feat(adapters): add read-only SonarQube adapter (#1240) - #1317

Summary

Adds a read-only SonarQube adapter (intl/sonarqube.json) that works with both SonarQube Server and SonarQube Cloud through the v1 Web API, as planned in #1240. An AI client can now answer questions like "did payments-api pass its quality gate?", "list the open high-severity security issues" or "how has coverage changed since June?".

Changes

• packages/backend/src/adapters/intl/sonarqube.json: REST adapter on {{SONARQUBE_URL}}/api with BEARER_TOKEN auth. Requires SONARQUBE_URL and SONARQUBE_TOKEN; SONARQUBE_ORGANIZATION is optional. Category infrastructure, probe sonarqube_list_projects. 7 tools, all GET and read-only:

  • sonarqube_list_projects (/components/search)
  • sonarqube_get_quality_gate_status (/qualitygates/project_status)
  • sonarqube_get_measures (/measures/component)
  • sonarqube_get_measures_history (/measures/search_history)
  • sonarqube_search_issues (/issues/search)
  • sonarqube_list_project_analyses (/project_analyses/search)
  • sonarqube_list_branches (/project_branches/list)

• Server vs Cloud differences, handled as the issue describes:

  • Listing projects always sends qualifiers=TRK. organization is mapped as ${SONARQUBE_ORGANIZATION}, so it is sent on Cloud and left out when the variable is empty (Server).
  • Issue search uses componentKeys and the impact filters (issueStatuses, impactSeverities, impactSoftwareQualities), never the deprecated types, severities or statuses.
  • The instructions name the quality-gate fallback (metricKeys=alert_status,quality_gate_details) and suggest the software_quality_* metrics.
  • The probe is not api/authentication/validate: sonarcloud.io answers {"valid":true} to it without a token.

• envVarMeta with an address pattern that refuses /api and a trailing slash and keeps a context path such as /sonarqube. verifyHints cover 400 (missing organization on Cloud), 401, 403, 404 and rate limiting.

• The instructions cover the three URL cases, which token to create (User token on Server; Personal Token under My account → Access tokens on Cloud), SONARQUBE_ORGANIZATION, SSRF_ALLOWED_HOSTS, the quality-gate fallback, pagination and the 429 rate limit on Cloud.

• intl/sonarqube.live.spec.ts: static checks run every time:

  • Bearer auth on {{SONARQUBE_URL}}/api, and every tool is GET with readOnlyHint and no body.
  • The URL of every tool, plus a Server context path.
  • qualifiers=TRK with and without organization; componentKeys with the impact filters.
  • The envVarMeta patterns, and that the probe isn't authentication/validate.

  The live tests run with RUN_SONARQUBE_LIVE=1. They list projects, then read the quality gate, measures, history, issues, analyses and branches of the first project.

• Logo packages/frontend/public/logos/connectors/sonarqube.svg (Simple Icons, CC0) and guide content/guides/en/sonarqube-to-mcp.mdx.

• catalog.ts regenerated. Quoted counts 561 → 562 adapters, as adapter-count.mjs --check asked, in README*.md, CITATION.cff, glama.json, package.json and server.json. llms.txt and llms-full.txt regenerated.

Self-hosted vs Cloud: adapter JSON only, with no backend, frontend or ee/ code change. Self-hosted works with SonarQube Cloud and any SonarQube Server it can reach; a Server on a private network needs its host in SSRF_ALLOWED_HOSTS. On AnythingMCP Cloud, it works with SonarQube Cloud or a publicly reachable Server.

Type

• New feature
• Documentation

Testing

• Added/updated unit tests
• Tested manually (describe steps below)

SonarQube versions tested:

• SonarQube Cloud 8.0.0.114649 (api/server/version, EU region): live spec run with a personal token and a private project in my organization.
• SonarQube Server: not tested live. I had no Docker available, and the public next.sonarqube.com instance now redirects to sonarsource.com. The Server-specific behaviour is covered by the static spec only: qualifiers=TRK, no organization when it is empty, and a context path. I'm happy to add a Community Build run if you'd like one before merging.

Without a token, I also called each tool's exact request on public SonarQube Cloud projects:

• All 7 endpoints return 200.
• Leaving out organization on components/search returns 400 "The 'organization' parameter is missing".
• The impact filters on issues/search return issues with impacts.
• qualitygates/project_status still answers on Cloud.

Commands run on macOS with Node 22.23.3:

I didn't run the full backend npm test or the frontend checks: this PR changes only adapter JSON, its spec, the generated catalog, a logo, a guide and quoted counts.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• The adapter catalog tests and the new spec pass (full backend npm test not run, see above)
• This PR has a descriptive title

Related Issues

Closes #1240

🤖 Generated with Claude Code