Connects the agent to SonarQube CLI and MCP Server for issues, quality gates, coverage, secrets scanning and dependency risks.
How it works
Foe: Breach Spider, a security hole an attacker could use.
Foes
- Breach SpiderHaze Poison Ward Insight Flicker Pinned Enraged
Party · Context
- RogueYour agent100/100Haze Poison Ward Insight Flicker Pinned Enraged
The Breach Spider blocks the way.
What really happensIt stands for a security hole an attacker could use.
Rogue: Context 100/100.
The spider strikes through a gap nobody guarded. Its bite lingers.
What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.
Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.
The lens is tuned to your SonarQube tower.
What really happens/sonarqube:sonar-integrate installs the SonarQube CLI, signs you in, and wires up the MCP Server and hooks.
Breach Spider takes 38.
Secret runes are caught before they leave the hall.
What really happensHooks scan for secrets. With Vortex analysis on, code is analyzed after each edit.
Breach Spider takes 10. Rogue: Ward.
The ward takes the blow.
What really happensA test or check catches the problem before it lands.
Rogue blocks the hit.
The tower reports cracks, gaps and weak beams.
What really happensAsk the agent to analyze code, list open SonarQube issues, or check coverage, duplication and dependency risks.
Breach Spider takes 17.
The gate opens only when the walls hold.
What really happens/sonarqube:sonar-quality-gate reports whether the project passes, and the sonar-fix-issue skill helps fix a listed issue.
Breach Spider takes 35. Breach Spider falls.
The Breach Spider falls.
Learn this spell
Claude Code
/plugin install sonarqube@claude-plugins-officialCodex
codex plugin marketplace add SonarSource/sonarqube-agent-plugins
codex plugin add sonarqube@sonarNotes
Needs a SonarQube Cloud, Server or Community Build account, the SonarQube CLI (sonar), Node.js for the SessionStart hook, and Docker, Podman or Nerdctl for the MCP server image. After install run /sonarqube:sonar-integrate, or sonar auth login then sonar integrate claude. In Codex, install sonarqube@sonar from the SonarSource marketplace, then run sonar integrate codex. Vortex analysis after each edit depends on your SonarQube Cloud org. License: Sonar Source-Available License v1.0.
This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.

