How do I install the Sonarqube skill?

Run npx skillmds@latest add tomevault-io/sonarqube-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sonarqube safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sonarqube?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sonarqube free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sonarqube?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sonarqube by tomevault-io — Agent Skill

Name: Sonarqube
Author: tomevault-io

Sonarqube

Fetch and fix SonarQube code quality issues, coverage metrics, security hotspots, and quality gate status. Use when reviewing SonarQube findings for a project or pull request, checking code coverage, investigating security hotspots, verifying quality gate pass/fail, or searching for SonarQube projects. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

SonarQube

Interact with SonarQube to fetch code quality issues, coverage, and quality gate status.

Configuration

Run ./setup.sh from the repo root (recommended), or create config files manually:

mkdir -p ~/.boring/sonarqube
echo 'https://your-sonarqube.example.com' > ~/.boring/sonarqube/url
echo 'your-token' > ~/.boring/sonarqube/token
chmod 600 ~/.boring/sonarqube/token

For bearer auth (instead of default token-as-login), also create:

echo 'bearer' > ~/.boring/sonarqube/auth_method

Generate token: User → My Account → Security → Generate Tokens.

Scripts

Fetch issues

scripts/sonarqube-issues.sh <project-key> [pr-number] \
    [--status OPEN,CONFIRMED] [--severity CRITICAL,BLOCKER] \
    [--type BUG] [--branch main] [--limit 100]

Coverage metrics

scripts/sonarqube-coverage.sh <project-key> [pr-number] [--branch main]

For PRs, returns new code coverage. For branches/projects, returns overall coverage.

Security hotspots

scripts/sonarqube-hotspots.sh <project-key> [--pr N] [--branch main] [--status TO_REVIEW]

Quality gate status

scripts/sonarqube-quality-gate.sh <project-key> [--pr N] [--branch main]

Exits 0 if gate passes, 1 if it fails.

List/search projects

scripts/sonarqube-projects.sh [search-query] [--limit 50]

Transition an issue

scripts/sonarqube-transition.sh <issue-key> <transition> [--comment "text"]

Transitions: confirm, unconfirm, reopen, resolve, falsepositive, wontfix, accept

Mark issues as false positive, resolved, or won't fix. Optionally attach a comment explaining why.

Raw API

scripts/sonarqube-api.sh <endpoint> [curl-options...]

Workflow for fixing issues

S=scripts

# 1. Fetch issues for a PR
$S/sonarqube-issues.sh my-service 327

# 2. Check quality gate
$S/sonarqube-quality-gate.sh my-service --pr 327

# 3. Check coverage
$S/sonarqube-coverage.sh my-service 327

# 4. Check security hotspots
$S/sonarqube-hotspots.sh my-service --pr 327

# 5. Fix issues, verify compilation, commit

Common Java rules and fixes

Read references/common-rules.md for fix patterns for frequently triggered rules (S3457 logging concatenation, S2629 conditional invocation, S1128 unused imports, S5786 JUnit modifiers, etc.).

API reference

Issue search: GET /api/issues/search?componentKeys=KEY&pullRequest=N&issueStatuses=OPEN&severities=CRITICAL&types=BUG&ps=100

Measures: GET /api/measures/component?component=KEY&pullRequest=N&metricKeys=new_coverage,new_line_coverage

Quality gate: GET /api/qualitygates/project_status?projectKey=KEY&pullRequest=N

Hotspots: GET /api/hotspots/search?projectKey=KEY&status=TO_REVIEW

Dashboard URL: <SONARQUBE_URL>/dashboard?id=PROJECT_KEY&pullRequest=PR_NUMBER

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: sonarqube-2description: Fetch and fix SonarQube code quality issues, coverage metrics, security hotspots, and quality gate status. Use when reviewing SonarQube findings for a project or pull request, checking code coverage, investigating security hotspots, verifying quality gate pass/fail, or searching for SonarQube projects. Use when this capability is needed.---# SonarQubeInteract with SonarQube to fetch code quality issues, coverage, and quality gate status.## ConfigurationRun `./setup.sh` from the repo root (recommended), or create config files manually:```bashmkdir -p ~/.boring/sonarqubeecho 'https://your-sonarqube.example.com' > ~/.boring/sonarqube/urlecho 'your-token' > ~/.boring/sonarqube/tokenchmod 600 ~/.boring/sonarqube/token```For bearer auth (instead of default token-as-login), also create:```bashecho 'bearer' > ~/.boring/sonarqube/auth_method```Generate token: User → My Account → Security → Generate Tokens.## Scripts### Fetch issues```bashscripts/sonarqube-issues.sh <project-key> [pr-number] \ [--status OPEN,CONFIRMED] [--severity CRITICAL,BLOCKER] \ [--type BUG] [--branch main] [--limit 100]```### Coverage metrics```bashscripts/sonarqube-coverage.sh <project-key> [pr-number] [--branch main]```For PRs, returns new code coverage. For branches/projects, returns overall coverage.### Security hotspots```bashscripts/sonarqube-hotspots.sh <project-key> [--pr N] [--branch main] [--status TO_REVIEW]```### Quality gate status```bashscripts/sonarqube-quality-gate.sh <project-key> [--pr N] [--branch main]```Exits 0 if gate passes, 1 if it fails.### List/search projects```bashscripts/sonarqube-projects.sh [search-query] [--limit 50]```### Transition an issue```bashscripts/sonarqube-transition.sh <issue-key> <transition> [--comment "text"]```**Transitions:** `confirm`, `unconfirm`, `reopen`, `resolve`, `falsepositive`, `wontfix`, `accept`Mark issues as false positive, resolved, or won't fix. Optionally attach a comment explaining why.### Raw API```bashscripts/sonarqube-api.sh <endpoint> [curl-options...]```## Workflow for fixing issues```bashS=scripts# 1. Fetch issues for a PR$S/sonarqube-issues.sh my-service 327# 2. Check quality gate$S/sonarqube-quality-gate.sh my-service --pr 327# 3. Check coverage$S/sonarqube-coverage.sh my-service 327# 4. Check security hotspots$S/sonarqube-hotspots.sh my-service --pr 327# 5. Fix issues, verify compilation, commit```## Common Java rules and fixesRead [references/common-rules.md](references/common-rules.md) for fix patterns for frequently triggered rules (S3457 logging concatenation, S2629 conditional invocation, S1128 unused imports, S5786 JUnit modifiers, etc.).## API reference**Issue search:** `GET /api/issues/search?componentKeys=KEY&pullRequest=N&issueStatuses=OPEN&severities=CRITICAL&types=BUG&ps=100`**Measures:** `GET /api/measures/component?component=KEY&pullRequest=N&metricKeys=new_coverage,new_line_coverage`**Quality gate:** `GET /api/qualitygates/project_status?projectKey=KEY&pullRequest=N`**Hotspots:** `GET /api/hotspots/search?projectKey=KEY&status=TO_REVIEW`**Dashboard URL:** `<SONARQUBE_URL>/dashboard?id=PROJECT_KEY&pullRequest=PR_NUMBER`---> Converted and distributed by [TomeVault](https://tomevault.io/claim/rezkam) — claim your Tome and manage your conversions.

Frequently asked questions