How is this different from connecting SonarQube MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the SonarQube MCP API changes?

We track the SonarQube MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different SonarQube tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in SonarQube?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the SonarQube MCP server myself?

No. TrustGate connects to the SonarQube MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to SonarQube directly.

Connect SonarQube MCP to your AI agents, securely.

Q: Is SonarQube MCP secure?

The server itself exposes 38 tools, and some of them can write to your SonarQube account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches SonarQube.

One secured endpoint for every SonarQube call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try SonarQube MCP now

What your agents can ask once SonarQube MCP is connected.

Select the tools your AI agents can call

38 tools from the SonarQube MCP schema.

Showing 38 tools

analyze_code_snippetreadAnalyses a file or code snippet with SonarQube analyzers to identify code quality and security issues.
get_raw_sourcereadRetrieves the source of a file as analysed by SonarQube.
toggle_automatic_analysiswriteEnables or disables SonarQube for IDE automatic analysis.
analyze_file_listreadAnalyses a list of files in the working directory using a running SonarQube for IDE instance.
run_advanced_code_analysisreadRuns server-side advanced analysis on a single file to identify code quality and security issues.
search_sonar_issues_in_projectsreadSearches issues across projects: bugs, vulnerabilities and code smells, with filters for severity, status and new code period.
change_sonar_issue_statuswriteChanges the status of an issue, to accept it, mark it as a false positive or reopen it.
get_project_quality_gate_statusreadGets the quality gate status for a project, branch or pull request.
list_quality_gatesreadLists the quality gate definitions configured on the instance.
search_security_hotspotsreadSearches for Security Hotspots in a project, with filters for new code and assignment.
show_security_hotspotreadShows the details of a Security Hotspot, including its risk description.
change_security_hotspot_statuswriteReviews a Security Hotspot by changing its status.
get_component_measuresreadGets the measures for a component: a project, directory or file.
search_metricsreadLists the metrics available to query on this instance.
get_file_coverage_detailsreadGets line-by-line coverage for a file, including uncovered lines and partially covered branches.
search_files_by_coveragereadSearches for files in a project sorted by coverage, worst first.
list_branchesreadLists the analysed branches of a project with their quality gate and analysis date.
list_pull_requestsreadLists the pull requests available for PR-decorated analysis.
get_scm_inforeadGets SCM information for source files.
search_my_sonarqube_projectsreadFinds SonarQube projects by project name or key.
show_rulereadShows the definition and rationale of an analysis rule.
get_duplicationsreadGets the duplicated blocks detected in a component.
search_dependency_risksreadSearches the SCA dependency risks found in a project.
search_duplicated_filesreadSearches for files with code duplications in a project.
list_portfoliosreadLists enterprise portfolios in SonarQube Cloud, with filtering and pagination.
list_enterprisesreadLists the SonarQube Cloud enterprises you have access to.
create_webhookwriteCreates a new webhook for a project or organization.
list_webhooksreadLists the webhooks for a project or organization.
list_organizationsreadLists the SonarQube Cloud organizations the user is a member of.
start_agentic_readiness_assessmentwriteStarts an agentic readiness assessment for a project or branch.
get_agentic_readiness_assessmentreadRetrieves the result of an agentic readiness assessment, including the readiness level and a per-pillar breakdown.
list_agentic_readiness_assessmentsreadLists the agentic readiness assessments for a project, newest first.
get_system_inforeadGets detailed SonarQube Server system configuration, including JVM state, database, search indexes and settings.
get_system_healthreadGets the health status of the SonarQube Server instance.
ping_systemreadPings the SonarQube Server system to check that it is alive.
get_system_statusreadGets the status, version and ID of the SonarQube Server.
get_system_logsreadGets SonarQube Server system logs in plain text.
list_languagesreadLists the programming languages supported in the instance.

What SonarQube MCP exposes

SonarQube MCP groups its 38 tools into 10 categories, each with a suggested starting policy.

All 38 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Analysis	Analysing a code snippet or file with SonarQube analyzers in the agent context	Read / Write	Snippets are sent to the analyzers; avoid pasting secrets
Issues	Issue search across projects, details, status transitions and assignment	Read / Write	Audit status transitions; they close findings
Quality Gates	Quality gate status for a project, branch or pull request, and gate definitions	Read	Safe to poll from pipelines
Security Hotspots	Hotspot search, details and status review	Read / Write	Hotspot review is a security judgement; keep a human in the loop
Coverage & Measures	Component measures, available metrics, under-covered files and line-by-line coverage	Read	Allow read-only reporting
Projects	Project search, branches and pull requests available for analysis	Read	Limit to the projects in scope
Rules & Dependencies	Rule definitions, duplications and SCA dependency risks	Read	Allow read-only lookups
Organizations & Webhooks	Listing organizations, enterprises and portfolios, and listing and creating webhooks	Read / Write	Webhook creation needs Administer permission; review target URLs
Agentic Readiness	Starting, listing and reading agentic readiness assessments for a project	Read / Write	Low risk; assessments run on SonarQube
System	SonarQube Server health, status, ping, system information, logs and supported languages	Read	System info and logs need admin rights; limit to operators

Connect SonarQube MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect SonarQube
Find SonarQube in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow SonarQube MCP or block it. You allow the exact tools each agent can call, one by one.

SonarQube MCP	38 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 38 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is SonarQube MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	SonarQube MCP38 documented tools.
Coding assistants	Connection & credentialsper user	System6 tools
Internal copilots	Tool access policiesdeny by default	Analysis5 tools
Workflow automations	Request & response inspectioninline	Organizations & Webhooks5 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools22 tools