SonarQube MCP server

A Codex marketplace plugin that connects Codex with SonarQube-based code analysis. It adds secrets-detection and verification hooks, skills for listing SonarQube issues, MCP configuration, context augmentation, and agents.md directives. In the demonstrated workflow, SonarQube findings are brought into the coding loop so Codex can inspect issues such as SQL injection, replace vulnerable string interpolation with a parameterized query, and verify the edited code again.

SonarQube CLI is a command-line interface from SonarSource for running SonarQube code-quality and security checks from a terminal. It authenticates with SonarQube Cloud or a self-hosted SonarQube Server, lists projects and issues, scans files for hardcoded secrets, and analyzes uncommitted changes for new issues when used with SonarQube Cloud Agentic Analysis. The CLI supports interactive use, JSON, table, CSV, and token-efficient TOON output for scripting and AI workflows. It can install integrations for Claude Code, GitHub Copilot CLI, Codex, Cursor, and Antigravity, including pre-tool-use secret scanning, SonarQube analysis, and an MCP server for accessing SonarQube data. Git pre-commit and pre-push hooks are also supported. It can be installed with Homebrew, Mise, or platform-specific scripts on Linux, macOS, and Windows. Authentication uses browser login or environment variables such as SONARQUBE_CLI_TOKEN, with organization or server settings supplied separately. The project is released under the GNU Lesser General Public License, version 3.0, and collects anonymous usage and error data by default with an opt-out setting.

A SonarQube plugin for OpenAI Codex that brings Sonar's code-quality and security checks into the agent's coding loop. It provides a secrets-detection hook that blocks credentials in prompts, a list-issues skill backed by SonarQube's MCP server, context augmentation that supplies project guidelines before generation, and agentic analysis that scans edits server-side as they are made. The workflow can surface findings such as SQL injection data flows, guide the agent toward fixes such as parameterized queries, and verify the resulting edits through another check.

SonarQube Cloud is a hosted static-analysis platform from Sonar that scans software projects for bugs, security vulnerabilities, secrets, and other code-quality issues, then presents findings in a project dashboard. In the demonstrated workflow, it follows user-controlled data into database execution to identify a SQL-injection vulnerability, provides guidance for fixing it, and verifies the edited code after the fix replaces string interpolation with a parameterized query. The workflow can be connected to coding agents through Sonar's CLI, plugin, hooks, skills, and MCP server so that context, issue listings, secrets checks, and verification run within the coding loop.

Docker MCP Gateway is an MCP gateway and Docker CLI plugin for configuring, running, and connecting MCP servers to AI clients. It routes requests between clients and MCP servers running in isolated Docker containers through a unified interface, allowing tools, resources, and prompts from multiple servers to be managed through one gateway endpoint. Servers are grouped into profiles that can be connected to clients, exported, shared through OCI registries, and configured with tool allowlists. The gateway supports stdio and streaming transports, dynamic tool and resource discovery, server lifecycle management, logging and call tracing, secrets management, and OAuth flows. It can run with Docker Desktop or independently, and the repository is licensed under the MIT License.