sonarqube
Automatically enforce SonarQube code quality and security in the agent coding loop — 7,000+ rules, secrets scanning, agentic analysis, and quality gates across 40+ languages. PostToolUse hooks run analysis after every file edit. Pre-tool secrets scanning prevents 450+ patterns from reaching the LLM. Slash commands give on-demand access to quality gate status, coverage, duplication, and dependency risks. Includes SonarQube CLI, MCP Server, skills, hooks, and slash commands.
/plugin install sonarqube@claude-plugins-officialHow to start
- Paste the command into Claude Code and press Enter.
- Restart Claude Code so the plugin loads.
- Just ask Claude. Its skills step in when your request fits.
What it adds
1 agent · 10 skills
Agents Claude hands work to these
sonarqube-reviewerReviews code changes against SonarQube quality, security, and dependency-risk standards by composing this plugin's sonar-* skills. Use proactively before mergi…
Skills Claude loads these when the task fits
sonar-analyzeAnalyze a file for quality and security issues using SonarQubesonar-coverageFind files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default pro…sonar-dependency-risksSearch for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default p…sonar-duplicationFind files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines t…sonar-fix-issueFix a specific SonarQube issue in code by rule key and locationsonar-integrateInstalls sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server…sonar-list-issuesSearch and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user argu…sonar-list-projectsList SonarQube projects accessible to the current usersonar-quality-gateShow SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project…sonar-triage-dependency-risksTriage SonarQube SCA dependency risks by CVE reachability, prepare safe UI writeups, and optionally bundle confirmed package fixes.
Read from the plugin's own files in SonarSource/sonarqube-agent-plugins, 26 Oct 2026.
What it needs
No keys or settings: its files ask for none.
More in Security
See all →auth0
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware…
zscaler
Manage Zscaler cloud security platform including ZPA (private access), ZIA (internet access), ZDX (digital…
workos
WorkOS integration skills for AuthKit, SSO, Directory Sync, RBAC, Vault, Audit Logs, migrations, and API references.
crowdstrike-falcon-foundry
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes…
crowdstrike-falcon-fusion
CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action…
crowdsec
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers…