{
 "categories": [
  "developer-tools",
  "quality-management"
 ],
 "deployment": "hybrid",
 "evidence": [
  {
   "date": "2026-09-03",
   "fact": "homepage",
   "note": "SonarSource presents SonarQube Cloud as managed SaaS and SonarQube Server as self-managed static analysis for quality, reliability, and security.",
   "source": "https://www.sonarsource.com/products/sonarqube/",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "license",
   "note": "The opened SONAR Source-Available License v1.0.1 grants use only for a Non-competitive Purpose and is not an OSI open-source license. The product record therefore uses commercial.",
   "source": "https://www.sonarsource.com/license/ssal/",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.exists",
   "note": "SonarQube Server documents a Web API and a Web API v2. Built-in help in the product lists the web services. A sample GET /api/measures/component call is shown.",
   "source": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.kinds[0]",
   "note": "SonarQube Cloud documents HTTPS Web API v1 and v2. Example calls use curl GET with JSON responses.",
   "source": "https://docs.sonarsource.com/sonarqube-cloud/appendices/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.auth[0]",
   "note": "SonarQube Server recommends bearer authentication with a user-type token in the Authorization: Bearer header. Cloud docs use the same Bearer scheme with a personal access token.",
   "source": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.coverage",
   "note": "Cloud Web API v2 lists analysis, authentication, audit logs, organizations, projects, quality gates, SCA, users, and related domains. v1 still documents measures. That is the analysis and administration API, not every UI action.",
   "source": "https://docs.sonarsource.com/sonarqube-cloud/appendices/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.mcp.first_party",
   "note": "SonarSource documents a first-party SonarQube MCP Server that exposes analysis, issues, quality gates, security hotspots, coverage, projects, dependency risks, and Vortex context tools.",
   "source": "https://docs.sonarsource.com/sonarqube-mcp-server/about-the-mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.cli.exists",
   "note": "SonarSource documents the official SonarScanner CLI (sonar-scanner) for CI analysis, with zip, Docker, SONAR_TOKEN, and SONAR_HOST_URL. The page distinguishes it from the newer sonar admin CLI.",
   "source": "https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.data_access.export[0]",
   "note": "The documented /api/measures/component example returns a JSON component object with a measures array.",
   "source": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.api",
   "note": "The Web API is documented, read/write for measures and administration, and uses bearer user tokens on Server and Cloud. Official language SDKs were not established, so the path is broad rather than unusually complete.",
   "source": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.mcp",
   "note": "Cloud managed MCP at api.sonarcloud.io/mcp is official but exposes a fixed smaller tool subset. Heavy analysis, Vortex context, and IDE-bridge tools need local STDIO. Server /mcp needs 2026.3+ on Developer or higher.",
   "source": "https://docs.sonarsource.com/sonarqube-mcp-server/setup/sonarqube-cloud-hosted",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.cli",
   "note": "sonar-scanner is the official CI analysis CLI with token auth and Docker. It does not administer the server and is the wrong scanner for Maven, Gradle, .NET, C#, and VB.NET, so the path is maintained and practical rather than complete.",
   "source": "https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[0].url",
   "note": "Opened the SonarQube MCP about page. It documents tool categories, supported clients, SSAL licensing, and telemetry.",
   "source": "https://docs.sonarsource.com/sonarqube-mcp-server/about-the-mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[1].url",
   "note": "Opened the MCP product page. It documents Cloud native MCP, Docker for Server or local use, and Server 2026.3+ /mcp without a separate container.",
   "source": "https://www.sonarsource.com/products/sonarqube/mcp-server/",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current SonarQube Server Web API page, including bearer user-token auth and the measures example.",
   "source": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current SonarScanner CLI page, including SONAR_TOKEN, Docker, and the Maven/Gradle/.NET exclusion.",
   "source": "https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-03",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://docs.sonarsource.com/sonarqube-mcp-server/about-the-mcp-server"
   },
   {
    "type": "mcp",
    "url": "https://www.sonarsource.com/products/sonarqube/mcp-server/"
   },
   {
    "type": "docs",
    "url": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api"
   },
   {
    "type": "docs",
    "url": "https://docs.sonarsource.com/sonarqube-server/analyzing-source-code/scanners/sonarscanner"
   }
  ]
 },
 "homepage": "https://www.sonarsource.com/products/sonarqube/",
 "id": "sonarqube",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": "unknown"
  },
  "api": {
   "auth": [
    "bearer-user-token"
   ],
   "coverage": "partial",
   "docs": "https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "api-json"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. SonarQube's Web API, sonar-scanner CLI, and first-party MCP (Cloud managed, Server /mcp, or Docker) cover practical quality-gate automation without browser control.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "SonarQube",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "github",
   "gitlab",
   "sentry"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "SonarSource",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": 7,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 8,
   "rpa": null
  },
  "summary": "SonarQube is automatable today through a documented Web API. This record is SonarQube Server and SonarQube Cloud code quality and security analysis, including the first-party SonarQube MCP Server. It is not Snyk. Server and Cloud both expose REST Web API v1 and a newer v2. Recommended auth is a user token in the Authorization: Bearer header. Cloud bases include https://sonarcloud.io (EU) and https://sonarqube.us (US); some Cloud APIs are rate-limited and return HTTP 429. Documented resources include measures, issues, projects, quality gates, and related administration. SonarSource documents a first-party MCP server licensed under the SONAR Source-Available License. That license is commercial source-available, not an OSI open-source grant. Cloud hosts a managed MCP at https://api.sonarcloud.io/mcp (US: https://api.sonarqube.us/mcp) with a fixed, smaller tool subset; heavy analysis, Vortex context, and IDE-bridge tools are unavailable there. SonarQube Server 2026.3+ on Developer, Enterprise, or Data Center can expose tools at /mcp without a separate container. Docker image sonarsource/sonarqube-mcp remains the self-hosted and local STDIO path and is the documented way to get the full tool set. MCP tools cover analysis, issues, quality gates, security hotspots, coverage, projects, dependency risks, and optional Vortex context. The SonarScanner CLI (sonar-scanner) is the official CI analysis scanner, authenticated with SONAR_TOKEN; it is not the newer sonar admin CLI and is the wrong scanner for Maven, Gradle, .NET, C#, and VB.NET projects. iPaaS connectors were not opened. Computer-use viability is unassessed. API scores 8 and is the best path. MCP stays at 7 because Cloud MCP is a reduced subset and Server /mcp needs 2026.3+ on a paid edition.\n"
 }
}