SonarQube MCP

1. Application

2. Introduction

2.1 Document purpose

This document is a low level design - LLD which aims to describe how the architecture evoked in high level design - HLD will be implemented. This document will describe the protocols used in the target architecture, how to implement them and any modifications made to their default behavior. Once validated by Thales, this document will then serve as a basis for the implementation of configurations on equipment.

2.2 Document scope

This document is not a manual and is not intended to replace the reference literature describing with great precision all network protocols.

The protocols used will be briefly described as well as the modifications made to their default behavior.

2.3 Referenced documentation

3. Component general description

This component is part of Software Factory as a Product (SWaaP), and it is visible in the TASD .

The SonarQube MCP Server is a Model Context Protocol (MCP) server that enables seamless integration with SonarQube Server for code quality and security. It also supports the analysis of code snippet directly within the agent context.

SonarQube MCP service is exposed using:

• SonarQube MCP API

4. Functional & Business Requirements

No formal list of requirements has been expressed by clients. It is designed and developed based on business use cases.

4.1 Feature summary

Features of the SonarQube MCP Server are:

• Connects your AI assistant directly to your SonarQube Server so code quality and security data can be queried inside the IDE or CLI workflow
• Helps developers stay in context by exposing SonarQube Server capabilities without switching to the SonarQube Server UI
• Supports both read and limited write actions, allowing the agent not only to inspect findings but also to update issue or Security Hotspot status where permitted
• Can analyze code snippets or files in agent workflows and use trusted SonarQube Server analysis results to support review and remediation decisions

The table below summarizes the available toolsets, including recommended enablement settings.

Table 3 - Recommended Toolset Limits.

Legend:

• ✅ Enabled - This toolset is enabled and available for use
• ❌ Disabled - This toolset is disabled and should not be enabled
• 📄 Read-only access - Allows viewing, searching, or retrieving information only
• 📝 Read/Write access - Allows viewing information and performing update actions

More information about SonarQube MCP Server capabilities can be found in the SonarQube MCP Server documentation .

4.2 Prerequisites

Every prerequisites of the product are applicable to this component. In detail:

• Kubernetes and Flux. See the TASD §4.1.2 Prerequisites for supported version.

At deployment phase, SonarQube MCP requires just a SonarQube Server instance endpoint, but doesn’t require authentication to it.

4.3 Variability

No variability is supported.

5. Architecture decision record

Here is a list of decisions:

Table 4 - List of architecture decision record.

5.1 ADR-SON-001: Add SonarQube as a component of the product

5.1.1 Status: Accepted

• SonarQube MCP in SWaaP

5.1.2 Context

• See ADR008 in TASD .

5.1.3 Decision

• Add SonarQube MCP

5.1.4 Consequences

• TASD introduction & LLD support

6. Architecture description

6.1 Business architecture and allocation to services

You will find in Figure 1 business architecture for software code and CI/CD engineering allocated to services:

Figure 1 - Business architecture allocated to services.

Note: in dash, external items.

6.2 Application architecture

flowchart LR
    A["MCP client chat
(Windsurf, Cursor, VS Code with Copilot...)"]
    B["SonarQube
MCP Server"]
    C["SonarQube
Cloud API"]
    D["SonarQube
Server API"]
    A <-->|Interacts| B
    B -->|Calls| C
    B -->|Calls| D

SonarQube MCP is using these external services:

• A Software Factory or mirror for deployment (PRE_001)
• Kubernetes with Flux (PRE_002, PRE_003)
• Ingress with TLS and dns resolution associated for one entry point and certificates, classically https://sonarqube-mcp.SF-DOMAIN (PRE_005, PRE_006, PRE_007)

6.2.1 User management

As SonarQube MCP server is forwarding request to SonarQube server, user management is done in SonarQube

6.2.2 RACI

As SonarQube MCP server is forwarding request to SonarQube server, RACI is done in SonarQube

6.3 Delivery

Component is part of the Software Factory as a Product (SWaaP) delivery. See TASD for more details.

6.3.1 Latest Version

• Latest version editor
  • Component registry: TBC on main branch
  • Helm chart repository
• SWaaP integration part

6.3.2 Version 1.1.0

• Component registry:
  • sonarqube-mcp
• Helm chart registry: in SF delivery
• SWaaP integration part
• Component Merge Request in Reference
• Security Report:
  • SCA Report

6.4 Infrastructure architecture

6.4.1 Software Factory API

Here is a list of services that can be integrated with the SonarQube MCP.

7. Operational and maintenance

In this chapter you will find strategy and policy. Detailed implementation will be described in the SCOM.

7.1 Life cycle policy

Cadence of version is described in the Product Lifecycle .

7.2 License

Licensed under the SONAR Source-Available License v1.0 . Using the SonarQube MCP Server in compliance with this documentation is a Non-Competitive Purpose and so is allowed under the SSAL.

Your use of SonarQube via MCP is governed by the SonarQube Cloud Terms of Service or SonarQube Server Terms and Conditions , including use of the Results Data solely for your internal software development purposes.

7.3 Deployment

The component is deployed as a standard component using Flux and SWaaP packaging. See TASD for more details.

7.4 IAM

Authentication is managed by SonarQube service.

7.5 Scaling

It is possible to scale the pods. Currently we are using default scaling.

7.6 Backup / restore

We recommend to manage point in time restore at platform level. Like that it is possible to restore synchronously:

• volumes.

As SonarQube MCP is stateless, no user data require to be backuped.