claudecodex

sonarqube

SonarQube is the AI code quality and security verification platform used by millions of developers to catch bugs, vulnerabilities, and leaked secrets. This plugin enforces those standards in the agent coding loop: 7,500+ distinct issue types, secrets scanning, agentic analysis, and quality gates across 40+ languages.

114 on GitHubby Sonarv2.7.0SSAL-1.0updated 8 days agoCode Review
/

Plugin sonarqube from marketplace sonar in SonarSource/sonarqube-agent-plugins. Commands read from the repo's manifest — 6 days ago.

What it installs

Skills (10)

  • sonar-analyze

    Analyze a file for quality and security issues using SonarQube

  • sonar-coverage

    Find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)

  • sonar-dependency-risks

    Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)

  • sonar-duplication

    Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)

  • sonar-fix-issue

    Fix a specific SonarQube issue in code by rule key and location

  • sonar-integrate

    Installs sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube.

  • sonar-list-issues

    Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)

  • sonar-list-projects

    List SonarQube projects accessible to the current user

  • sonar-quality-gate

    Show SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project key optional — resolved from `sonar-project.properties` or the MCP integration default.

  • sonar-triage-dependency-risks

    Triage SonarQube SCA dependency risks by CVE reachability, prepare safe UI writeups, and optionally bundle confirmed package fixes.

Subagents (1)

  • sonarqube-reviewer

    Reviews code changes against SonarQube quality, security, and dependency-risk standards by composing this plugin's sonar-* skills. Use proactively before merging a PR or when the user asks for a SonarQube-based code review, a second opinion on code quality, or to "review my changes with SonarQube.

View source on GitHub sonarsource.com

Similar plugins

mattpocock-skills

claude

Matt Pocock's agent skills for real engineering (grilling, spec/ticket flows, TDD, code review, domain modelling and more).

39 skills

mattpocock/skills 323,108

open-code-review

claude

Perform AI code review on Git diffs — supports workspace changes, branch ranges, and single commits with concurrent per-file analysis, codebase search, and deep context-aware review.

2 commands

alibaba/open-code-review 50,068

gitnexus

claudecodex

Code intelligence powered by a knowledge graph. Provides execution flow tracing, blast radius analysis, and augmented search across your codebase.

12 skills · 1 MCP server · hooks

abhigyanpatwari/GitNexus 48,482

agent-teams

claudecodex

Orchestrate multi-agent teams for parallel code review, hypothesis-driven debugging, and coordinated feature development using Claude Code's Agent Teams

6 skills · 7 commands · 4 agents

wshobson/agents 42,461

codex

claude

Use Codex from Claude Code to review code or delegate tasks.

3 skills · 8 commands · 1 agent · hooks

openai/codex-plugin-cc 35,098

prowler

claude

Connect Claude to Prowler Cloud through the Prowler MCP server. Reads providers, scans, findings, compliance results and resources for AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub and the other providers listed at https://registry.prowler.com, and returns remediation guidance for failed checks. Writes are limited to Prowler Cloud itself: triggering scans, finding triage, mute rules and the mutelist, providers and integrations. Your cloud resources are not changed by the connector.

1 skill · 1 MCP server

prowler-cloud/prowler 15,234

Maintain sonarqube?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex pluginslisted