Can AI agents automate SonarQube?

SonarQube is automatable today through a documented Web API. This record is SonarQube Server and SonarQube Cloud code quality and security analysis, including the first-party SonarQube MCP Server. It is not Snyk. Server and Cloud both expose REST Web API v1 and a newer v2. Recommended auth is a user token in the Authorization: Bearer header. Cloud bases include https://sonarcloud.io (EU) and https://sonarqube.us (US); some Cloud APIs are rate-limited and return HTTP 429. Documented resources include measures, issues, projects, quality gates, and related administration. SonarSource documents a first-party MCP server licensed under the SONAR Source-Available License. That license is commercial source-available, not an OSI open-source grant. Cloud hosts a managed MCP at https://api.sonarcloud.io/mcp (US: https://api.sonarqube.us/mcp) with a fixed, smaller tool subset; heavy analysis, Vortex context, and IDE-bridge tools are unavailable there. SonarQube Server 2026.3+ on Developer, Enterprise, or Data Center can expose tools at /mcp without a separate container. Docker image sonarsource/sonarqube-mcp remains the self-hosted and local STDIO path and is the documented way to get the full tool set. MCP tools cover analysis, issues, quality gates, security hotspots, coverage, projects, dependency risks, and optional Vortex context. The SonarScanner CLI (sonar-scanner) is the official CI analysis scanner, authenticated with SONAR_TOKEN; it is not the newer sonar admin CLI and is the wrong scanner for Maven, Gradle, .NET, C#, and VB.NET projects. iPaaS connectors were not opened. Computer-use viability is unassessed. API scores 8 and is the best path. MCP stays at 7 because Cloud MCP is a reduced subset and Server /mcp needs 2026.3+ on a paid edition.

Best path today: api · Overall automatability: 8/10