Skip to main content
Connect SonarQube to let CloudThinker agents tell you why a quality gate failed, list the blocker and high-severity issues behind it, review open security hotspots, and find the files with the least test coverage. The connection signs in with one SonarQube user token and runs the official SonarSource MCP server, so it works with SonarQube Cloud and self-hosted SonarQube Server.

​
Prerequisites

  • A SonarQube Cloud organization, or a SonarQube Server or Community Build instance reachable from CloudThinker over HTTPS. For a private instance, see Reaching private services.
  • A SonarQube account for CloudThinker with Browse permission on the projects agents should read (see Required permissions).
  • The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

​
Setup

1

Generate a user token

Sign in to SonarQube Cloud as the account CloudThinker will use. Go to My Account → Security, enter a name such as cloudthinker, set an expiry, and click Generate Token.Copy the token. SonarQube shows it only once.
2

Find your organization key

Open your organization. The key is the last part of the URL: https://sonarcloud.io/organizations/<org-key>.
3

Grant Browse on the projects

For each project agents should read, open the project, go to Administration → Permissions, and give the CloudThinker account Browse. Without it, the verify prompt comes back empty.
4

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select SonarQube. Fill in:
  • SONARQUBE_TOKEN: the token you copied
  • SONARQUBE_DEPLOYMENT_TYPE: SonarQube Cloud
  • SONARQUBE_ORG: your organization key
Click Connect.Success state: the Connect SonarQube dialog closes without an error. Run the verify prompt below.

​
Connection details

The form shows SONARQUBE_ORG or SONARQUBE_URL depending on the deployment type you pick. The SonarQube Cloud option connects to sonarcloud.io. There’s no region field.

​
Required permissions

A user token acts with the permissions of the account that created it. Grant that account project permissions in SonarQube, per project or through a permission template.
Start with Browse only. Agents can explain every gate and issue with it. Add the two Administer permissions only on projects where you want agents to propose status changes.

​
Agent capabilities

Severity names follow your instance’s mode. Multi-Quality Rule mode reports BLOCKER, HIGH, MEDIUM, LOW, and INFO. Standard Experience reports BLOCKER, CRITICAL, MAJOR, MINOR, and INFO. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. A rejected request isn’t retried. To decide each status change yourself, such as marking an issue as a false positive, choose Manual so a person approves every change. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can narrow that to the SonarQube connection alone. Some tools depend on your SonarQube edition: dependency risks need an Advanced Security license, and system health tools work only on SonarQube Server. Agents report each project’s numbers as they are today. SonarQube returns current measures, so agents won’t claim a trend unless you ask them to compare branches or pull requests.

​
Verify the connection

Expect a table of project keys and names, a gate status of OK or ERROR for each, and issue counts by severity, such as BLOCKER.

​
Example prompts

Use the real project key. Agents look keys up from the project list and won’t guess one.

​
Troubleshooting

The token is wrong, expired, or revoked. Generate a new user token, edit the connection, and paste it into SONARQUBE_TOKEN.
CloudThinker can’t reach SONARQUBE_URL. Check that the address is HTTPS and reachable from the internet, not localhost or a private hostname, and that the SonarQube service is running.
SONARQUBE_ORG is wrong, or the token’s account isn’t a member of that organization. Copy the key from the organization URL and confirm membership.
The token’s account lacks Browse on them. Grant Browse on those projects in SonarQube. No need to reconnect; permissions apply on the next request.
The account lacks Administer Issues or Administer Security Hotspots on that project. Grant the permission in SonarQube, then ask again.
Your edition doesn’t include those tools. Dependency risks need an Advanced Security license, and system health tools exist only on SonarQube Server.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Use a user token: on SonarQube Server, pick the User Token type, not a Global Analysis Token, so access follows one account’s project permissions.
  • Set an expiry: give the token an expiry date and rotate it before it lapses.

Review

Get AI review comments on every merge request and pull request.

Semgrep connection

Let agents triage static analysis findings from Semgrep.