🎃 New adapter: SonarQube (code quality, Server or Cloud) #1240

Part of the October Challenge #997.

Why

SonarQube is one of the most widely used code-quality and code-security tools. Teams run it as SonarQube Server (self-hosted, including the free Community Build) or as SonarQube Cloud (formerly SonarCloud). Its Web API exposes projects, quality gate status, issues, measures and analysis history. With an adapter, a user could ask "did the main branch of payments-api pass its quality gate?", "list the open high-severity security issues in project X" or "how has coverage changed since June?". The catalog has GitHub, GitLab and Sentry but no SonarQube (ls packages/backend/src/adapters/*/ | grep -i sonar finds nothing).

Self-hosted vs Cloud

• Self-hosted AnythingMCP: available in Community and Business. Catalog adapters have no edition gating. SonarQube Cloud and any SonarQube Server reachable on the internet work as they are. A SonarQube Server on a private network or private IP needs its host in SSRF_ALLOWED_HOSTS, because the outbound guard blocks private address space by default (same wording as intl/directus.json:9).
• AnythingMCP Cloud (DEPLOYMENT_MODE=cloud): available, but only for SonarQube Cloud (sonarcloud.io, or sonarqube.us for the US region) or a SonarQube Server that is publicly reachable. Private-network servers cannot be reached from Cloud. On Cloud trial plans, installs count toward the trial's connector limit (license-guard.service.ts:75-92).
• Who can use it: any role except VIEWER can install it (adapters.controller.ts:306). The connector and its encrypted token belong to the installer's organization. The token sees only the projects its SonarQube user can browse.

What to build

packages/backend/src/adapters/intl/sonarqube.json, one adapter for both SonarQube Server and SonarQube Cloud. Start with npm run adapter:new -- sonarqube --region intl --auth BEARER_TOKEN.

• API docs: Server: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/web-api/ (the full reference is in the instance under Help → Web API). Cloud: https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/web-api/ and the live reference https://sonarcloud.io/web_api. Use the v1 Web API (/api/...): it is the same on both products. Web API v2 is gradually replacing it, but v2 runs on a different host on Cloud (api.sonarcloud.io), so it cannot share one base URL.
• Base URL: "baseUrl": "{{SONARQUBE_URL}}/api", as intl/gitlab.json:46 and intl/grafana.json:46 do. SONARQUBE_URL is https://sonarcloud.io (Cloud, EU), https://sonarqube.us (Cloud, US), or the Server address including any context path (for example https://sonar.example.com or https://example.com/sonarqube). Add envVarMeta with an address pattern like intl/gitlab.json:14-32.
• Auth: BEARER_TOKEN with token: "{{SONARQUBE_TOKEN}}" (Authorization: Bearer <token>, documented for both products), as intl/directus.json:15-18 does. Server: My account → Security, token type User (project and global analysis tokens are for running scans, not the Web API; https://docs.sonarsource.com/sonarqube-server/latest/user-guide/managing-tokens/). Cloud: My account → Access Tokens (https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens/).
• Organization (Cloud only): add optionalEnvVars: ["SONARQUBE_ORGANIZATION"] and pass it as the organization query param where noted below, the way intl/ebay-sell.json:199 passes a connector variable. Cloud requires it for listing projects. A Server 24.12 Community Build ignored the parameter in our test, both when set and when empty.
• Category: infrastructure (like GitHub and GitLab). probe: sonarqube_list_projects. Do not use api/authentication/validate as the probe: it returns {"valid":true} for anonymous calls too (seen on sonarcloud.io and on a Server instance), so it proves nothing about the token.
• Pagination: p (1-based) and ps (max 500 on most endpoints, 1000 on search_history).

All tools are GET, so they are derived as readOnlyHint: true, destructiveHint: false (docs/tool-definition.md:782-806). Server and Cloud differences that the JSON must handle (checked against the api/webservices/list output of sonarcloud.io and of a SonarQube Server 24.12 Community Build):

• Listing projects: use components/search, not projects/search. On Server, projects/search requires Administer System. On Cloud, components/search requires organization; on Server it requires qualifiers=TRK. Each product ignores the other's parameter, so one request with both works on both.
• Issues by project: use componentKeys. Cloud only accepts componentKeys; on Server it is the deprecated alias of components and still works. Use the impact filters (impactSeverities, impactSoftwareQualities, issueStatuses): Cloud has deprecated types, severities and statuses.
• Quality gate: on Cloud, qualitygates/project_status is marked deprecated since 16 September 2025, with no v2 replacement yet. It still answers. instructions should name the fallback: sonarqube_get_measures with metricKeys=alert_status,quality_gate_details. Both metrics exist on both products.
• Metrics: suggest software_quality_reliability_issues, software_quality_security_issues and software_quality_maintainability_issues in descriptions and instructions, not bugs, vulnerabilities or code_smells, which Cloud has deprecated (https://docs.sonarsource.com/sonarqube-cloud/deprecations-and-removals/). coverage, duplicated_lines_density, ncloc and alert_status exist on both.

Where to look

• packages/backend/src/adapters/intl/gitlab.json — the closest match: one adapter for a SaaS host and self-managed instances, with {{GITLAB_URL}}/api/v4 (:46), address envVarMeta (:14-32) and verifyHints.
• packages/backend/src/adapters/intl/directus.json — Bearer auth (:15-18) and the SSRF / private-network wording in instructions (:9).
• packages/backend/src/adapters/intl/ebay-sell.json:199 — a connector variable sent as a query param.
• packages/backend/src/adapters/intl/todoist.live.spec.ts — spec template; gate live calls behind RUN_SONARQUBE_LIVE=1 as intl/sentry.live.spec.ts:28 does.
• docs/tool-definition.md:18-28 — optionalEnvVars; docs/tool-definition.md:343-356 — how $param and connector variables map into the query string.
• .github/CONTRIBUTING.md:137-155 — the "Add an adapter" checklist; 🐣 Good first issue: contribute a new MCP adapter #982 — good-first-issue adapter guide.

Acceptance criteria

• intl/sonarqube.json exists with the 7 read-only tools, requiredEnvVars: ["SONARQUBE_URL","SONARQUBE_TOKEN"], optionalEnvVars: ["SONARQUBE_ORGANIZATION"], and a docsUrl.
• No tool uses POST/PUT/PATCH/DELETE (asserted in the spec).
• validate-adapters.mjs --warn is clean (the validator requires instructions ≥ 800 chars and each tool description ≥ 60 chars, scripts/validate-adapters.mjs:32-33); catalog.ts is regenerated; adapter-count.mjs --check passes.
• intl/sonarqube.live.spec.ts: static checks (base URL is {{SONARQUBE_URL}}/api, Bearer auth, read-only methods, sonarqube_list_projects sends qualifiers=TRK and organization, sonarqube_search_issues uses componentKeys); with RUN_SONARQUBE_LIVE=1 it lists projects and reads the quality gate, measures and issues of the first one. Run it against both a SonarQube Server and SonarQube Cloud, and say in the PR which versions you tested. npx jest src/adapters/intl/sonarqube passes in packages/backend.
• Logo at packages/frontend/public/logos/connectors/sonarqube.svg.
• instructions cover the three URL cases, which token type to create, SONARQUBE_ORGANIZATION for Cloud, the private-network / SSRF_ALLOWED_HOSTS rule, the quality-gate fallback and the 429 rate limit on Cloud ("wait a few minutes", per the Cloud Web API page).
• Docs updated: optional content/guides/en/sonarqube-to-mcp.mdx.

Out of scope

• Any write: issue transitions, assignments and comments, quality gate and quality profile changes, project creation or deletion, token management.
• Security hotspots (api/hotspots/*): Cloud marks them deprecated since 16 June 2026, replaced by security issues, which sonarqube_search_issues already covers.
• Web API v2, portfolios and applications, administration and system endpoints.
• New-code filters on issues: the parameter is inNewCodePeriod on Server and sinceLeakPeriod on Cloud. It can come in a follow-up.

Free / test account: SonarQube Cloud is free for public projects, and for private projects up to 50k lines of code (https://www.sonarsource.com/plans-and-pricing/sonarcloud/). Import any public GitHub repo to get data. For Server, run the Community Build locally: docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest, log in at http://localhost:9000 as admin/admin, and analyze a small project (https://docs.sonarsource.com/sonarqube-community-build/try-out-sonarqube/).

Size

S (a few hours)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #997.