Connects the agent to SonarQube CLI and MCP Server for issues, quality gates, coverage, secrets scanning and dependency risks.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100
  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. SonarQube Agent Plugin

    The lens is tuned to your SonarQube tower.

    What really happens/sonarqube:sonar-integrate installs the SonarQube CLI, signs you in, and wires up the MCP Server and hooks.

    Breach Spider takes 38.

  4. SonarQube Agent Plugin

    Secret runes are caught before they leave the hall.

    What really happensHooks scan for secrets. With Vortex analysis on, code is analyzed after each edit.

    Breach Spider takes 10. Rogue: Ward.

  5. Exploit

    The ward takes the blow.

    What really happensA test or check catches the problem before it lands.

    Rogue blocks the hit.

  6. SonarQube Agent Plugin

    The tower reports cracks, gaps and weak beams.

    What really happensAsk the agent to analyze code, list open SonarQube issues, or check coverage, duplication and dependency risks.

    Breach Spider takes 17.

  7. SonarQube Agent Plugin

    The gate opens only when the walls hold.

    What really happens/sonarqube:sonar-quality-gate reports whether the project passes, and the sonar-fix-issue skill helps fix a listed issue.

    Breach Spider takes 35. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Claude Code

/plugin install sonarqube@claude-plugins-official

Codex

codex plugin marketplace add SonarSource/sonarqube-agent-plugins
codex plugin add sonarqube@sonar

Notes

Needs a SonarQube Cloud, Server or Community Build account, the SonarQube CLI (sonar), Node.js for the SessionStart hook, and Docker, Podman or Nerdctl for the MCP server image. After install run /sonarqube:sonar-integrate, or sonar auth login then sonar integrate claude. In Codex, install sonarqube@sonar from the SonarSource marketplace, then run sonar integrate codex. Vortex analysis after each edit depends on your SonarQube Cloud org. License: Sonar Source-Available License v1.0.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.