// SCAN REPORT

Sonarcube

12 tools. 0 can modify or destroy data without limits.

Read-only server. Low risk, but rate limits prevent runaway API costs.

Last updated: 30 Jun 2026

0 can modify or destroy data

12 read-only

12 tools total

Community server · catalogue entry verified 30/06/2026

How to control Sonarcube ↓

TOOL MAP

What Sonarcube exposes to your agents

Read (12) Write / Execute (0) Destructive / Financial (0)

Running more than one server? Check your whole stack →

THE RISK

What can go wrong

Even read-only tools carry cost. An agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up bills.

POLICY

How to control Sonarcube

PolicyLayer is an MCP gateway — it sits between your AI agents and Sonarcube, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "sq_get_component_tree": {
    "limits": [
      {
        "counter": "sq_get_component_tree_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Sonarcube — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON SONARCUBE →

Instant setup, no code required.

FULL CATALOGUE

All 12 Sonarcube tools

READ 12 tools

Read sq_get_component_tree Get project file tree with metrics — find files with worst coverage or most issues Read sq_get_hotspot Get detailed information about a specific security hotspot Read sq_get_issue Get detailed information about a specific issue including its location, rule, and remediation effort Read sq_get_measures Get project metrics such as coverage, bugs, vulnerabilities, duplication, tech debt, and ratings Read sq_get_measures_history Get metrics history over time to track trends and regressions Read sq_get_project Get a detailed project overview with quality gate status and key metrics Read sq_get_quality_gate Get quality gate status for a project — shows passed/failed conditions and thresholds Read sq_get_rule Get detailed information about an analysis rule — description, remediation, examples Read sq_list_projects List SonarQube projects with their quality status and key metrics Read sq_search_hotspots Search security hotspots needing review for a project Read sq_search_issues Search for issues (bugs, vulnerabilities, code smells) with filtering by severity, type, file, rule, etc. Read sq_search_rules Search analysis rules by language, type, severity, or tags

FAQ

Questions about Sonarcube

Is the Sonarcube MCP server safe to use without restrictions? +

The Sonarcube server is primarily read-only with 12 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Sonarcube MCP server expose? +

12 tools across 1 categories: Read. 12 are read-only. 0 can modify, create, or delete data.

How do I enforce a policy on Sonarcube? +

Register the Sonarcube MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Sonarcube tool call.

Deterministic rules across all 12 Sonarcube tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON SONARCUBE →

Instant setup, no code required.

12 Sonarcube tools catalogued and risk-classified — across an index of 43,000+ MCP servers.