Operations Guide

Referenced documentation

Introduction

The SonarQube MCP component is part of Software Factory as a Package (SWaaP).

The SonarQube MCP Server is a Model Context Protocol (MCP) server that connects your AI coding agent to SonarQube’s code quality and security data.

Learn more about it .

Service Catalog Items

The catalog items are defined according to the RACI in the LLD.

Grant access to SonarQube MCP

Connection to SonarQube requires a token of type USER and will not function properly if project tokens or global tokens are used. More on this in Secrets, Tokens and Credentials in SonarQube section

⚠️ Security best practices

🔒 Important: Your SonarQube token is a sensitive credential. Follow these security practices:

When using CLI commands:

• Avoid hardcoding tokens in command-line arguments – they get saved in shell history
• Use environment variables – set tokens in environment variables before running commands

When using configuration files:

• Never commit tokens to version control
• Use environment variable substitution in config files when possible

For specific steps in how to Configure your AI agent check official docs.

Billing and onboarding

Billing and oboarding is managed by SonarQube service.

Component deployment and configuration

Requirements & Pre-requisite

All associated ECOL prerequisites are detailed here .

Configuration

Setting Helm values

The only mandatory helm value for a succesfull SonarQube MCP deplyment is the SonarQube Server endpoint:

sonarqube:
  url: https://${sonarqubeName:="sonarqube.example.com"}

Aplication specific behavious can be furter customized via

extraEnvVars:
  - name: STORAGE_PATH      #influences [logging](../lld/_index.md/#78-logging)
    value: /data
  - name: TELEMETRY_DISABLED
    value: "true"
  - name: SONAR_LOG_LEVEL     # influences [logging](../lld/_index.md/#78-logging)
    value: "INFO"             # options Logging verbosity ["TRACE", "DEBUG", "INFO", "WARNING", "ERROR"]
  - name: SONARQUBE_TOOLSETS  # influences [tooling](../lld/_index.md/#41-feature-summary)
    value: "analysis,coverage,dependency-risks,duplications,issues,languages,measures,projects,quality-gates,rules,security-hotspots"

⚠️ Security doesn’t approve injecting SONARQUBE_TOKEN as an environment variable

Configuring Kubernetes secrets

No specific Kubernetes secrets are required for SonarQube MCP.

Deployment & update procedure

The deployment and update procedures are described in the SWaaP Readme - Quick start section .

Logging

Monitoring

Aside from the /mcp endpoint, SonarQube MCP exposes /health endpoint which do not require an Authorization header. It returns 200 OK with an empty body once the server is accepting requests.

Logging

Application logs are written to the STORAGE_PATH/logs/mcp.log file by default. To disable file logging entirely, set SONARQUBE_LOG_TO_FILE_DISABLED=true.

Prometheus monitoring

Prometheus monitoring and metrics are not available at the time of this release (app version 1.23.0.3101).