Sonarqube
Automatically enforce SonarQube code quality and security in the agent coding loop — 7,000+ rules, secrets scanning, agentic analysis, and quality gates across 40+ languages. PostToolUse hooks run analysis after every file edit. Pre-tool secrets scanning prevents 450+ patterns from reaching the LLM. Slash commands give on-demand access to quality gate status, coverage, duplication, and dependency risks. Includes SonarQube CLI, MCP Server, skills, hooks, and slash commands.
Skills (9)
Claude uses these on its own when your request matches.
- sonar-analyzeAnalyze a file for quality and security issues using SonarQube
- sonar-coverageFind files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)
- sonar-dependency-risksSearch for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)
- sonar-duplicationFind files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)
- sonar-fix-issueFix a specific SonarQube issue in code by rule key and location
- sonar-integrateInstalls sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube.
- sonar-list-issuesSearch and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)
- sonar-list-projectsList SonarQube projects accessible to the current user
- sonar-quality-gateShow SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project key optional — resolved from `sonar-project.properties` or the MCP integration default.
Agents (1)
Specialized helpers Claude can hand work to.
Install
Run in your terminal
claude plugin install sonarqube@claude-plugins-officialClaude Code already includes the claude-plugins-official marketplace, so this installs directly. Start a new Claude Code session to use it.
Already in a Claude Code session?
Install
/plugin install sonarqube@claude-plugins-officialPublished in Anthropic's claude-plugins-official marketplace (anthropics/claude-plugins-official).
Related plugins
- 1SSecurity GuidanceSecurity review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.242kmarketplace installs
- 2
SemgrepSemgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.20kmarketplace installs
- 3CClaude SecurityDeep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.8.6kmarketplace installs
- 4
Sonatype GuideSonatype Guide MCP server for software supply chain intelligence and dependency security. Analyze dependencies for vulnerabilities, get secure version recommendations, and check component quality metrics.7.5kmarketplace installs
- 5
Aikido SecurityAikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.7.3kmarketplace installs
- 6
Auth0Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.4.7kmarketplace installs