Not in the top 1,000 by GitHub stars
SonarSource/sonarqube-agent-plugins
SonarQube Plugin for AI Agents
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/sonar-analyze/SKILL.md
Week of Nov 2, 2026 · +28 / −12 lines
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-coverage/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-dependency-risks/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-duplication/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-fix-issue/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Instructions only
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-integrate/SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
A local comparison is unavailable. You can inspect the recorded versions on GitHub.
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-list-issues/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Instructions only
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-list-projects/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Instructions only
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-quality-gate/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Network or broad shell
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
skills/sonar-triage-dependency-risks/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Not checked yet → After Instructions only
b62989418526 → 2f8b420d6bfc
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Not checked yet
First observation → b62989418526
No earlier version was observed for comparison.
Verified commit 2f8b420d6bfc333b68849be87ea6d7a640614f64
git clone --filter=blob:none --no-checkout https://github.com/SonarSource/sonarqube-agent-plugins.git .hotskills/sonarsource-sonarqube-agent-plugins && git -C .hotskills/sonarsource-sonarqube-agent-plugins checkout --detach 2f8b420d6bfc333b68849be87ea6d7a640614f64
# Copy each selected skill directory from .hotskills/sonarsource-sonarqube-agent-plugins into .claude/skills/<skill-name>/Heat
1.6- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- sonar-analyze
skills/sonar-analyze - sonar-coverage
skills/sonar-coverage - sonar-dependency-risks
skills/sonar-dependency-risks - sonar-duplication
skills/sonar-duplication - sonar-fix-issue
skills/sonar-fix-issue - sonar-integrate
skills/sonar-integrate - sonar-list-issues
skills/sonar-list-issues - sonar-list-projects
skills/sonar-list-projects - sonar-quality-gate
skills/sonar-quality-gate - sonar-triage-dependency-risks
skills/sonar-triage-dependency-risks
How it works
sonar-analyze
When your agent uses it
Analyze a file for quality and security issues using SonarQube
What it loads into context
Frontmatter
70 tokensAlways available to the agent
SKILL.md
2,087 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
../../.claude-plugin/marketplace.jsonasset620 bytes../../.claude-plugin/plugin.jsonasset764 bytes../../claude-hooks/hooks.jsonasset272 bytes../../claude-hooks/hooks.jsonasset272 bytesSKILL.mdcore9,004 bytesSKILL.mdcore9,004 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-coverage
When your agent uses it
Find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)
What it loads into context
Frontmatter
97 tokensAlways available to the agent
SKILL.md
1,957 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore8,252 bytesSKILL.mdcore8,252 bytesSKILL.mdcore8,252 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-dependency-risks
When your agent uses it
Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)
What it loads into context
Frontmatter
96 tokensAlways available to the agent
SKILL.md
1,852 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore7,672 bytesSKILL.mdcore7,672 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-duplication
When your agent uses it
Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)
What it loads into context
Frontmatter
107 tokensAlways available to the agent
SKILL.md
2,286 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore9,779 bytesSKILL.mdcore9,779 bytesSKILL.mdcore9,779 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-fix-issue
When your agent uses it
Fix a specific SonarQube issue in code by rule key and location
What it loads into context
Frontmatter
53 tokensAlways available to the agent
SKILL.md
563 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Instructions
Files
SKILL.mdcore2,210 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-integrate
When your agent uses it
Installs sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube.
What it loads into context
Frontmatter
133 tokensAlways available to the agent
SKILL.md
1,915 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Instructions
Files
SKILL.mdcore8,559 bytesSKILL.mdcore8,559 bytesSKILL.mdcore8,559 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-list-issues
When your agent uses it
Search and filter SonarQube issues for a project, branch, or pull request via sonarqube-cli (`-p` is always required on the CLI; resolve the key from user arguments or sonar-project.properties)
What it loads into context
Frontmatter
93 tokensAlways available to the agent
SKILL.md
1,515 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore6,325 bytesSKILL.mdcore6,325 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-list-projects
When your agent uses it
List SonarQube projects accessible to the current user
What it loads into context
Frontmatter
38 tokensAlways available to the agent
SKILL.md
700 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore2,977 bytesSKILL.mdcore2,977 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-quality-gate
When your agent uses it
Show SonarQube quality gate status for a project — pass/fail and each condition (metric key, threshold, actual value), plus worst-offender breakdowns. Project key optional — resolved from `sonar-project.properties` or the MCP integration default.
What it loads into context
Frontmatter
115 tokensAlways available to the agent
SKILL.md
3,958 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Usage
- Prerequisites
- Instructions
Files
SKILL.mdcore16,412 bytesSKILL.mdcore16,412 bytesSKILL.mdcore16,412 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubsonar-triage-dependency-risks
When your agent uses it
Triage SonarQube SCA dependency risks by CVE reachability, prepare safe UI writeups, and optionally bundle confirmed package fixes.
What it loads into context
Frontmatter
105 tokensAlways available to the agent
SKILL.md
2,290 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Guardrails
- 1. Determine scope and mode
- 2. Fetch and normalize findings
- 3. Determine whether the package ships at runtime
- 4. Research the vulnerable mechanism
- 5. Verify reachability
- 6. Assign a verdict
- 7. Report results
- 8. Remediate only with explicit authorization
- Completion checklist
Files
SKILL.mdcore11,698 bytesSKILL.mdcore11,698 bytesSKILL.mdcore11,698 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubSkills included
- sonar-analyze
- sonar-coverage
- sonar-dependency-risks
- sonar-duplication
- sonar-fix-issue
- sonar-integrate
- sonar-list-issues
- sonar-list-projects
- sonar-quality-gate
- sonar-triage-dependency-risks
Repository facts
- License
- No license detected
- Created
- Feb 6, 2026
- Last pushed
- Nov 5, 2026
- Forks
- 6
- Open issues
- 0
- Project activity
- Active
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 16 notes
claude-hooks/hooks.json:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-analyze/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-coverage/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-coverage/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-dependency-risks/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-duplication/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-duplication/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedclaude-hooks/hooks.json:1Plugin-wide analysis incomplete; see repository notesskills/sonar-integrate/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-integrate/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-list-issues/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-list-projects/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-quality-gate/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-quality-gate/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-triage-dependency-risks/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/sonar-triage-dependency-risks/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- 6 broad permissionsin 6 files: sonar-analyze/SKILL.md:1 sonar-coverage/SKILL.md:1 sonar-dependency-risks/SKILL.md:1 and 3 more
- 1 dangerous shell commandin 1 file: sonar-integrate/SKILL.md:32
- 23 network referencesin 4 files: sonar-integrate/SKILL.md:30 .claude-plugin/plugin.json:5 .claude-plugin/marketplace.json:6 and 1 more
- No hidden or obfuscated text
- No instruction overrides
- No executable scripts
- 2 references to secretsin 1 file: sonar-integrate/SKILL.md:85
- No requests to vote in Hot
Show all 32 signals by file
.claude-plugin/marketplace.json
.claude-plugin/plugin.json
- Network accessline 5
"author": { "name": "Sonar", "url": "https://www.sonarsource.com/" - Network accessline 6
"name": "Sonar", "url": "https://www.sonarsource.com/" }, - Network accessline 7
"url": "https://www.sonarsource.com/" - Network accessline 15
], "license": "SSAL-1.0", "repository": "https://github.com/SonarSource/sonarqube-agent-plugins", - Network accessline 16
"license": "SSAL-1.0", "repository": "https://github.com/SonarSource/sonarqube-agent-plugins", "homepage": "https://www.sonarsource.com", - Network accessline 17
"repository": "https://github.com/SonarSource/sonarqube-agent-plugins", - Network accessline 18
"homepage": "https://www.sonarsource.com",
skills/sonar-analyze/SKILL.md
- Broad permissionsline 1
Read, Glob, Bash(git branch:*), Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
skills/sonar-coverage/SKILL.md
- Broad permissionsline 1
Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
skills/sonar-dependency-risks/SKILL.md
- Broad permissionsline 1
Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
skills/sonar-duplication/SKILL.md
- Broad permissionsline 1
Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
skills/sonar-integrate/SKILL.md
- Broad permissionsline 1
Bash(which:*), Bash(Get-Command:*), Bash(sonar:*), Bash(curl:*), Bash(irm:*), Bash(iex:*), Bash(brew:*), Bash(mise:*), Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*) - Network accessline 30
| Platform / method | Install command | | ------------------------ | ----------------------------------------------------------- - Network accessline 31
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------ | | macOS / Linux (script) | `curl -o- https://raw.githubusercontent.com/SonarSource/son - Dangerous shell operationline 32
| macOS / Linux (script) | `curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash` | - Network accessline 32
| macOS / Linux (script) | `curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash` | - Network accessline 33
| macOS / Linux (Homebrew) | `brew install --cask sonarqube-cli` | | Any OS (mise) | `mise use -g aqua:SonarSource/sonarqube-cli` - Network accessline 35
| Windows (PowerShell) | `irm https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.ps1 \| iex` | - Network accessline 69
| ------------------------------ | ------------------------------------------------------------- | | SonarQube Cloud — EU (default) | organization key (e.g. `my-org`) | | SonarQube Cloud — US | organiz - Network accessline 70
| SonarQube Cloud — EU (default) | organization key (e.g. `my-org`) | | SonarQube Cloud — US | organization key + confirm US region (`https://sonarqube.us`) | | SonarQube Server | server - Network accessline 71
| SonarQube Cloud — US | organization key + confirm US region (`https://sonarqube.us`) | - Network accessline 72
| SonarQube Server | server URL (e.g. `https://sonarqube.yourcompany.com`) | - Network accessline 77
| -------------------- | ------------------------------------------------------- | | SonarQube Cloud — EU | `sonar auth login -o <org-key>` | | SonarQube Cloud — US | `sonar auth login -o <org-key> -s https://sonarqu - Network accessline 78
| SonarQube Cloud — EU | `sonar auth login -o <org-key>` | | SonarQube Cloud — US | `sonar auth login -o <org-key> -s https://sonarqube.us` | | SonarQube Server | `sonar auth login -s <server-url>` - Network accessline 79
| SonarQube Cloud — US | `sonar auth login -o <org-key> -s https://sonarqube.us` | - Access to secretsline 85
[Credential-related source omitted] - Access to secretsline 121
[Credential-related source omitted]
skills/sonar-quality-gate/SKILL.md
- Broad permissionsline 1
Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*) - Network accessline 215
To investigate **beyond** the gate (e.g. overall coverage, line coverage, bug counts, detailed ratings), call **`mcp__sonarqube__get_component_measures`** with the same branch/PR context if applicable, and pass `metricKeys` for the measures
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 22 facts
- Broad permissions in the frontmatter of the SKILL.mdsonar-analyze/SKILL.md:1High confidence
- Broad permissions in the frontmatter of the SKILL.mdsonar-coverage/SKILL.md:1High confidence
- Broad permissions in the frontmatter of the SKILL.mdsonar-dependency-risks/SKILL.md:1High confidence
- Broad permissions in the frontmatter of the SKILL.mdsonar-duplication/SKILL.md:1High confidence
- Broad permissions in the frontmatter of the SKILL.mdsonar-integrate/SKILL.md:1High confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:30Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:31Low confidence
- Dangerous shell operation in prose of the SKILL.mdsonar-integrate/SKILL.md:32Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:32Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:33Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:35Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:69Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:70Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:71Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:72Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:77Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:78Low confidence
- Network access in prose of the SKILL.mdsonar-integrate/SKILL.md:79Low confidence
- Access to secrets in prose of the SKILL.mdsonar-integrate/SKILL.md:85Low confidence
- Access to secrets in code of the SKILL.mdsonar-integrate/SKILL.md:121High confidence
- Broad permissions in the frontmatter of the SKILL.mdsonar-quality-gate/SKILL.md:1High confidence
- Network access in prose of the SKILL.mdsonar-quality-gate/SKILL.md:215Low confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/sonar-analyze/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/sonar-analyze/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/sonar-analyze/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/sonar-analyze/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/sonar-analyze/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
