Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

SonarQube MCP Integration · giuseppe-trisciuoglio | DecimalAI

code reviewby giuseppe-trisciuoglio

SonarQube MCP Integration

giuseppe-trisciuoglio/sonarqube-mcp

Source giuseppe-trisciuoglio/developer-kit ↗License MIT

Provides SonarQube and SonarCloud integration patterns via the Model Context Protocol (MCP) server. Enables quality gate monitoring, issue discovery and triaging, pre-push code analysis, and rule education directly in the agent workflow.

SkillScore82Maintained

Automatic

QA & Test Engineering pack

Last verified 8/21/2026

What it changes

Passed 15 of 18 test cases with the skill, and 8 of 18 without it.

Without skill45%

With skill82%

Checks it passed that the model alone missed

Includes coverage in the metricKeys array argument.
States that SONARQUBE_URL should be omitted when using SonarCloud.
Avoids passing a branch argument to get_project_quality_gate_status.

and 11 more in the full report

8 fixed10 passed either way4 still failing0 broke

Pass-rate lift: +36 pp
Tokens: +193%
Agent turns: 0%
Response time: -36%

Model gemini-3.6-flashMeasured 8/21/2026v118 of 22 cases passed with skill · 18 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/giuseppe-trisciuoglio-sonarqube-mcp/SKILL.md https://app.decimal.ai/s/giuseppe-trisciuoglio-sonarqube-mcp/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add giuseppe-trisciuoglio-sonarqube-mcp, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/giuseppe-trisciuoglio-sonarqube-mcp/ and pins it in .decimal/skills.lock

decimalai skills add giuseppe-trisciuoglio-sonarqube-mcp

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/giuseppe-trisciuoglio-sonarqube-mcp/SKILL.md https://app.decimal.ai/s/giuseppe-trisciuoglio-sonarqube-mcp/SKILL.md

Raw file: /s/giuseppe-trisciuoglio-sonarqube-mcp/SKILL.md ↗ · machine-readable summary at /s/giuseppe-trisciuoglio-sonarqube-mcp.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 7

Prompt

Can I search for blocker issues across both `cart-service` and `checkout-service` at the same time using `search_sonar_issues_in_projects`?

What was checked, without and with the skill
Checked	Without skill	With skill
Passes array containing cart-service and checkout-service to the projects parameter.	Missed	Passed
Leverages multi-project searching capability of search_sonar_issues_in_projects.	Missed	Passed

case-18 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md361 lines5 files

SonarQube MCP Integration

Leverage SonarQube and SonarCloud capabilities directly through the Model Context Protocol (MCP) server to enforce code quality, discover issues, and run pre-push analysis inside the agent workflow.

Overview

This skill provides instructions and patterns for using the SonarQube MCP Server tools. It enables automated workflows for:

Checking quality gate status before merges or deployments
Discovering and triaging issues by severity and project
Analyzing code snippets locally before committing (shift-left)
Understanding SonarQube rules with full documentation

When to Use

Use this skill when:

The user wants to check if a project passes its quality gate before merging a PR
The user wants to find critical or blocker issues in one or more SonarQube projects
The user wants to analyze a code snippet for issues before pushing to CI
The user wants to understand why a specific Sonar rule flagged their code
The user asks for pre-commit or pre-push quality feedback

Trigger phrases: "check quality gate", "sonarqube quality gate", "find sonar issues", "search sonar issues", "analyze code with sonar", "check sonar rule", "sonarcloud issues", "pre-push sonar check", "sonar pre-commit"

Prerequisites and Setup

The plugin includes a .mcp.json that starts the SonarQube MCP Server automatically via Docker. Before using this skill, set the required environment variables:

SonarQube Server (remote or local):

export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_URL="https://sonarqube.mycompany.com"  # or http://host.docker.internal:9000 for local Docker

SonarCloud:

export SONARQUBE_TOKEN="squ_your_token"
export SONARQUBE_ORG="your-org-key"   # required for SonarCloud
# SONARQUBE_URL is not needed for SonarCloud

Track record

Benchmark

15 / 18

test cases passed, vs 8 / 18 without

Adoption

Users: 3
Times used: 51

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

giuseppe-trisciuoglio / developer-kit

plugins/developer-kit-tools/skills/sonarqube-mcp/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 4 files

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

SonarQube MCP Integration

Overview

When to Use

Prerequisites and Setup

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills