{
  "markdown": "# SonarQube agent integrations\n\n**Made by [Sonar](https://www.sonarsource.com/)**\n\nSonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.\n\nSonarQube combines deterministic checks with AI-assisted workflows so quality rules apply consistently to code from both developers and agents. Where your stack supports it, analysis and secrets scanning can run inside the agent loop instead of only in CI.\n\n## What do the plugins include\n\nThe Plugin helps agents connect to [SonarQube CLI](https://cli.sonarqube.com/) and [SonarQube MCP Server](https://docs.sonarsource.com/sonarqube-mcp-server) for issue detection, checking project metrics such as test coverage and duplications, fetch dependency risks, etc. Claude Code, Copilot CLI, Codex, and Antigravity (through SonarQube CLI) install agent hooks for secrets scanning and, when entitled, Vortex analysis.\n\nHow to use: Run `/sonarqube:sonar-integrate` after installation to walk through setup — CLI installation, authentication, and wiring up the MCP Server and hooks. From there, use slash commands like `/sonarqube:sonar-quality-gate` to check quality gates or interact naturally with prompts like \"analyze my code for issues,\" \"show open SonarQube findings,\" or \"check my coverage.\" With Vortex analysis enabled, verification happens automatically after each edit with no manual invocation required.\n\n## Prerequisites\n\n- A SonarQube account (**SonarQube Cloud**, **Server**, or **Community Build**). Some features (for example Vortex analysis) depend on your SonarQube Cloud organization settings.\n- **[SonarQube CLI](https://cli.sonarqube.com/)** (`sonar`) on your machine.\n- A **container runtime** (Docker, Podman, or Nerdctl) for the MCP server image.\n\nAuthenticate once with **`sonar auth login`** (browser flow; credentials stay in your OS keychain). The MCP server uses that login.\n\nCheck auth anytime:\n\n```bash\nsonar auth status\n```\n\n---\n\n## How plugins connect to SonarQube\n\n**SonarQube CLI** can wire everything for you:\n\n```bash\nsonar integrate claude        # Claude Code: MCP, hooks, secrets scanning, etc.\nsonar integrate copilot       # GitHub Copilot CLI: MCP, hooks, secrets scanning, etc.\nsonar integrate codex         # Codex: MCP, hooks, secrets scanning, Vortex analysis hook\nsonar integrate antigravity   # Antigravity: hooks, instructions, CAG, MCP patch (after plugin install)\nsonar integrate cursor        # Cursor: MCP, secret-scanning hooks, Vortex analysis instructions\n```\n\nRun these **after** `sonar auth login`. Use the **`/sonarqube:sonar-integrate`** skill if you prefer a guided flow (install/update CLI, login, then integrate).\n\n## Claude Code\n\nInstall from Anthropic's marketplace **`claude-plugins-official`**:\n\n```shell\n/plugin install sonarqube@claude-plugins-official\n```\n\n```shell\nclaude plugin install sonarqube@claude-plugins-official\n```\n\n### One-time setup\n\n- **Node.js** — for the SessionStart hook (`scripts/setup.js`).\n- Install **SonarQube CLI** if needed, then **`/sonarqube:sonar-integrate`** or **`sonar auth login`** + **`sonar integrate claude`**.\n\n`sonar auth login` by scenario:\n\n| Scenario             | Command                                                 |\n|----------------------|---------------------------------------------------------|\n| SonarQube Cloud (EU) | `sonar auth login -o <org-key>`                         |\n| SonarQube Cloud (US) | `sonar auth login -o <org-key> -s https://sonarqube.us` |\n| SonarQube Server     | `sonar auth login -s <server-url>`                      |\n\nOptional: add **`sonar-project.properties`** in the project root with `sonar.projectKey`, sources, etc.\n\n---\n\n## GitHub Copilot CLI\n\nPlugin bundle: **`.github/plugin/`**.\n\n1. Install **sonarqube** from the pre-packaged `awesome-copilot` plugins catalog:\n\n   ```shell\n   /plugin install sonarqube@awesome-copilot\n   ```\n\n2. Run **`sonar integrate copilot`**, or invoke the `/sonarqube:sonar-integrate` skill.\n\nSame workflows as **[Usage](#usage)** once MCP is connected.\n\n---\n\n## Cursor\n\n**`.cursor-plugin/`** with MCP via **`mcp.json`**.\n\n1. Install **SonarQube** plugin through [Cursor's marketplace](https://cursor.com/marketplace/sonarsource):\n\n```\n/add-plugin sonarqube\n```\n\n2. Run **`sonar integrate cursor`**, or invoke the `/sonarqube:sonar-integrate` skill.\n\n---\n\n## Antigravity\n\nRepo-root plugin: **`plugin.json`**, **`mcp_config.json`**, **`rules/sonarqube.md`**, and shared **`skills/`**. Hooks and managed instructions are **not** in the plugin bundle—they are installed by **`sonar integrate antigravity`**.\n\n### Recommended flow (full integration)\n\n```bash\n# 1. Plugin bundle — skills, rules, MCP\nagy plugin install https://github.com/SonarSource/sonarqube-agent-plugins\n\n# 2. Auth + hooks / instructions / CAG / MCP patch\nsonar auth login\nsonar integrate antigravity              # project-scoped (default)\n# sonar integrate antigravity -g         # global (all projects; Vortex analysis skipped)\n```\n\nOr use **`/sonarqube:sonar-integrate`** inside Antigravity for a guided flow. Restart the agent session if MCP tools do not appear.\n\n### Install options\n\n| Option            | Command / path                                | What you get                                            |\n|-------------------|-----------------------------------------------|---------------------------------------------------------|\n| **CLI global**    | `agy plugin install <git-url\\|path\\|archive>` | Plugin copied to `~/.gemini/config/plugins/sonarqube/`  |\n| **IDE workspace** | `<project>/.agents/plugins/sonarqube/`        | Plugin for that workspace only                          |\n| **Monorepo dev**  | Open `sonarqube-agent-plugins` as workspace   | Auto-discovery from repo root — no `agy plugin install` |\n\nInstalling the **whole repo** is acceptable — other agents' dot-folders are inert in Antigravity.\n\n### Migrating from Gemini CLI\n\nGemini CLI is being replaced by Antigravity. Migrate platform config first (layout, skills paths, and cleanup), then update SonarQube as below.\n\nIf you already had the **SonarQube Gemini extension** installed:\n\n```bash\nagy plugin import gemini          # converts legacy extensions → native plugins\nsonar integrate antigravity       # add hooks, instructions, CAG (new vs Gemini)\n```\n\n`agy plugin import gemini` scans legacy Gemini directories and migrates inline `mcpServers` into `mcp_config.json`. Expect output like `✔ mcpServers : 1 server definition migrated to mcp_config.json` for SonarQube.\n\nIf you had custom skills under `.gemini/skills/`, move them to `.agents/skills/`.\n\nAfter verifying Antigravity works, remove any duplicate legacy Gemini extension install if import created a copy.\n\nFor a fresh install, use the [recommended flow](#recommended-flow-full-integration) above.\n\nSame workflows as **[Usage](#usage)** once MCP is connected.\n\n---\n\n## Codex CLI\n\nPlugin bundle: **`.codex-plugin/`** — catalog **`sonar`**, plugin **`sonarqube`** (see **[`.codex-plugin/plugin.json`](.codex-plugin/plugin.json)**).\n\n1. Add **SonarSource/sonarqube-agent-plugins** as a plugin marketplace in Codex CLI:\n\n   ```shell\n   codex plugin marketplace add SonarSource/sonarqube-agent-plugins\n   ```\n2. Install **sonarqube** plugin from that catalog:\n\n   ```shell\n   codex plugin add sonarqube@sonar\n   ```\n\n3. Run **`sonar auth login`**.\n\n4. From your project directory, run **`sonar integrate codex`** (add **`--project <key>`** if needed). This wires MCP in **`.codex/config.toml`**, secrets hooks, and—when your SonarQube Cloud org has Vortex analysis—a **PostToolUse** hook on **`apply_patch`** that runs analysis on the git change set after each edit.\n\nSame workflows as **[Usage](#usage)** once MCP is connected.\n\n---\n\n## Kiro\n\nPlugin includes **MCP configuration** (**`kiro-power/mcp.json`**) that runs the **`mcp/sonarqube`** image and **relies on SonarQube CLI** for authentication—the same **`sonar auth login`** session.\n\n**`sonar auth login`**, then enable the power per Kiro’s documentation.\n\n---\n\n## Gemini CLI *(legacy)*\n\n**`gemini-extension.json`** and **`GEMINI.md`**. **`sonar auth login`** and **[Usage](#usage)**.\n\nMigrate to **[Antigravity](#antigravity)** with **`agy plugin import gemini`** and **`sonar integrate antigravity`** as described above.\n\n---\n## Usage\n\nSkills are the same across agents. Ask in natural language, invoke skills explicitly, or use the **SonarQube MCP** tools your client shows after MCP starts.\n\nOn **Claude Code**, **GitHub Copilot CLI**, and **Cursor**, the plugin also ships a **`sonarqube-reviewer`** agent (`agents/sonarqube-reviewer.agent.md`) that composes the skills below into a single PR/diff review — quality gate, issues, dependency risks, duplication, and coverage — without editing code itself.\n\nMCP reference: [SonarQube MCP Server docs](https://docs.sonarsource.com/sonarqube-mcp-server/).\n\n### Skills\n\n#### Set up\n\n```\n/sonarqube:sonar-integrate\n```\n\n#### List projects\n\n```\n/sonarqube:sonar-list-projects\n/sonarqube:sonar-list-projects my-project\n```\n\n#### List issues\n\n```\n/sonarqube:sonar-list-issues\n/sonarqube:sonar-list-issues my-project --severities CRITICAL\n```\n\n#### Fix an issue\n\n```\n/sonarqube:sonar-fix-issue java:S1481 src/main/java/MyClass.java\n/sonarqube:sonar-fix-issue python:S2077 src/auth/login.py:34\n```\n\n#### Quality gate / analyze / coverage / duplication / dependency risks\n\n```\n/sonarqube:sonar-quality-gate\n/sonarqube:sonar-quality-gate my-project --branch main\n\n/sonarqube:sonar-analyze\n/sonarqube:sonar-analyze src/auth/login.py\n\n/sonarqube:sonar-coverage\n/sonarqube:sonar-coverage my-project --max 50\n/sonarqube:sonar-coverage my-project --file src/auth/login.py\n\n/sonarqube:sonar-duplication\n/sonarqube:sonar-duplication my-project --pr 42\n\n/sonarqube:sonar-dependency-risks\n/sonarqube:sonar-dependency-risks my-project --pr 42\n```\n\n---\n\n## License\n\nCopyright (C) 2025-2026 SonarSource Sàrl. Licensed under [SSAL-1.0](LICENSE).\n\n## Support\n\n- Community: https://community.sonarsource.com/\n",
  "bytes": 10188,
  "sha": "ecd60ee03bb8ac89ae20025f431f32f1e2f7edc8b9df3a6e75ba8dc70f3b5871",
  "repo_slug": "sonarsource/sonarqube-agent-plugins",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_sonarsource_sonarqube_agent_plugins_01a4cdac/readme"
}