sonar-local-cli

Run real SonarQube/SonarCloud Connected Mode analysis from the terminal — no Java pre-install, no Docker, no MCP server. On first run it downloads a portable JRE (Eclipse Temurin) and the analysis engine (pavel-zeman/sonarlint-cli, which drives the same sonarlint-core/sonarlint-language-server engine the SonarLint IDE plugins use), caches both under ~/.sonar-local-cli, then runs the analysis synced against your project's real quality profile.

Why

• SonarLint IDE plugins are the fastest way to see issues, but they're IDE-only — no CLI, no CI, no "run this on a machine without the extension installed."
• The official sonar CLI (SonarSource/sonarqube-cli) needs "Vortex" (SonarCloud's server-side AI analysis) for anything beyond secrets scanning — not available on every plan.
• SonarCloud/SonarQube MCP servers are great for ad-hoc snippet checks, but full project analysis via their tools can hit plan-tier restrictions (e.g. per-branch issue queries), and they depend on an MCP client + often Docker being set up and running.

This tool sidesteps all three: it's a thin wrapper that gets a real, Connected-Mode-synced local analysis with a single command, on any machine with Node ≥18.

Usage

npx sonar-local-cli \
  --token <your-sonarcloud-token> \
  --org <your-org-key> \
  --project <your-project-key> \
  --sources backend/app,src

Or reuse an existing sonar-project.properties:

npx sonar-local-cli --token <your-token> --properties ./sonar-project.properties

Combine --properties with --sources/--tests to narrow just those two settings for a fast, scoped run — everything else in the file (projectKey, exclusions, etc.) stays as-is:

npx sonar-local-cli --token <your-token> \
  --properties ./sonar-project.properties \
  --sources backend/app/SomeModule \
  --tests backend/tests/SomeModule

Avoiding a manual --token/$SONAR_TOKEN every time

Drop a .env file (gitignored — never commit a real token) in the current directory:

SONAR_TOKEN=your-token-here
SONAR_ORG=your-org-key

It's picked up automatically — no flag needed. Point at a different file with --env-file <path>. Uses Node's built-in env-file loader, no extra dependency; requires Node ≥21.7.0 (still marked experimental upstream as of this writing, but functions normally).

--token can also be set via $SONAR_TOKEN, --org via $SONAR_ORG — keeps the token out of shell history in CI or scripts.

Run npx sonar-local-cli --help for the full flag list.

Note: --sources/--tests (and the equivalent properties-file keys) must be directories, not individual file paths — that's a constraint of the underlying sonarlint-cli engine.

What gets cached where

~/.sonar-local-cli/
├── jre/21-<os>-<arch>/     # portable JRE, one-time download (~45MB)
└── jar/sonarlint-cli-*.jar # the analysis engine, one-time download (~40MB)

Delete ~/.sonar-local-cli any time to force a clean re-download.

Output

By default, prints just the issues found — one line each (severity, file:line, rule, message) — plus a final count. The underlying engine's own startup/analyzer/rule-documentation logging (Java, Spring, TeamCity ##teamcity[...] service messages) is suppressed.

WARNING       pos/src/components/Foo.tsx:83  [typescript:S9011]  Add an explicit "type" attribute to this button.
WEAK WARNING  pos/src/components/Foo.tsx:138  [typescript:S6759]  Mark the props of the component as read-only.

2 issue(s), 0 security hotspot(s).

Pass --verbose/-v to stream the engine's raw output instead — useful for debugging something that isn't a lint finding. On a genuine failure (bad config, crash, etc.) the raw output is always shown, regardless of --verbose, since a filtered issue list isn't useful for debugging a crash.

The process exit code reflects the underlying tool's own exit — a clean run and a run that found issues both exit 0; only a real failure exits non-zero.

License

MIT for this wrapper. It downloads and invokes pavel-zeman/sonarlint-cli (LGPL-3.0) and Eclipse Temurin (GPLv2 with the Classpath Exception) as separate, unmodified external processes/binaries fetched fresh from their own official sources at run time — never bundled or redistributed inside this package.