SonarQube
Puts SonarQube's rule set, secrets scanning and quality gate inside the agent's own edit loop.
Install
OfficialShips scriptsClaude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install sonarqube@claude-plugins-official
Kod yazarken ya da PR'ı kapatmadan önce kalite kapısını, kapsamayı ve güvenlik bulgularını denetlerken
- Author
- SonarSource
- License
- SONAR Source-Available License v1.0
Nine skills map onto the questions a review actually asks: list open issues, fix one, check the quality gate, read coverage, look at duplication, pull dependency risks. What separates it from running an analyser afterwards is placement — a PostToolUse hook analyses after each file edit, and a pre-tool secrets scan aims to stop credentials from reaching the model at all rather than flagging them once they are already in context. Setup is a guided skill instead of manual wiring: the SonarQube CLI has an integrate command that writes the MCP configuration and hooks for whichever host it is pointed at, and authentication is a browser login whose credentials stay in the operating system keychain. Cloud, Server and Community Build are all supported.
Similar skills
SAST Configuration
SkillSets up Semgrep, CodeQL and SonarQube so the pipeline blocks real findings.
CodeQL Code Scanning
SkillSets up CodeQL scanning through Actions or the CLI, and unsticks it when it fails.
Aikido Security
SkillScans the files an agent just wrote and loops on the fix until the findings actually clear.
Comments(0)
Sign in to comment