1.29.0.4488

SonarQube MCP Server v1.29.0

This release improves protocol compatibility, updates core dependencies, and includes internal code quality improvements.

Improvements

• Leaner tool responses — Output schemas are no longer advertised in tools/list and structured content is no longer duplicated alongside text responses, reducing payload size significantly on every conversation and tool call

Miscellaneous

• Updated SonarLint Core, Jetty, Logback, Commons Lang, Jackson, and other dependencies
• Bumped Context Augmentation (CAG) to 0.23.0.5451
• Internal code quality refactors (stream pipeline in ServerApiHelper, reduced cognitive complexity in fetch_jira_ticket)
• Gradle updated to 9.8.1

1.28.0.4397

SonarQube MCP Server v1.28.0

This release fixes a SonarQube version check edge case and ships internal dependency and tooling updates.

Bug Fixes

• Fixed the minimum version check to correctly enforce SonarQube Server 2025.1+ and SonarQube Cloud Business 25.1+, which previously allowed the unsupported SQCB 24.12 release

Miscellaneous

• Updated sonarlint-core to 11.11.0.87410 and aligned the Jackson dependency pin accordingly
• Bumped context augmentation to 0.22.0.4777
• Updated miscellaneous dependencies (ayza, Mockito, Jetty)
• Removed shadow scan workflows from CI

1.27.0.4335

SonarQube MCP Server v1.27.0

This release adds tag filtering for issue searches, fixes a critical startup failure in containerized environments, and resolves missing New Code metric values in component measures.

Features

• Tag filter for issue search — search_sonar_issues_in_projects now accepts a tags parameter, enabling server-side filtering by issue tag (e.g. to isolate issues from a specific source) without pulling and filtering results client-side.

Bug Fixes

• Container startup failure — Fixed a crash on startup when HOME is not set in the container environment (e.g. Kubernetes). The server now resolves SLCORE's user home and work directory from STORAGE_PATH, preventing the Cannot create directory '/.sonarlint' error that left all analysis tools unavailable for the pod's lifetime.
• Missing New Code metric values — get_component_measures now correctly returns values for New Code period metrics on branches. Previously, these values were silently dropped because SonarQube returns them under periods rather than the top-level value field.

Miscellaneous

• Analyzer downloads for SonarQube Cloud now use the CloudFront CDN instead of the Web API, improving download performance and reliability.
• Updated context augmentation bundle to 0.20.0.4545.
• Dependency updates and CVE fixes, including Jackson Core (CVE-2026-83557) and Logback.

1.26.0.4269

SonarQube MCP Server v1.26.0

This release improves issue triage workflows, expands new code filtering, enhances startup error reporting, and resolves a security vulnerability.

New Features

• New code filtering — Tools now support filtering results on new code, allowing you to focus analysis and triage on recently introduced issues
• Comment on issue status change — The change_sonar_issue_status tool now accepts an optional comment parameter, letting you attach a justification or note when transitioning an issue's status — matching the existing behavior of the hotspot status change tool
• Clearer startup error messages — When the MCP Server fails to start in stdio mode (e.g. due to a missing token, URL, or organization), it now responds to the MCP initialize request with a descriptive error message instead of silently closing the connection

Security

• Bumped Jackson dependencies to address CVE-2026-77310 (SSRF, medium severity)

Miscellaneous

• Enabled Vortex (run_advanced_code_analysis) tools on SonarQube Server when both required hubs are entitled — foundational work aligning Server entitlement with SonarQube Cloud (in progress)
• Internal code quality improvements and refactoring

1.25.0.3221

SonarQube MCP Server v1.25.0

This release introduces the new vortex and ide toolsets for Vortex-enabled organizations, deprecates analyze_code_snippet in that context, and fixes an HTTPS liveness probe failure on Kubernetes.

Features

• vortex toolset — Organizations entitled to Vortex now have a unified vortex toolset available. Set SONARQUBE_TOOLSETS=vortex to activate it. Tools previously reachable via the analysis toolset remain accessible through it as well.
• ide toolset — IDE bridge analysis tools (analyze_file_list, toggle_automatic_analysis) are now also available under a dedicated ide toolset, reflecting their distinct purpose from Vortex analysis.
• Deprecation of analyze_code_snippet — When the vortex toolset is active for your organization, analyze_code_snippet is automatically disabled to avoid conflicting analysis tools.

Bug Fixes

• Fixed HTTPS liveness probe returning 400 Invalid SNI when kubelet probes via pod IP on Kubernetes with TLS enabled, which was causing unnecessary pod restarts.

Miscellaneous

• Updated dependencies, including sonarlint-core, Jetty, and Gradle.
• Added telemetry for Vortex toolset adoption.

1.24.0.3152

SonarQube MCP Server v1.24.0

This release improves the analyze_file_list tool by exposing rule keys in its output, making it easier for AI agents to look up further rule details after an analysis.

Bug Fixes

• analyze_file_list now returns the rule key — Analysis results now include the rule key for each issue, allowing AI agents to seamlessly look up additional rule details using the get_rule_details tool. Previously, agents had no way to retrieve this information from analysis output alone.

Miscellaneous

• Updated Context Augmentation (CAG) to 0.19.0.3620 and bumped SonarLint Core to 11.8.0.86067.
• Internal dependency and CI tooling updates.

1.23.0.3101

SonarQube MCP Server v1.23.0

This release simplifies SonarQube Cloud setup with auto-detected organizations, expands branch visibility for AI agents, adds mTLS client certificate support, and fixes inconsistent tool parameter names.

Features

• Auto-detect SonarQube Cloud organization — When your token is associated with a single organization, SONARQUBE_ORG is no longer required in stdio mode. The server now detects and applies it automatically at startup, with SONARQUBE_ORG still honored as an explicit override.
• Short-lived branch support in list_branches — list_branches now returns all analyzed branches, including short-lived branches on SonarQube Cloud. An optional branchTypes filter (ALL, LONG, SHORT) lets agents narrow results, and mergeBranch is now exposed for short-lived branches.
• mTLS client certificate configuration — The MCP Server can now be configured to use a mounted client certificate (PKCS12 keystore) for mutual TLS, enabling deployments in enterprise networks that require client authentication.

Bug Fixes

• Consistent parameter names across tools — Parameter names were inconsistent across tools (e.g. projects vs projectKey, p/ps vs pageIndex/pageSize, branchName vs branch), causing agents to silently pass wrong values and receive unfiltered results. Parameters have been standardized: projectKeys, pageIndex/pageSize, and branch are now the canonical names.

Miscellaneous

• Added AI agent rule files to the repository to improve code generation consistency.

1.22.0.3040

SonarQube MCP Server v1.22.0

This release adds agentic-readiness assessment tools, strengthens supply chain security for the Docker image, hardens plugin synchronization against path traversal and hash tampering, and includes several internal maintenance updates.

Features

• Agentic-readiness assessment tools (SonarQube Cloud only) — Added three new tools for entitled SonarQube Cloud customers to trigger and poll Sonar Agentic Readiness Assessment (SARA) directly from an AI agent: start_agentic_readiness_assessment, get_agentic_readiness_assessment, and related polling support

Security

• Docker image supply chain attestations — Published Docker images now include an SBOM and max-mode provenance attestations, improving the Docker Scout supply chain health score
• Plugin path traversal prevention — The plugin synchronizer now validates plugin filenames and confines all resolved paths strictly within the plugins storage directory, preventing potential directory traversal attacks
• Plugin integrity verification — Downloaded plugin bytes are now verified against the MD5 hash returned by the server before use, ensuring plugins have not been tampered with

Miscellaneous

• Removed Gemini extension-related files (gemini-extension.json and GEMINI.md) that had been migrated to a separate repository

1.21.0.2975

SonarQube MCP Server v1.21.0

This release fixes a connectivity regression in HTTP(S) mode that blocked MCP clients from connecting to the hosted MCP in SonarQube Cloud, and self-hosted deployments.

Improvements

• Improved Context Augmentation — Enhanced Context Augmentation for existing tools to help LLMs select and use tools more effectively, improving tool-calling accuracy while reducing token consumption.

Bug Fixes

• MCP client connectivity in HTTP mode — Fixed 403 Origin not allowed errors that prevented MCP clients (Cursor, OpenCode, Claude Desktop, etc.) from connecting to the hosted MCP in SonarQube Cloud (https://api.sonarcloud.io/mcp) and self-hosted deployments.

1.20.0.2929

SonarQube MCP Server v1.20.0

⚠️ Important: New releases are published under sonarsource/sonarqube-mcp; switch from mcp/sonarqube to stay up to date.

This release restores branch support across relevant tools, improves code snippet analysis with broader language handling, fixes several silent failure scenarios, strengthens configuration behavior around CORS and Docker deployments, and upgrades to MCP Java SDK 2.0.0.

Features

• Branch parameter restored — The branch parameter is back on relevant tools, with improved guidance on when to use it (long-lived branches only; short-lived branches are tied to pull requests)
• New list_branches tool — Lists long-lived branches to discover valid branch values before calling other tools
• Expanded language support in analyze_code_snippet — The tool now correctly handles additional language variants, including tsx and jsx, by creating temporary files with the appropriate extensions before analysis. This ensures language-specific parsers and rules are applied correctly, fixing the original TSX/JSX issue and enabling more accurate analysis across a wider range of languages and file types instead of silently reporting zero issues.
• CORS decoupled from bind address — Setting SONARQUBE_HTTP_HOST=0.0.0.0 (required for Docker port mapping) no longer implicitly allows all browser origins. Use the now-documented SONARQUBE_HTTP_ALLOWED_ORIGINS variable to explicitly allow additional origins

Bug Fixes

• Fixed analyze_code_snippet silently returning zero issues for .tsx/.jsx snippets when language was set to ts or js
• Fixed blank optional string arguments (e.g. an empty pullRequest field) being forwarded as empty query parameters, causing SonarQube Server to reject the request
• Fixed certificate installation scripts writing informational messages to stdout in Docker stdio mode, which could corrupt the MCP client handshake
• Fixed incorrect Docker environment variable names in the GitHub Copilot coding agent README example, which caused authentication to silently fail

Improvements

• Upgraded to MCP Java SDK 2.0.0, aligning with the 2025-11-25 MCP specification and enabling stricter tool input validation
• Documented the SONARQUBE_HTTP_ALLOWED_ORIGINS environment variable and clarified that 0.0.0.0 controls the listen address only, not CORS policy
• Documented the sonarsource/sonarqube-mcp Docker image for users who need versioned image pinning
• Documented the standalone JAR download location at binaries.sonarsource.com for users who prefer to run without Docker

Breaking Changes

• Tool arguments have been renamed and aligned: branchKey/pullRequestKey/pullRequestId → branch/pullRequest