> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SonarQube

> Connect SonarQube to CloudThinker for continuous code quality analysis, security scanning, and technical debt tracking

Connect your SonarQube instance to enable CloudThinker agents to analyze code quality, review security hotspots, and monitor quality gate statuses across your projects. CloudThinker uses the official SonarSource MCP server and authenticates with a **user token**.

***

## Supported platforms

| Platform             | Support           |
| -------------------- | ----------------- |
| **SonarQube Cloud**  | All organizations |
| **SonarQube Server** | 2025.4 and above  |

***

## Prerequisites

* A **SonarQube Cloud** organization or a **SonarQube Server** instance running version 2025.4 or newer.
* A **user token** generated from **My Account → Security → Generate Tokens**.
* **Browse** permission on the projects CloudThinker should analyze.

<Info>
  CloudThinker uses the official SonarSource MCP server, which requires SonarQube Server 2025.4+ or SonarQube Cloud.
</Info>

***

## Setup

<Tabs>
  <Tab title="SonarQube Cloud">
    <Steps>
      <Step title="Generate a token">
        Go to [SonarQube Cloud](https://sonarcloud.io/) → **My Account → Security → Generate Tokens**:

        * **Name**: `cloudthinker`
        * **Type**: `User Token`
        * **Expires in**: set an appropriate duration

        Copy the token — it will not be shown again.
      </Step>

      <Step title="Find your organization key">
        Go to **My Organizations** and note the organization key from the URL:

        ```
        https://sonarcloud.io/organizations/YOUR_ORG_KEY
        ```
      </Step>

      <Step title="Add the connection in CloudThinker">
        Navigate to **Connections → SonarQube** and enter:

        * **Token**: the token you generated
        * **Deployment Type**: select **SonarQube Cloud**
        * **Organization**: your organization key

        Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
      </Step>
    </Steps>
  </Tab>

  <Tab title="SonarQube Server (self-hosted)">
    <Steps>
      <Step title="Generate a token">
        Go to your SonarQube instance → **My Account → Security → Generate Tokens**:

        * **Name**: `cloudthinker`
        * **Type**: `User Token`
        * **Expires in**: set an appropriate duration

        Copy the token — it will not be shown again.
      </Step>

      <Step title="Find your server URL">
        Your SonarQube Server URL is the address of your instance, e.g., `https://sonarqube.your-domain.com`.
      </Step>

      <Step title="Add the connection in CloudThinker">
        Navigate to **Connections → SonarQube** and enter:

        * **Token**: the token you generated
        * **Deployment Type**: select **SonarQube Server**
        * **Server URL**: your SonarQube instance URL

        Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Warning>
  Copy the token immediately after generation. SonarQube will not show it again, and you'll need to create a new token if lost.
</Warning>

***

## Connection details

| Field                           | Description                   | Example                             |
| ------------------------------- | ----------------------------- | ----------------------------------- |
| **SONARQUBE\_TOKEN**            | User token for authentication | `squ_xxxxx...`                      |
| **SONARQUBE\_DEPLOYMENT\_TYPE** | `cloud` or `self_hosted`      | `cloud`                             |
| **SONARQUBE\_ORG**              | Organization key (Cloud only) | `my-org`                            |
| **SONARQUBE\_URL**              | Server URL (self-hosted only) | `https://sonarqube.your-domain.com` |

***

## Required permissions

* **Browse** permission on projects you want CloudThinker to analyze
* **Execute Analysis** permission for triggering scans

<Tip>
  Follow least privilege: Browse permission is sufficient for read-only analysis. Add Administer and Create Projects only if CloudThinker must manage quality gates or onboard new projects.
</Tip>

***

## Agent capabilities

Once connected, agents can query code quality data across your SonarQube projects.

| Capability            | Description                                                    |
| --------------------- | -------------------------------------------------------------- |
| **Project browsing**  | List and inspect all projects in your organization             |
| **Issue analysis**    | Retrieve and categorize bugs, vulnerabilities, and code smells |
| **Quality gates**     | Check quality gate statuses across projects                    |
| **Security hotspots** | Review and prioritize security hotspots                        |
| **Code duplication**  | Analyze code duplication metrics                               |
| **Code metrics**      | Inspect coverage, complexity, and maintainability ratings      |

### Verify the connection

```text theme={null}
@oliver list all SonarQube projects and report quality gate statuses
```

### Example prompts

```text theme={null}
@oliver analyze code quality metrics across all projects and #report quality gate statuses
@oliver review all security hotspots and categorize them by risk level
@oliver list all blocker and critical severity issues broken down by type
```

***

## Troubleshooting

<Accordion title="Authentication failed">
  The token is incorrect, expired, or revoked. Confirm the token type is `User Token`, generate a new token if needed, and update the connection.
</Accordion>

<Accordion title="Organization not found (Cloud)">
  The organization key is incorrect, or the account is not a member of that organization. Confirm the key from **My Organizations** in SonarQube Cloud and verify membership.
</Accordion>

<Accordion title="Server unreachable (self-hosted)">
  The SonarQube URL is wrong or the instance is not reachable from CloudThinker. Verify the URL, check firewall rules, and confirm the SonarQube service is running.
</Accordion>

<Accordion title="No projects visible">
  The token owner lacks Browse permission on the projects. Check project visibility settings (public vs. private) and grant Browse permission for the projects CloudThinker should analyze.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **HTTPS only** — always use HTTPS for self-hosted instances to protect the token in transit.
- **User token type** — use a `User Token`, not a Global Analysis Token, to limit the token's scope to what CloudThinker needs.

***

## Related

<CardGroup cols={2}>
  <Card title="Elasticsearch Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/elasticsearch.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c7389cfcd0bc8d303aeeb68bd19199ca" href="/guide/connections/elasticsearch" width="24" height="24" data-path="images/icons/elasticsearch.svg">
    Search code quality logs
  </Card>

  <Card title="Grafana Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/grafana.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c1329049025cd3c3a0909b400baef7be" href="/guide/connections/grafana" width="24" height="24" data-path="images/icons/grafana.svg">
    Visualize code quality metrics
  </Card>
</CardGroup>