SonarQube CLI

An MCP server for SonarQube that runs in Docker and exposes skills such as issue listing, allowing Codex to retrieve findings from a SonarQube project dashboard in the terminal. In the described workflow, it provides security-analysis evidence inside an agent coding loop, alongside SonarQube's CLI, plugin, hooks, and verification steps.

SonarQube Cloud is a hosted static-analysis platform from Sonar that scans software projects for bugs, security vulnerabilities, secrets, and other code-quality issues, then presents findings in a project dashboard. In the demonstrated workflow, it follows user-controlled data into database execution to identify a SQL-injection vulnerability, provides guidance for fixing it, and verifies the edited code after the fix replaces string interpolation with a parameterized query. The workflow can be connected to coding agents through Sonar's CLI, plugin, hooks, skills, and MCP server so that context, issue listings, secrets checks, and verification run within the coding loop.

A SonarQube plugin for OpenAI Codex that brings Sonar's code-quality and security checks into the agent's coding loop. It provides a secrets-detection hook that blocks credentials in prompts, a list-issues skill backed by SonarQube's MCP server, context augmentation that supplies project guidelines before generation, and agentic analysis that scans edits server-side as they are made. The workflow can surface findings such as SQL injection data flows, guide the agent toward fixes such as parameterized queries, and verify the resulting edits through another check.

SonarQube is a named software product. The supplied page does not describe SonarQube; it describes Gitar, an AI-powered code review and pull-request automation tool from Sonar.

A Codex marketplace plugin that connects Codex with SonarQube-based code analysis. It adds secrets-detection and verification hooks, skills for listing SonarQube issues, MCP configuration, context augmentation, and agents.md directives. In the demonstrated workflow, SonarQube findings are brought into the coding loop so Codex can inspect issues such as SQL injection, replace vulnerable string interpolation with a parameterized query, and verify the edited code again.