: https://mcptest.io/badge/server/sonarqube-cloud.svg
   :alt: Tested on mcptest.io
   :target: https://mcptest.io/servers/sonarqube-cloud/

Latest validation evidence

Validation status: Online when last tested
Validation checked at: Oct 26, 2026 at 11:07 AM
Validation detail: Authentication challenge at https://api.sonarcloud.io/mcp returned HTTP 401; endpoint was reachable but did not complete an MCP probe; authentication bearer-token

Tool inventory

Requires authorization; inventory not observed

The catalog validator lists tools only on servers that answer without credentials. SonarQube Cloud asks for a bearer token first, so its tools, resources and prompts were not observed. Connect in the Playground with your own credentials to list them.