sonarqube

v2.6.0

SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.

CodexClaude Code9 Skills

By SonarLicense: SSAL-1.0112 GitHub starsUpdated last week

Directory evidence

Runtimes: Codex and Claude Code
Parsed components: 9 skill or MCP entries
Source updated: Oct 13, 2026
Manifest status: Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install sonarqube for Codex and Claude Code

Installs for the current user

codex plugin marketplace add SonarSource/sonarqube-agent-plugins
codex plugin marketplace upgrade sonar
codex plugin add sonarqube@sonar

Paste and run these commands in a terminal with Codex. They add and refresh the sonar catalog, then install this plugin.

Compatibility: the page URL and API slug “sonarqube” remain stable.

Codex: sonarqube@agent-plugin-marketplace → sonarqube@sonar

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually

$ git clone https://github.com/SonarSource/sonarqube-agent-plugins

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The repository root is the plugin root.

Plugin files

sonarqube/

├── .codex-plugin/plugin.json
├── .claude-plugin/plugin.json
├── skills/sonar-analyze/SKILL.md
├── skills/sonar-coverage/SKILL.md
├── skills/sonar-dependency-risks/SKILL.md
├── skills/sonar-duplication/SKILL.md
├── skills/sonar-fix-issue/SKILL.md
├── skills/sonar-integrate/SKILL.md
├── skills/sonar-list-issues/SKILL.md
├── skills/sonar-list-projects/SKILL.md
└── skills/sonar-quality-gate/SKILL.md

Included Skills9

sonar-analyzeskills/sonar-analyze/SKILL.md

Analyze a file for quality and security issues using SonarQube

sonar-coverageskills/sonar-coverage/SKILL.md

Find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)

sonar-dependency-risksskills/sonar-dependency-risks/SKILL.md

Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)

sonar-duplicationskills/sonar-duplication/SKILL.md

Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)

sonar-fix-issueskills/sonar-fix-issue/SKILL.md

Fix a specific SonarQube issue in code by rule key and location

sonar-integrateskills/sonar-integrate/SKILL.md

Installs sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube.

sonar-list-issuesskills/sonar-list-issues/SKILL.md

Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)

sonar-list-projectsskills/sonar-list-projects/SKILL.md

List SonarQube projects accessible to the current user

sonar-quality-gateskills/sonar-quality-gate/SKILL.md

Show SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project key optional — resolved from `sonar-project.properties` or the MCP integration default.

Plugin manifests2

.codex-plugin/plugin.json

{
  "name": "sonarqube",
  "version": "2.6.0",
  "description": "SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.",
  "author": {
    "name": "Sonar",
    "url": "https://www.sonarsource.com/"
  },
  "keywords": [
    "sonarqube",
    "code-quality",
    "static-analysis",
    "security",
    "secrets"
  ],
  "license": "SSAL-1.0",
  "repository": "https://github.com/SonarSource/sonarqube-agent-plugins",
  "homepage": "https://www.sonarsource.com",
  "interface": {
    "displayName": "SonarQube",
    "shortDescription": "Review code as it's written",
    "longDescription": "SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.",
    "developerName": "Sonar",
    "category": "Developer Tools",
    "capabilities": [
      "Read",
      "Interactive"
    ],
    "websiteURL": "https://www.sonarsource.com",
    "privacyPolicyURL": "https://www.sonarsource.com/company/privacy/",
    "termsOfServiceURL": "https://www.sonarsource.com/legal/sonarcloud/terms-of-service/",
    "defaultPrompt": [
      "Help me fix the most severe SonarQube issues for this project"
    ],
    "brandColor": "#290042",
    "brandColorDark": "#F3F6FB",
    "composerIcon": "./assets/logo.png",
    "composerIconDark": "./assets/logo-dark.png",
    "logo": "./assets/logo.png",
    "logoDark": "./assets/logo-dark.png",
    "screenshots": []
  },
  "skills": "./skills/"
}

.claude-plugin/plugin.json

{
  "name": "sonarqube",
  "version": "2.6.0",
  "description": "SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.",
  "author": {
    "name": "Sonar",
    "url": "https://www.sonarsource.com/"
  },
  "keywords": [
    "sonarqube",
    "code-quality",
    "static-analysis",
    "security",
    "secrets"
  ],
  "license": "SSAL-1.0",
  "repository": "https://github.com/SonarSource/sonarqube-agent-plugins",
  "homepage": "https://www.sonarsource.com",
  "hooks": "./claude-hooks/hooks.json"
}

Browse the “sonarqube” tag →

skills-igb

by Sistemas IGB

Nueve skills para Claude Code que trabajan con criterio empresarial: arranque de proyectos con interrogatorio de requisitos, Docker + NGINX, CI/CD, SonarQube, pruebas de carga con K6, automatizaciones en n8n, IA generativa (LLM, RAG, agentes), modelos predictivos y MLOps. En español, agnósticas de stack.

Claude Code

1Updated last month

architect

by Architecture Office

Acts as the organization's chief software architect during planning, review, and coding. Encodes the on-premise standards for OpenShift, Oracle, MongoDB, Elasticsearch, RabbitMQ, Kafka, OpenTelemetry, Red Hat SSO, and the nginx edge gateway — plus contract-first APIs, the SonarQube quality gate, and safe AI features — and keeps a human in the loop at every architectural decision fork.

Claude Code18 Skills

0Updated 3 weeks ago

ugt-nextjs-platform

by UGT DX Team

Org standards for Next.js projects: SQL Server via Prisma, SSO/LDAP/Local login + RBAC, test/lint tooling, design agreement + shadcn tokens/UI kit, Jenkins + SonarQube + Docker deploy, plus the harness layer (CLAUDE.md, rules, state, audit log)

Claude Code11 Skills

0Updated last month

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[sonarqube on Agent Plugins Marketplace](https://pluginsmp.com/plugins/sonarqube)