skills.rest
ByronWilliamsCPA
ByronWilliamsCPAOFFICIAL
Explore all skills by this author →
GitHub

sonarcloud

Review, triage, and fix SonarCloud issues and security hotspots via SonarQube MCP servers.

Updated Jul 9, 2026
Search Tags:#code quality#static analysis#code review#mcp#quality gate#sonarcloud#security hotspots
One-click install
npx skills add https://github.com/ByronWilliamsCPA/plugin --skill sonarcloud-byronwilliamscpa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sonarcloud
Source: https://github.com/ByronWilliamsCPA/plugin/tree/main/plugins/wff-code/skills/sonarcloud
Command: npx skills add https://github.com/ByronWilliamsCPA/plugin --skill sonarcloud-byronwilliamscpa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? SonarCloud findings pile up across issues and security hotspots, and manually navigating the dashboard to triage, understand rules, and apply fixes is slow. This Skill connects directly to SonarCloud through SonarQube MCP servers so you can query, triage, and remediate findings without leaving your workspace. ## Core Features & Use Cases - Issue and Hotspot Triage: List open issues by severity and security hotspots by vulnerability probability, or run a combined triage dashboard for weekly hygiene reviews. - Automated Fixing: Fetch rule remediation guidance via show_rule and apply fixes file-by-file, including taint-analysis rules where the fix belongs at the untrusted source boundary. - Setup Diagnostics: Run a full check mode that validates MCP container connectivity, cross-checks project keys across sonar-project.properties, .sonarlint/connectedMode.json, and VS Code settings, and verifies analysis freshness. - Use Case: Your quality gate fails on a PR. Run the skill to see which conditions failed, list the BLOCKER issues, get remediation guidance for each rule, and apply fixes before pushing again. ## Quick Start Ask the assistant to show the SonarCloud quality gate status and top open issues for the current project.

Frequently Asked Questions about sonarcloud

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix SonarCloud issues automatically?▼

Use the fix mode to fetch open issues, look up each rule's remediation guidance with show_rule, and apply fixes to the local files. The skill reads the current file state first since SonarCloud findings may reference stale analysis, then runs the project linter to verify no regressions.

How do I review SonarCloud security hotspots?▼

Use the hotspots mode to list security hotspots with TO_REVIEW status, optionally filtered by HIGH, MEDIUM, or LOW vulnerability probability. Each hotspot includes its security category, file, line, and rule key, and you can mark them ACKNOWLEDGED, SAFE, or FIXED after review.

Why do SonarCloud issues still show after I fixed the code?▼

Fixing code locally does not update SonarCloud because findings reflect the last server-side analysis. A new analysis must run via push, PR, or the sonar-scanner CLI before the issue disappears from MCP query results.

What is the difference between SonarCloud issues and security hotspots?▼

Issues are rule violations with severities like BLOCKER or HIGH, while hotspots are security-sensitive code requiring human judgment on exploitability. They are separate queues, so a zero issue count does not mean zero hotspots.

Why is the SonarQube MCP server not responding?▼

The MCP servers run as Docker containers on ports 8090 and 8091, so Docker must be running and the containers up. Run the check mode to diagnose connectivity, token configuration, and project binding problems, with restart commands available in the org context file.

Related Skills

Explore More Software Engineering Skills→
edercnjedercnj

x-run-sonar-security

Run SonarScanner, evaluate quality gates, and generate SARIF reports.

Community
Advanced
badbsallyybadbsallyy

prepare-pr

Rebase a GitHub pull request onto main and run automated checks.

Community
Advanced
zengbin93zengbin93
2

python-code-review

Evaluate Python code for style, type annotations, tests, and performance.

Community
Intermediate
bitsoexbitsoex
40

fix-sonarqube

Integrates Java projects with SonarQube via MCP Server for automated code quality analysis and issue resolution.

Official
Intermediate