How to set up the SonarCloud MCP server

SonarQube Cloud analyzes code quality and security across organizations and projects. Its hosted MCP server supports OAuth sign-in and SonarQube user tokens.

This guide prepares SonarCloud for an MCP client. Dome does not currently provide a managed SonarCloud agent template; connect the server directly and govern the resulting connection in your own workspace.

Choose a connection method

Choose OAuth when the MCP client supports Client ID Metadata Documents (CIMD) and Sonar has approved the client metadata URL. Choose a dedicated user token for a headless client or one that cannot complete CIMD OAuth. See Sonar's Cloud-hosted MCP guide.

Recommended: OAuth

OAuth avoids a copied long-lived token, but it requires a client that supports CIMD. Sonar must approve unlisted client metadata before the connection can authorize.

1. Confirm the client supports OAuth with CIMD and that Sonar has approved its metadata URL.
2. Start sign-in from the MCP client and authorize the intended SonarQube Cloud identity.
3. Use the server's read-only header or tool filtering where available, then verify a known issue in a test project.
4. Confirm a project outside the user's membership is unavailable.

Alternative: User token

Use a dedicated user's SonarQube token when OAuth is unavailable. Keep the account's organization and project permissions narrow; a token represents that user.

• Create the token under a dedicated test user, store it only in secret storage, and record its owner and rotation date.
• Use SONARQUBE_READ_ONLY=true to suppress write tools when the MCP client can set that header.
• Do not send SONARQUBE_ORG with an OAuth connection; select the organization with the server's organization-aware tools instead.

Verify SonarCloud MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that SonarCloud MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved SonarCloud boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

If the server authenticates but gets no projects, check organization membership and project permissions. Revoke and regenerate a token that has been exposed; SonarCloud tokens cannot be safely recovered after disclosure.

Next steps

Create a governed agent in Dome using the connected SonarCloud server. Restrict it to the approved organization and projects, use a read-focused instruction set, and keep its model, tool, and access policies under review.