fix-sonarqube

어떤 스킬인가요?

SonarQube integration via MCP for Java projects. Fix issues, check coverage, review security hotspots, and analyze code duplications using the SonarQube MCP Server (v1.10+). No local setup required.

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

# Common SonarQube Java Rules

Rules are grouped by severity. SonarQube 2025.1+ uses MQR severity (BLOCKER, HIGH, MEDIUM, LOW, INFO). Legacy instances use Standard Experience (BLOCKER, CRITICAL, MAJOR, MINOR, INFO).

## BLOCKER / BLOCKER Rules

| Rule | Description | Fix |
|------|-------------|-----|
| `java:S2259` | Null pointer dereference | Add null checks |
| `java:S2095` | Resources not closed | Use try-with-resources |
| `java:S2245` | Predictable random | Use SecureRandom |

## HIGH / CRITICAL Rules

| Rule | Description | Fix |
|------|-------------|-----|
| `java:S1128` | Unused imports | Remove unused imports |
| `java:S1161` | Missing @Override | Add @Override annotation |
| `java:S2142` | InterruptedException | Re-interrupt thread |
| `java:S2583` | Conditions always true/false | Fix logic |

## MEDIUM / MAJOR Rules

| Rule | Description | Fix |
|------|-------------|-----|
| `java:S1135` | TODO comments | Implement or remove |
| `java:S1168` | Return empty collection not null | Return Collections.emptyList() |
| `java:S1172` | Unused parameters | Remove or use |
| `java:S1481` | Unused local variables | Remove |

## Quick Fixes

### S2259 - Null Pointer

```java
// Before
String result = obj.getValue().toLowerCase();

// After
String result = Optional.ofNullable(obj)
    .map(Obj::getValue)
    .map(String::toLowerCase)
    .orElse("");
```

### S2095 - Resources

```java
// Before
InputStream is = new FileInputStream(file);
is.read();
is.close();

// After
try (InputStream is = new FileInputStream(file)) {
    is.read();
}
```

### S1161 - Override

```java
// Before
public String toString() { ... }

// After
@Override
public String toString() { ... }
```
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/references/common-rules.md -->
<!-- To modify, edit the source file and run the distribution workflow -->

---
title: Copilot CLI Setup
description: Configure SonarQube MCP for GitHub Copilot CLI
---

# Copilot CLI Setup

Configure the SonarQube MCP server for the GitHub Copilot CLI tool.

## Contents

- [Overview](#overview)
- [Configuration Location](#configuration-location)
- [Setup Steps](#setup-steps)
- [Configuration Format](#configuration-format)
- [Verification](#verification)
- [Troubleshooting](#troubleshooting)
- [Related](#related)

---
## Overview

The GitHub Copilot CLI (`gh copilot`) supports MCP servers for enhanced code analysis. The SonarQube MCP server runs remotely at `https://sonarqube-mcp.bitso.io/mcp`.

**No tokens or environment variables required** - the remote server handles authentication.

## Configuration Location

- **File**: `~/.copilot/mcp-config.json`
- **Format**: HTTP/SSE server URL with tools array
- **Scope**: User-level (applies to all CLI invocations)

## Setup Steps

### Step 1: Check Existing Configuration

```bash
if [ -f ~/.copilot/mcp-config.json ]; then
  echo "✓ Copilot CLI config found"
  # Validate JSON
  if jq empty ~/.copilot/mcp-config.json 2>/dev/null; then
    echo "  ✓ Valid JSON"
  else
    echo "  ❌ Invalid JSON - fix or remove file"
    exit 1
  fi
else
  echo "→ Copilot CLI config not found (will create)"
fi
```

### Step 2: Backup (if exists)

```bash
if [ -f ~/.copilot/mcp-config.json ]; then
  cp ~/.copilot/mcp-config.json ~/.copilot/mcp-config.json.backup
  echo "✓ Backed up to mcp-config.json.backup"
fi
```

### Step 3: Create or Update Configuration

```bash
# Create directory if needed
mkdir -p ~/.copilot

# Check if file exists
if [ ! -f ~/.copilot/mcp-config.json ]; then
  # Create new config
  cat > ~/.copilot/mcp-config.json << 'EOF'
{
  "mcpServers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp",
      "tools": ["*"]
    }
  }
}
EOF
  echo "✓ Created new configuration"
else
  # Merge with existing config
  existing=$(cat ~/.copilot/mcp-config.json)
  echo "$existing" | jq '.mcpServers.sonarqube = {"type": "http", "url": "https://sonarqube-mcp.bitso.io/mcp", "tools": ["*"]}' \
    > ~/.copilot/mcp-config.json
  echo "✓ Merged SonarQube config (preserving other servers)"
fi
```

## Configuration Format

Copilot CLI uses HTTP/SSE configuration with `mcpServers` root key and a `tools` array:

```json
{
  "mcpServers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp",
      "tools": ["*"]
    }
  }
}
```

**Notes**:
- The `type` must be `"http"` for SSE servers
- `tools: ["*"]` enables all available tools
- You can restrict tools: `["get_issues", "get_rule"]`

## Verification

```bash
echo "=== Verifying Copilot CLI Configuration ==="

if [ -f ~/.copilot/mcp-config.json ]; then
  echo "✓ Config file exists"

  # Validate JSON
  if jq empty ~/.copilot/mcp-config.json 2>/dev/null; then
    echo "✓ JSON syntax valid"

    # Check SonarQube entry
    url=$(jq -r '.mcpServers.sonarqube.url' ~/.copilot/mcp-config.json 2>/dev/null)
    if [ -n "$url" ] && [ "$url" != "null" ]; then
      echo "✓ SonarQube URL: $url"
    else
      echo "⚠ SonarQube not configured"
    fi
  else
    echo "❌ Invalid JSON"
  fi
else
  echo "❌ Config file not found"
fi
```

**Test the CLI**:

```bash
gh copilot suggest "analyze this code for SonarQube issues"
```

## Troubleshooting

### SonarQube Tools Not Available

Verify the configuration file is valid:

```bash
cat ~/.copilot/mcp-config.json | jq '.'
```

### Connection Errors

Check network connectivity to the remote server:

```bash
curl -s https://sonarqube-mcp.bitso.io/mcp
```

### Multiple Servers

You can have multiple MCP servers configured:

```json
{
  "mcpServers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp",
      "tools": ["*"]
    },
    "atlas": {
      "type": "http",
      "url": "https://atlas-mcp.bitso.io/mcp",
      "tools": ["*"]
    }
  }
}
```

## Related

- [intellij-setup.md](intellij-setup.md) - IntelliJ configuration
- [mcp-tools.md](mcp-tools.md) - Available MCP tools
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/references/copilot-cli-setup.md -->
<!-- To modify, edit the source file and run the distribution workflow -->

# Coverage Checking via SonarQube MCP

Use SonarQube MCP tools to check and improve code coverage without running local JaCoCo builds.

## Contents

- [When to Use](#when-to-use)
- [MCP vs Local Coverage](#mcp-vs-local-coverage)
- [Workflow: Identify and Improve Coverage](#workflow-identify-and-improve-coverage)
- [Tool Reference](#tool-reference)
- [Example Prompts](#example-prompts)
- [PR Coverage Workflow](#pr-coverage-workflow)

---

## When to Use

- **Before writing tests**: identify which files need coverage the most
- **During PR review**: check coverage impact without waiting for CI
- **Quality gate failing**: quickly find which files are dragging coverage down
- **Coverage planning**: prioritize test efforts across the project
- **Avoiding slow local builds**: skip `./gradlew test jacocoTestReport` just to check current state

## MCP vs Local Coverage

| Approach | Best For | Limitation |
|----------|----------|------------|
| **SonarQube MCP** | Checking current state, finding gaps, PR-specific analysis | Reflects last CI analysis, not local uncommitted changes |
| **JaCoCo (local)** | Running tests, generating new coverage data, verifying thresholds | Requires local Gradle execution, slower feedback |

Use MCP to **discover** coverage gaps, then JaCoCo to **generate** and **verify** new coverage.

## Workflow: Identify and Improve Coverage

### 1. Find Low-Coverage Files

Use `search_files_by_coverage` to identify files needing tests:

```text
projectKey: "payment-service"
```

For PR-specific coverage:

```text
projectKey: "payment-service", pullRequest: "247"
```

### 2. Get Line-Level Coverage Details

Use `get_file_coverage_details` to see which lines are covered:

```text
key: "payment-service:src/main/java/com/bitso/payment/PaymentService.java"
```

### 3. Check Project-Level Metrics

Use `get_component_measures` for overall coverage:

```text
component: "payment-service", metricKeys: ["coverage", "ncloc", "violations"]
```

For a specific module or package:

```text
component: "payment-service:src/main/java/com/bitso/payment", metricKeys: ["coverage"]
```

### 4. Write Tests for Uncovered Code

Based on the line-level details from step 2, write tests targeting the uncovered lines:

```bash
# Run tests with coverage locally to verify
./gradlew clean test jacocoTestReport

# Check HTML report for visual confirmation
open build/reports/jacoco/test/html/index.html
```

### 5. Verify Quality Gate

After pushing, check the quality gate via MCP:

```text
get_project_quality_gate_status: projectKey: "payment-service", pullRequest: "247"
```

## Tool Reference

| Tool | Purpose | Key Parameter |
|------|---------|---------------|
| `search_files_by_coverage` | Find files with lowest coverage | `projectKey` |
| `get_file_coverage_details` | Line-by-line coverage for a file | `key` (file component key) |
| `get_component_measures` | Coverage metric for project/dir/file | `component`, `metricKeys: ["coverage"]` |
| `get_project_quality_gate_status` | Check if coverage gate passes | `projectKey` |
| `list_pull_requests` | Discover PR IDs for PR-specific queries | `projectKey` |

## Example Prompts

Use these prompts with your AI agent:

```text
"What files have the lowest coverage in payment-service?"

"Show me line-by-line coverage for PaymentService.java in payment-service"

"Is the quality gate passing for PR #247 in payment-service?"

"Our code coverage dropped below 82%. Which files are dragging it down?"

"Check the coverage impact of my pull request #123 on order-service"
```

## PR Coverage Workflow

When reviewing a PR for coverage:

1. **Discover PR ID**: use `list_pull_requests` with `projectKey` to find the PR
2. **Check PR coverage**: use `search_files_by_coverage` with `pullRequest` parameter
3. **Review specific files**: use `get_file_coverage_details` for changed files
4. **Check quality gate**: use `get_project_quality_gate_status` with `pullRequest`

This replaces the need to run `./gradlew test jacocoTestReport` locally just to check coverage status.
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/references/coverage-via-mcp.md -->
<!-- To modify, edit the source file and run the distribution workflow -->

---
title: IntelliJ IDEA Setup
description: Configure SonarQube MCP for IntelliJ IDEA GitHub Copilot extension
---

# IntelliJ IDEA Setup

Configure the SonarQube MCP server for IntelliJ IDEA's GitHub Copilot extension.

## Contents

- [Overview](#overview)
- [Configuration Location](#configuration-location)
- [Setup Steps](#setup-steps)
- [Configuration Format](#configuration-format)
- [Verification](#verification)
- [Troubleshooting](#troubleshooting)
- [Related](#related)

---
## Overview

IntelliJ IDEA uses the GitHub Copilot extension for MCP integration. The SonarQube MCP server runs remotely at `https://sonarqube-mcp.bitso.io/mcp`.

**No tokens or environment variables required** - the remote server handles authentication.

## Configuration Location

- **File**: `~/.config/github-copilot/intellij/mcp.json`
- **Format**: HTTP/SSE server URL
- **Scope**: User-level (applies to all IntelliJ instances)

## Setup Steps

### Step 1: Check Existing Configuration

```bash
if [ -f ~/.config/github-copilot/intellij/mcp.json ]; then
  echo "✓ IntelliJ config found"
  # Validate JSON
  if jq empty ~/.config/github-copilot/intellij/mcp.json 2>/dev/null; then
    echo "  ✓ Valid JSON"
  else
    echo "  ❌ Invalid JSON - fix or remove file"
    exit 1
  fi
else
  echo "→ IntelliJ config not found (will create)"
fi
```

### Step 2: Backup (if exists)

```bash
if [ -f ~/.config/github-copilot/intellij/mcp.json ]; then
  cp ~/.config/github-copilot/intellij/mcp.json ~/.config/github-copilot/intellij/mcp.json.backup
  echo "✓ Backed up to mcp.json.backup"
fi
```

### Step 3: Create or Update Configuration

```bash
# Create directory if needed
mkdir -p ~/.config/github-copilot/intellij

# Check if file exists
if [ ! -f ~/.config/github-copilot/intellij/mcp.json ]; then
  # Create new config
  cat > ~/.config/github-copilot/intellij/mcp.json << 'EOF'
{
  "servers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp"
    }
  }
}
EOF
  echo "✓ Created new configuration"
else
  # Merge with existing config
  existing=$(cat ~/.config/github-copilot/intellij/mcp.json)
  echo "$existing" | jq '.servers.sonarqube = {"type": "http", "url": "https://sonarqube-mcp.bitso.io/mcp"}' \
    > ~/.config/github-copilot/intellij/mcp.json
  echo "✓ Merged SonarQube config (preserving other servers)"
fi
```

### Step 4: Restart IntelliJ

Configuration changes require an IDE restart to take effect.

## Configuration Format

IntelliJ uses HTTP/SSE configuration with `servers` root key:

```json
{
  "servers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp"
    }
  }
}
```

**Notes**:
- The `type` must be `"http"` for SSE servers
- Multiple servers can coexist (Atlas, SonarQube, etc.)

## Verification

```bash
echo "=== Verifying IntelliJ Configuration ==="

if [ -f ~/.config/github-copilot/intellij/mcp.json ]; then
  echo "✓ Config file exists"

  # Validate JSON
  if jq empty ~/.config/github-copilot/intellij/mcp.json 2>/dev/null; then
    echo "✓ JSON syntax valid"

    # Check SonarQube entry
    url=$(jq -r '.servers.sonarqube.url' ~/.config/github-copilot/intellij/mcp.json 2>/dev/null)
    if [ -n "$url" ] && [ "$url" != "null" ]; then
      echo "✓ SonarQube URL: $url"
    else
      echo "⚠ SonarQube not configured"
    fi
  else
    echo "❌ Invalid JSON"
  fi
else
  echo "❌ Config file not found"
fi
```

**Test in IntelliJ**:
1. Restart IntelliJ IDEA
2. Open a Java file
3. Use Copilot to ask: "Find SonarQube issues in this project"

## Troubleshooting

### MCP Server Not Connecting

Verify the remote server is accessible:

```bash
curl -s https://sonarqube-mcp.bitso.io/mcp
```

### Configuration Not Loading

- Ensure IntelliJ IDEA has been restarted after configuration changes
- Check file permissions: `ls -la ~/.config/github-copilot/intellij/mcp.json`

### Multiple Servers

You can have multiple MCP servers configured:

```json
{
  "servers": {
    "sonarqube": {
      "type": "http",
      "url": "https://sonarqube-mcp.bitso.io/mcp"
    },
    "atlas": {
      "type": "http",
      "url": "https://atlas-mcp.bitso.io/mcp"
    }
  }
}
```

## Related

- [copilot-cli-setup.md](copilot-cli-setup.md) - CLI configuration
- [mcp-tools.md](mcp-tools.md) - Available MCP tools
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/references/intellij-setup.md -->
<!-- To modify, edit the source file and run the distribution workflow -->

# SonarQube MCP Tools Reference

Complete reference for SonarQube MCP Server tools (v1.10+), organized by category.

## Contents

- [Analysis](#analysis)
- [Issues](#issues)
- [Coverage](#coverage)
- [Duplications](#duplications)
- [Security Hotspots](#security-hotspots)
- [Quality Gates](#quality-gates)
- [Projects and Pull Requests](#projects-and-pull-requests)
- [Measures and Metrics](#measures-and-metrics)
- [Rules](#rules)
- [Sources](#sources)
- [Dependency Risks](#dependency-risks)
- [System](#system)
- [Severity Model](#severity-model)

---

## Analysis

### analyze_code_snippet

Analyze a file or code snippet with SonarQube analyzers.

**Parameters:**
- `fileContent` (string, required): Complete file content
- `projectKey` (string, required): Project key
- `language` (string, optional): Language hint (e.g., `"java"`)
- `codeSnippet` (string, optional): Snippet to filter results to
- `scope` (string, optional): `"MAIN"` or `"TEST"` (default: MAIN)

Pass complete `fileContent` for full file analysis. Add `codeSnippet` to report only issues within that snippet.

**Usage:** "Analyze this Java code for SonarQube issues"

### analyze_file_list

Analyze files in the current working directory using SonarQube for IDE (requires IDE integration).

**Parameters:**
- `file_absolute_paths` (array of strings, required): Absolute file paths to analyze

## Issues

### search_sonar_issues_in_projects

Search for SonarQube issues across projects.

**Parameters:**
- `projects` (array, optional): Project key(s) - always include to avoid overload
- `severities` (array, optional): `["INFO", "LOW", "MEDIUM", "HIGH", "BLOCKER"]`
- `impactSoftwareQualities` (array, optional): `["MAINTAINABILITY", "RELIABILITY", "SECURITY"]`
- `issueStatuses` (array, optional): `["OPEN", "CONFIRMED", "FALSE_POSITIVE", "ACCEPTED", "FIXED"]`
- `issueKey` (string, optional): Fetch a specific issue
- `pullRequestId` (string, optional): PR-specific issues
- `ps` (integer, optional): Page size (max 500, default 100)
- `p` (integer, optional): Page number (default 1)

**Usage:** "Find BLOCKER issues in payment-service"

### change_sonar_issue_status

Change the status of a SonarQube issue.

**Parameters:**
- `key` (string, required): Issue key
- `status` (enum, required): `"accept"`, `"falsepositive"`, `"reopen"`

**Usage:** "Mark this issue as false positive"

## Coverage

### search_files_by_coverage

Find files with the lowest test coverage. Auto-fetches all pages by default (up to 10,000 files).

**Parameters:**
- `projectKey` (string, required): Project key
- `pullRequest` (string, optional): Pull request ID
- `pageSize` (integer, optional): Results per page (max 500)
- `pageIndex` (integer, optional): Page number (starts at 1)

**Usage:** "What files have the lowest coverage in my-service?"

### get_file_coverage_details

Get line-by-line coverage information for a file.

**Parameters:**
- `key` (string, required): File component key (e.g., `"project:src/main/java/Service.java"`)
- `pullRequest` (string, optional): Pull request ID

**Usage:** "Show me line-by-line coverage for PaymentService.java"

## Duplications

### search_duplicated_files

Find files with code duplications. Auto-fetches all pages by default (up to 10,000 files).

**Parameters:**
- `projectKey` (string, required): Project key
- `pullRequest` (string, optional): Pull request ID
- `pageSize` (integer, optional): Results per page (max 500)
- `pageIndex` (integer, optional): Page number (starts at 1)

**Usage:** "Find the most duplicated files in my-service"

### get_duplications

Get line-by-line duplication details for a file.

**Parameters:**
- `key` (string, required): File component key
- `pullRequest` (string, optional): Pull request ID

**Usage:** "Show duplication details for this file"

## Security Hotspots

### search_security_hotspots

Search for Security Hotspots in a project.

**Parameters:**
- `projectKey` (string, required): Project or application key
- `pullRequest` (string, optional): Pull request key
- `status` (string, optional): `"TO_REVIEW"` or `"REVIEWED"`
- `resolution` (string, optional): `"FIXED"`, `"SAFE"`, `"ACKNOWLEDGED"`
- `files` (array, optional): File paths to filter
- `sinceLeakPeriod` (boolean, optional): New code only
- `onlyMine` (boolean, optional): Assigned to me only
- `ps` (integer, optional): Page size (max 500)

**Usage:** "Search for security hotspots to review in payment-service"

### show_security_hotspot

Get detailed information about a specific Security Hotspot.

**Parameters:**
- `hotspotKey` (string, required): Security Hotspot key

**Usage:** "Show me details about this security hotspot"

### change_security_hotspot_status

Review a Security Hotspot by changing its status.

**Parameters:**
- `hotspotKey` (string, required): Security Hotspot key
- `status` (enum, required): `"TO_REVIEW"` or `"REVIEWED"`
- `resolution` (enum, when REVIEWED): `"FIXED"`, `"SAFE"`, `"ACKNOWLEDGED"`
- `comment` (string, optional): Review comment

**Usage:** "Mark this hotspot as safe"

## Quality Gates

### get_project_quality_gate_status

Get the quality gate status for a project.

**Parameters:**
- `projectKey` (string, optional): Project key
- `pullRequest` (string, optional): Pull request ID

**Usage:** "Check quality gate for my-service"

### list_quality_gates

List all quality gates in the SonarQube instance. No parameters required.

## Projects and Pull Requests

### search_my_sonarqube_projects

Find SonarQube projects. Paginated response.

**Parameters:**
- `page` (string, optional): Page number

**Usage:** "List all my SonarQube projects"

### list_pull_requests

List all pull requests for a project. Use to discover PR IDs for other tools.

**Parameters:**
- `projectKey` (string, required): Project key

**Usage:** "List pull requests for payment-service"

## Measures and Metrics

### get_component_measures

Get SonarQube measures for a component (project, directory, or file).

**Parameters:**
- `component` (string, optional): Component key
- `metricKeys` (array, optional): Metrics to fetch (e.g., `["coverage", "violations", "ncloc"]`)
- `pullRequest` (string, optional): Pull request ID

**Common Metrics:**

| Metric | Description |
|--------|-------------|
| `coverage` | Code coverage percentage |
| `ncloc` | Non-comment lines of code |
| `violations` | Total violations count |
| `blocker_violations` | BLOCKER count |
| `complexity` | Cyclomatic complexity |
| `duplicated_lines_density` | Duplication percentage |

**Usage:** "Show coverage and violations for my-service"

### search_metrics

Search for available SonarQube metrics.

**Parameters:**
- `ps` (integer, optional): Page size (max 500)
- `p` (integer, optional): Page number

## Rules

### show_rule

Get detailed information about a SonarQube rule.

**Parameters:**
- `key` (string, required): Rule key (e.g., `"java:S1128"`)

Returns rule description, how to fix, violation examples, and compliant code.

**Usage:** "Explain rule java:S2259"

## Sources

### get_raw_source

Get source code as raw text from SonarQube. Requires See Source Code permission.

**Parameters:**
- `key` (string, required): File key
- `pullRequest` (string, optional): Pull request ID

### get_scm_info

Get SCM (git blame) information for source files.

**Parameters:**
- `key` (string, required): File key
- `from` (number, optional): First line (starts at 1)
- `to` (number, optional): Last line (inclusive)

## Dependency Risks

### search_dependency_risks

Search for software composition analysis issues (SCA/dependency risks). Requires SonarQube Server 2025.4 Enterprise with Advanced Security.

**Parameters:**
- `projectKey` (string): Project key
- `branchKey` (string): Branch key
- `pullRequestKey` (string, optional): Pull request key

## System

System tools are only available when connecting to SonarQube Server.

| Tool | Purpose | Parameters |
|------|---------|------------|
| `get_system_health` | Instance health (GREEN/YELLOW/RED) | None |
| `get_system_status` | Status, version, and ID | None |
| `get_system_info` | Full system config (requires admin) | None |
| `get_system_logs` | System logs (requires admin) | `name`: app, access, ce, web, es |
| `ping_system` | Liveness check (returns "pong") | None |

## Severity Model

SonarQube supports two severity models depending on instance configuration.

### MQR Mode (default in SonarQube 2025.1+)

| Priority | Severity | Description |
|----------|----------|-------------|
| 1 | BLOCKER | Production-breaking, immediate fix required |
| 2 | HIGH | Critical impact, urgent fix required |
| 3 | MEDIUM | Significant code quality impact |
| 4 | LOW | Minor improvements |
| 5 | INFO | Informational, no expected impact |

Use `impactSoftwareQualities` to filter by quality dimension:
- `MAINTAINABILITY` - Code smells, technical debt
- `RELIABILITY` - Bugs, potential crashes
- `SECURITY` - Vulnerabilities, security risks

### Standard Experience Mode (legacy)

| Priority | Severity | Description |
|----------|----------|-------------|
| 1 | BLOCKER | Production-breaking issues |
| 2 | CRITICAL | Security or major bugs |
| 3 | MAJOR | Significant code smells |
| 4 | MINOR | Minor improvements |
| 5 | INFO | Informational only |
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/references/mcp-tools.md -->
<!-- To modify, edit the source file and run the distribution workflow -->

---
name: fix-sonarqube
description: >
  SonarQube integration via MCP for Java projects. Fix issues, check coverage,
  review security hotspots, and analyze code duplications using the SonarQube
  MCP Server (v1.10+). No local setup required.
compatibility: All Java projects with SonarQube analysis
metadata:
  version: "3.0.0"
  technology: java
  category: quality
  tags:
    - java
    - sonarqube
    - mcp
    - code-quality
    - coverage
    - security-hotspots
---

# Fix SonarQube

SonarQube integration via MCP (Model Context Protocol) for Java code quality analysis, coverage checking, security hotspot review, and duplication analysis.

## When to use this skill

- Finding and fixing SonarQube issues
- Checking quality gate status
- **Checking code coverage** without running local JaCoCo builds
- Reviewing and triaging security hotspots
- Analyzing code duplications
- Analyzing code for quality issues
- Understanding SonarQube rules
- Prioritizing issue remediation
- When asked to "fix sonarqube issues", "check coverage", or "add sonarqube mcp"

## Skill Contents

### Sections

- [When to use this skill](#when-to-use-this-skill)
- [Quick Start](#quick-start)
- [MCP Tools Available](#mcp-tools-available)
- [Common Workflows](#common-workflows)
- [Supported IDEs](#supported-ides)
- [References](#references)
- [Related Rules](#related-rules)
- [Related Skills](#related-skills)

### Available Resources

**references/** - Detailed documentation
- [common rules](references/common-rules.md)
- [copilot cli setup](references/copilot-cli-setup.md)
- [coverage via mcp](references/coverage-via-mcp.md)
- [intellij setup](references/intellij-setup.md)
- [mcp tools](references/mcp-tools.md)

---

## Quick Start

The SonarQube MCP server runs remotely at `https://sonarqube-mcp.bitso.io/mcp` and is automatically configured in all supported IDEs.

**No setup required** - just use natural language:

```text
"Find BLOCKER issues in my-project"
"Show me details about rule java:S1128"
"What's the quality gate status for my-service?"
"What files have the lowest coverage in my-project?"
"Search for security hotspots in my-service"
"Find duplicated files in my-project"
"Analyze this code for SonarQube issues"
```

## MCP Tools Available

### Issues

| Tool | Purpose |
|------|---------|
| `search_sonar_issues_in_projects` | Search issues by project, severity, quality |
| `change_sonar_issue_status` | Accept, mark false positive, or reopen |
| `show_rule` | Get rule documentation and fix guidance |

### Coverage

| Tool | Purpose |
|------|---------|
| `search_files_by_coverage` | Find files with lowest test coverage |
| `get_file_coverage_details` | Line-by-line coverage for a file |
| `get_component_measures` | Coverage metrics for project/dir/file |

### Security Hotspots

| Tool | Purpose |
|------|---------|
| `search_security_hotspots` | Search for security hotspots |
| `show_security_hotspot` | Get hotspot details |
| `change_security_hotspot_status` | Review and resolve hotspots |

### Duplications

| Tool | Purpose |
|------|---------|
| `search_duplicated_files` | Find files with highest duplication |
| `get_duplications` | Line-by-line duplication details |

### Quality & Projects

| Tool | Purpose |
|------|---------|
| `get_project_quality_gate_status` | Check quality gate status |
| `list_quality_gates` | List all quality gates |
| `search_my_sonarqube_projects` | Find project keys |
| `list_pull_requests` | List PRs for a project |
| `analyze_code_snippet` | Analyze code snippet inline |

## Common Workflows

### 1. Fix Issues by Severity

```text
"Find all BLOCKER issues in payment-service"
"Show me the rule java:S2259"
"What's the quality gate status for my-service?"
```

### 2. Check Coverage

```text
"What files have the lowest coverage in my-service?"
"Show me line-by-line coverage for src/main/java/PaymentService.java"
"What's the coverage for PR #247 in my-service?"
```

### 3. Review Security Hotspots

```text
"Search for security hotspots to review in payment-service"
"Show me details about this security hotspot"
"Mark this hotspot as safe with comment: verified input is sanitized"
```

### 4. Analyze Duplications

```text
"Find the most duplicated files in my-service"
"Show duplication details for this file"
```

### 5. Understand Rules

```text
"Explain rule java:S1128 (unused imports)"
"What are the BLOCKER rules for Java?"
```

## Supported IDEs

The MCP is automatically available in:

| IDE | Configuration |
|-----|---------------|
| **Cursor** | `.cursor/mcp.json` |
| **VS Code + Copilot** | `.vscode/mcp.json` |
| **Claude Code** | `.mcp.json` |
| **IntelliJ IDEA** | See manual setup |
| **Copilot CLI** | See manual setup |

For IntelliJ and Copilot CLI, see: `java/commands/add-sonarqube-mcp-to-intellij-and-copilot-cli.md`

## References

| Reference | Description |
|-----------|-------------|
| [references/mcp-tools.md](references/mcp-tools.md) | Full MCP tool reference (all 25 tools) |
| [references/coverage-via-mcp.md](references/coverage-via-mcp.md) | Coverage checking via SonarQube MCP |
| [references/common-rules.md](references/common-rules.md) | Common Java rules |

## Related Rules

- [java-sonarqube-setup](.cursor/rules/java-sonarqube-setup/java-sonarqube-setup.mdc) - Setup guide
- [java-sonarqube-mcp](.cursor/rules/java-sonarqube-mcp/java-sonarqube-mcp.mdc) - MCP tool reference
- [fix-sonarqube-issues](.cursor/commands/fix-sonarqube-issues.md) - Fix command

## Related Skills

| Skill | Purpose |
|-------|---------|
| [java-coverage](.claude/skills/java-coverage/SKILL.md) | JaCoCo coverage for SonarQube |
| [gradle-standards](.claude/skills/gradle-standards/SKILL.md) | SonarQube Gradle plugin |
<!-- AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY -->
<!-- Source: bitsoex/ai-code-instructions → java/skills/fix-sonarqube/SKILL.md -->
<!-- To modify, edit the source file and run the distribution workflow -->