Sonarqube Check
This skill executes SonarQube checks to analyze code quality and identify potential bugs/vulnerabilities for improved security & maintainability.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add sonarqube-check npx -- -y @trustedskills/sonarqube-check
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"sonarqube-check": {
"command": "npx",
"args": [
"-y",
"@trustedskills/sonarqube-check"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill allows AI agents to trigger and analyze SonarQube code quality scans. It can be used to identify potential bugs, vulnerabilities, and maintainability issues within a codebase. The results are presented in a structured format for review and action.
When to use it
- Automated Code Reviews: Integrate into CI/CD pipelines to automatically check code quality on every commit or pull request.
- Security Audits: Run scans before releasing new software versions to proactively identify security vulnerabilities.
- Refactoring Initiatives: Assess the impact of refactoring efforts by comparing SonarQube metrics before and after changes.
- Technical Debt Management: Track code quality trends over time to prioritize areas for improvement and reduce technical debt.
Key capabilities
- Triggers SonarQube analysis
- Analyzes code quality results
- Presents structured output
Example prompts
- "Run a SonarQube scan on the
my-projectrepository." - "What are the critical vulnerabilities found in the latest SonarQube report for
backend?" - "Compare the technical debt of
frontendbetween last week and this week based on SonarQube data."
Tips & gotchas
- Requires a configured SonarQube instance with appropriate project access.
- The skill's output will depend on the quality rules and configuration within your SonarQube environment.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.