mcp-sonarqube-legacy

An MCP (Model Context Protocol) server for legacy SonarQube servers (9.x). It exposes quality gates, issues, measures, security hotspots, rules, and system info from the SonarQube Web API as MCP tools.

The official SonarSource SonarQube MCP requires SonarQube Server 2025.1+. This package is designed for teams still on the 9.9 LTS line, using only Web API endpoints verified to work with a standard USER token on SonarQube 9.9.3.

Installation

Requires Node.js 18+.

npx mcp-sonarqube-legacy@latest

Configuration

The server reads two environment variables:

| Variable | Required | Description | | ------------------- | -------- | ------------------------------------------------------ | | SONARQUBE_URL | yes | Base URL of the SonarQube server (no trailing slash). | | SONARQUBE_TOKEN | yes | SonarQube USER token (generate via My Account → Security). |

Cursor setup

Add to ~/.cursor/mcp.json (or your project-level .cursor/mcp.json):

{
  "mcpServers": {
    "sonarqube": {
      "command": "npx",
      "args": ["-y", "mcp-sonarqube-legacy@latest"],
      "env": {
        "SONARQUBE_URL": "https://sonarqube.example.com",
        "SONARQUBE_TOKEN": "squ_xxx"
      }
    }
  }
}

Cursor also forwards variables from ~/.cursor/.env.cursor, so you can keep the token there instead.

Tools

| Tool | Endpoint | Purpose | | --------------------------- | ------------------------------------ | ------------------------------------------------- | | get_quality_gate_status | /api/qualitygates/project_status | Quality gate status for a project/branch/PR. | | list_quality_gates | /api/qualitygates/list | List all quality gates. | | search_issues | /api/issues/search | Search issues with filters (severity, type, ...). | | get_component_measures | /api/measures/component | Metrics for a project/component. | | show_rule | /api/rules/show | Details for a specific rule. | | search_rules | /api/rules/search | Search rules by language/query. | | search_metrics | /api/metrics/search | Available SonarQube metrics. | | list_languages | /api/languages/list | Supported programming languages. | | search_hotspots | /api/hotspots/search | Security hotspots for a project. | | list_pull_requests | /api/project_pull_requests/list | Pull requests analyzed for a project. | | get_system_status | /api/system/status | Server status and version. | | ping_system | /api/system/ping | Liveness check. |

Compatibility

Tested against SonarQube 9.9.3 LTS. All tools use endpoints that return 200 with a standard USER token. Admin-only endpoints (/api/system/health, /api/system/info, /api/projects/search, webhooks, ...) are intentionally excluded.

Development

npm install
npm run build
SONARQUBE_URL=... SONARQUBE_TOKEN=... npm start

License

MIT