Install
$ agentstack add mcp-lreimer-sonar-mcp-server ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Sonar MVP Server
An MCP server implementation for the SonarQube Cloud API in Golang.
Build and Release
# to quickly build the latest snapshot
goreleaser build --snapshot --clean
goreleaser release --skip=publish --snapshot --clean
Usage Instructions
If you want to use the tool locally, e.g. with Claude Desktop, use the following configuration for the MCP server.
{
"mcpServers": {
"sonar": {
"command": "/Users/mario-leander.reimer/Applications/sonar-mcp-server",
"args": ["-t", "stdio"],
"env": {
"SONAR_TOKEN": ">"
}
}
}
}
Alternatively, you can use the MCP introspector for easy local development:
# as stdio binary
npx @modelcontextprotocol/inspector go run main.go
# as SSE server using
go run main.go --transport sse
npx @modelcontextprotocol/inspector npx mcp-remote@next http://localhost:8080/sse
npx @modelcontextprotocol/inspector
Deployment
Currently using manual Google Cloud Run deployment. Can either be deployed directly from source or using the Docker image built on Github.
# create a new secret for the SONAR_TOKEN
gcloud services enable secretmanager.googleapis.com
print $SONAR_TOKEN | gcloud secrets create sonar-token --data-file=-
# next deploy the local build from source to Cloud Run
gcloud services enable run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com
gcloud secrets add-iam-policy-binding sonar-token \
--member=serviceAccount:343509396461-compute@developer.gserviceaccount.com \
--role=roles/secretmanager.secretAccessor
gcloud run deploy sonar-mcp-server --source=. \
--region=europe-north1 \
--port=8080 --allow-unauthenticated \
--set-secrets=SONAR_TOKEN=sonar-token:latest \
--set-env-vars=BASE_URL=https://sonar-mcp-server-343509396461.europe-north1.run.app
gcloud run services delete sonar-mcp-server --async --region=europe-north1
Maintainer
M.-Leander Reimer (@lreimer),
License
This software is provided under the MIT open source license, read the LICENSE file for details.
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: lreimer
- Source: lreimer/sonar-mcp-server
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.