SonarQube

Connect SonarQube to CloudThinker for continuous code quality analysis, security scanning, and technical debt tracking

Connect your SonarQube instance to enable CloudThinker agents to analyze code quality, review security hotspots, and monitor quality gate statuses across your projects. CloudThinker uses the official SonarSource MCP server and authenticates with a user token.

---

Supported platforms

Platform	Support
SonarQube Cloud	All organizations
SonarQube Server	2025.4 and above

---

Prerequisites

• A SonarQube Cloud organization or a SonarQube Server instance running version 2025.4 or newer.
• A user token generated from My Account → Security → Generate Tokens.
• Browse permission on the projects CloudThinker should analyze.

CloudThinker uses the official SonarSource MCP server, which requires SonarQube Server 2025.4+ or SonarQube Cloud.

---

Setup

SonarQube Cloud

1. Generate a token

   Go to SonarQube Cloud → My Account → Security → Generate Tokens:

   • Name: cloudthinker
   • Type: User Token
   • Expires in: set an appropriate duration

   Copy the token — it will not be shown again.

2. Find your organization key

   Go to My Organizations and note the organization key from the URL:

   https://sonarcloud.io/organizations/YOUR_ORG_KEY
   
3. Add the connection in CloudThinker

   Navigate to Connections → SonarQube and enter:

   • Token: the token you generated
   • Deployment Type: select SonarQube Cloud
   • Organization: your organization key

   Click Connect. CloudThinker verifies the credentials and shows a Connected status.

SonarQube Server (self-hosted)

1. Generate a token

   Go to your SonarQube instance → My Account → Security → Generate Tokens:

   • Name: cloudthinker
   • Type: User Token
   • Expires in: set an appropriate duration

   Copy the token — it will not be shown again.

2. Find your server URL

   Your SonarQube Server URL is the address of your instance, e.g., https://sonarqube.your-domain.com.

3. Add the connection in CloudThinker

   Navigate to Connections → SonarQube and enter:

   • Token: the token you generated
   • Deployment Type: select SonarQube Server
   • Server URL: your SonarQube instance URL

   Click Connect. CloudThinker verifies the credentials and shows a Connected status.

Copy the token immediately after generation. SonarQube will not show it again, and you’ll need to create a new token if lost.

---

Connection details

Field	Description	Example
SONARQUBE_TOKEN	User token for authentication	squ_xxxxx...
SONARQUBE_DEPLOYMENT_TYPE	cloud or self_hosted	cloud
SONARQUBE_ORG	Organization key (Cloud only)	my-org
SONARQUBE_URL	Server URL (self-hosted only)	https://sonarqube.your-domain.com

---

Required permissions

• Browse permission on projects you want CloudThinker to analyze
• Execute Analysis permission for triggering scans

Follow least privilege: Browse permission is sufficient for read-only analysis. Add Administer and Create Projects only if CloudThinker must manage quality gates or onboard new projects.

---

Agent capabilities

Once connected, agents can query code quality data across your SonarQube projects.

Capability	Description
Project browsing	List and inspect all projects in your organization
Issue analysis	Retrieve and categorize bugs, vulnerabilities, and code smells
Quality gates	Check quality gate statuses across projects
Security hotspots	Review and prioritize security hotspots
Code duplication	Analyze code duplication metrics
Code metrics	Inspect coverage, complexity, and maintainability ratings

Verify the connection

@oliver list all SonarQube projects and report quality gate statuses

Example prompts

@oliver analyze code quality metrics across all projects and #report quality gate statuses
@oliver review all security hotspots and categorize them by risk level
@oliver list all blocker and critical severity issues broken down by type

---

Troubleshooting

Authentication failed

The token is incorrect, expired, or revoked. Confirm the token type is User Token, generate a new token if needed, and update the connection.

Organization not found (Cloud)

The organization key is incorrect, or the account is not a member of that organization. Confirm the key from My Organizations in SonarQube Cloud and verify membership.

Server unreachable (self-hosted)

The SonarQube URL is wrong or the instance is not reachable from CloudThinker. Verify the URL, check firewall rules, and confirm the SonarQube service is running.

No projects visible

The token owner lacks Browse permission on the projects. Check project visibility settings (public vs. private) and grant Browse permission for the projects CloudThinker should analyze.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• HTTPS only — always use HTTPS for self-hosted instances to protect the token in transit.
• User token type — use a User Token, not a Global Analysis Token, to limit the token’s scope to what CloudThinker needs.

---

Related

Elasticsearch Connection

Search code quality logs

Grafana Connection

Visualize code quality metrics