DEV Community: Giuliano Buzetti

SonarQube MCP in Claude Code: read-only setup, keeping the token out of your repo, and fewer toolsets

Giuliano Buzetti — Wed, 28 Oct 2026 14:33:23 +0000

The SonarQube MCP Server lets Claude Code read issues, quality gates, measures, security hotspots and coverage from SonarQube Cloud or SonarQube Server. SonarSource ships it as the sonarsource/sonarqube-mcp container image, so Claude Code starts it as a local stdio process through Docker, and it acts with the rights of the token you give it.

The steps below summarize the official docs (the SonarQube MCP Server README, SonarSource's configuration generator, the SonarQube Cloud docs on managing tokens, and the Claude Code docs on MCP and permissions), checked on 2026-10-28. They are based on the official docs, not hands-on tested; if something differs on your version, the linked docs win. The original version of this guide lives at AgentTask Atlas: How to connect the SonarQube MCP server to Claude Code.

1. Check what you need

Docker on the machine running Claude Code. For SonarQube Cloud: a token (SONARQUBE_TOKEN); SONARQUBE_ORG is optional and fixes the organization, and Cloud US also needs SONARQUBE_URL=https://sonarqube.us. For SonarQube Server: a USER token plus SONARQUBE_URL; the server must be SonarQube Server 2025.1 or Community Build 25.1 or newer. SonarSource also has an official configuration generator at mcp.sonarqube.com/config-generator.html if you'd rather not write the command yourself.

2. Add it for SonarQube Cloud, read-only

export SONAR_TOKEN="YOUR_TOKEN"   # better: load it from your secret manager or shell profile
export SONAR_ORG="your-org-key"
claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  --env SONARQUBE_READ_ONLY=true \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG -e SONARQUBE_READ_ONLY sonarsource/sonarqube-mcp

This is the Claude Code command from SonarSource's README with SONARQUBE_READ_ONLY=true added, which turns off every write tool (such as changing an issue's status). Leave that line out only if you want the agent to accept issues or mark them false positives. Claude Code writes to local scope by default (only you, only this project, stored in ~/.claude.json outside your repository); add --scope user to make it available in all your projects, or --scope project to write it to .mcp.json (see step 4 before doing that). Everything after -- is the docker command Claude Code runs, untouched.

3. Or add it for SonarQube Server

Same command, with your server's URL instead of the organization. Use a USER token, not a project or global analysis token.

claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_USER_TOKEN \
  --env SONARQUBE_URL=$SONAR_URL \
  --env SONARQUBE_READ_ONLY=true \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_URL -e SONARQUBE_READ_ONLY sonarsource/sonarqube-mcp

4. Share it with the team in .mcp.json without committing the token

Claude Code expands ${VAR} in a project .mcp.json's command, args and env, so each teammate sets SONARQUBE_TOKEN and SONARQUBE_ORG in their own shell and the file stays secret-free:

{
  "mcpServers": {
    "sonarqube": {
      "type": "stdio",
      "command": "docker",
      "args": ["run", "--init", "--pull=always", "-i", "--rm", "-e", "SONARQUBE_TOKEN", "-e", "SONARQUBE_ORG", "-e", "SONARQUBE_READ_ONLY", "sonarsource/sonarqube-mcp"],
      "env": {
        "SONARQUBE_TOKEN": "${SONARQUBE_TOKEN}",
        "SONARQUBE_ORG": "${SONARQUBE_ORG}",
        "SONARQUBE_READ_ONLY": "true"
      }
    }
  }
}

Claude Code asks each person to approve project-scoped servers the first time.

5. Load only the toolsets you use

Every enabled tool's name, description and schema sits in Claude Code's context in every session. SONARQUBE_TOOLSETS limits the server to the toolsets you list (projects is always on), and SONARQUBE_PROJECT_KEY fixes one project so tools stop asking for it. Pass each one with another --env and -e pair, or in the env block above.

--env SONARQUBE_TOOLSETS=issues,quality-gates,security-hotspots,measures
--env SONARQUBE_PROJECT_KEY=my-project
# and add to the docker args:
-e SONARQUBE_TOOLSETS -e SONARQUBE_PROJECT_KEY

6. Check the connection and try it

claude mcp list
claude mcp get sonarqube
# in a session:
My quality gate is failing for my project. Can you help me understand why and fix the most critical issues?
I want to reduce technical debt in my project. What are the top issues I should prioritize?

claude mcp list should show sonarqube as connected, and /mcp shows its tools. The prompts above are from SonarSource's examples.

7. Keep write tools behind a prompt

If you skipped read-only mode, an ask rule in .claude/settings.json makes Claude Code confirm every SonarQube tool call before it runs, including status changes:

{
  "permissions": { "ask": ["mcp__sonarqube__*"] }
}

Don't add an allow rule for mcp__sonarqube__* unless you are fine with the agent accepting issues or marking them false positives on its own.

Troubleshooting (from the official docs)

"SonarQube server version is not supported, minimal version is SQS 2025.1 or SQCB 25.1": the server checks your SonarQube Server version at startup. Upgrade to a supported release; this check doesn't apply to SonarQube Cloud.
A feature or tool from the README is missing: you are probably on an old cached image. Run docker pull sonarsource/sonarqube-mcp (or keep --pull=always), then restart Claude Code.
Connection or configuration problems you can't see: set SONARQUBE_DEBUG_ENABLED=true for debug logs on stderr and in STORAGE_PATH/logs/mcp.log.
The server times out while starting: raise Claude Code's MCP startup timeout, for example MCP_TIMEOUT=10000 claude for 10 seconds. Running docker pull sonarsource/sonarqube-mcp beforehand also keeps the image download out of startup.
claude mcp list shows sonarqube as ⏸ Pending approval: it comes from a project .mcp.json you haven't approved yet. Run claude interactively in the project, accept the workspace trust dialog and approve the server.
claude mcp list warns about a missing environment variable: a ${VAR} in .mcp.json names a variable that isn't set, so Claude Code passes the literal ${VAR} text. Export SONARQUBE_TOKEN (and SONARQUBE_ORG or SONARQUBE_URL) in the shell you start claude from.

Notes

The server sends anonymous usage data to SonarSource (no source code or IP address, per the README). Add --env TELEMETRY_DISABLED=true and -e TELEMETRY_DISABLED to turn it off.
analyze_code_snippet otherwise receives whole files as arguments. Mounting your project at /app/mcp-workspace (-v /path/to/project:/app/mcp-workspace in the docker args) lets it read files from disk instead, so file contents don't pass through the agent's context.
--pull=always gets updates automatically. For reproducible setups, pin a tag such as sonarsource/sonarqube-mcp:<version> and drop --pull=always so Docker doesn't upgrade silently.
Give the agent a token with only the rights it needs: the server can do whatever that token can.
The license is SonarSource's source-available license (SONAR Source-Available License v1.0), not an OSI open-source license.

Context7 in Claude Code: setup, keeping the API key out of your repo, and fixing 401s

Giuliano Buzetti — Tue, 27 Oct 2026 14:34:10 +0000

Context7 gives Claude Code current, version-specific library docs through two tools, resolve-library-id and query-docs. The hosted server at https://mcp.context7.com/mcp needs no local Node.js; an API key is optional, but Upstash recommends a free one for higher rate limits. Your library names and queries are sent to Context7's hosted service, whose backend is private.

The steps below summarize the official docs (the Context7 README, Context7's Claude Code page and troubleshooting page, and the Claude Code docs on MCP and permissions), checked on 2026-10-27. They are based on the official docs, not hands-on tested; if something differs on your version, the linked docs win. The original version of this guide lives at AgentTask Atlas: How to connect the Context7 MCP server to Claude Code.

1. Check what you need

Nothing for the hosted server except outbound HTTPS. For an API key, create one in the Context7 dashboard (context7.com/dashboard); keys start with ctx7sk. The local npx server needs Node.js 20 or newer, and the ctx7 setup CLI needs Node.js 22.13 or newer.

2. Fastest: let ctx7 set it up

npx ctx7 setup --claude

It signs you in with an OAuth device flow (a link and short code you can open on any device, so it also works over SSH), generates an API key and lets you choose CLI + skill mode or MCP mode. Undo it later with npx ctx7 remove.

3. Or install the Context7 plugin

Run these inside Claude Code, restart it, then open /mcp, select Context7 and finish the browser sign-in:

/plugin marketplace add upstash/context7
/plugin install context7@context7-marketplace

No API key is needed, and the plugin does not read CONTEXT7_API_KEY, so use the next step on headless, SSH or CI hosts.

4. Manual: hosted server with the key from an env var

export CONTEXT7_API_KEY="YOUR_API_KEY"   # better: load it from your secret manager or shell profile
claude mcp add --scope user --header "Authorization: Bearer $CONTEXT7_API_KEY" --transport http context7 https://mcp.context7.com/mcp

--scope user makes it available in every project and stores it in ~/.claude.json, outside your repository. To skip the key and sign in with OAuth instead, use https://mcp.context7.com/mcp/oauth without the header and authenticate from /mcp.

5. Share it with the team without committing the key

Claude Code expands ${VAR} in the url and headers of a project's .mcp.json, so each teammate sets CONTEXT7_API_KEY in their own environment and the file stays secret-free:

{
  "mcpServers": {
    "context7": {
      "type": "http",
      "url": "https://mcp.context7.com/mcp",
      "headers": { "Authorization": "Bearer ${CONTEXT7_API_KEY}" }
    }
  }
}

Claude Code asks each person to approve project-scoped servers the first time.

6. Or run it locally over stdio

claude mcp add --env CONTEXT7_API_KEY="$CONTEXT7_API_KEY" --transport stdio context7 -- npx -y @upstash/context7-mcp

Pass the key with --env instead of --api-key on the command line. Keep --transport stdio between --env and the server name: if the name comes right after --env, the CLI reads it as another KEY=value pair.

7. Check the connection

claude mcp list
claude mcp get context7
# in a session:
use context7 with /vercel/next.js for app router setup

claude mcp list should show context7 as connected. Adding the library ID (/owner/repo) skips the lookup step.

Troubleshooting (from the official docs)

Rate-limit errors: add a free API key as an Authorization: Bearer header (remote) or CONTEXT7_API_KEY / --api-key (local).
401, and claude mcp list shows Failed to connect: check the key starts with ctx7sk and the header reads exactly Authorization: Bearer <key>. Claude Code reports a rejected header as a failed connection rather than offering OAuth.
Warning about a missing variable: CONTEXT7_API_KEY isn't set in the shell that launched Claude Code. Export it first, or use a ${VAR:-default} fallback.
ERR_MODULE_NOT_FOUND / Cannot find module 'uriTemplate.js' locally: use Node.js 20+ and @upstash/context7-mcp@latest, try bunx or deno, or use the hosted URL.
404 for a library: IDs look like /owner/repo or /owner/repo/version; let resolve-library-id find it first.
Corporate proxy: set https_proxy / HTTPS_PROXY (in the server's env for stdio), then check curl https://mcp.context7.com/ping returns pong.
"already exists in local config": run claude mcp remove context7 first, or add it under a different scope.

Notes

Context7's 2 tool definitions measured about 1,060 tokens (o200k) on @upstash/context7-mcp 4.4.4, one of the lightest servers on our MCP tool budget table.
Every query text leaves your machine for Context7's service, so don't paste secrets or proprietary code into one.
An allow rule for mcp__context7__* in .claude/settings.json stops the per-call prompt; leave it out to keep confirming each lookup.
Library docs on Context7 are community-contributed; Upstash says it can't guarantee their accuracy or security.

Connecting Jira, Confluence and Bitbucket to Claude Code with Atlassian's Rovo MCP server

Giuliano Buzetti — Mon, 26 Oct 2026 14:37:13 +0000

Atlassian runs an official, hosted MCP server (the Atlassian Rovo MCP Server), so there is nothing to install locally. Claude Code connects to https://mcp.atlassian.com/v2/mcp over HTTP and acts with your own Atlassian Cloud permissions. Atlassian's README says v2 is the recommended endpoint for new setups.

The steps below summarize the official docs (the Atlassian MCP Server README, Atlassian Support's API token guide, and the Claude Code docs on MCP and permissions), checked on 2026-10-26. Client CLIs and admin menus change, so if something differs on your version, the linked docs win. The original version of this guide lives at AgentTask Atlas: How to connect the Atlassian Rovo MCP server to Claude Code.

1. Check what you need

An Atlassian Cloud site with Jira, Confluence, Jira Service Management, Bitbucket or Compass.
A browser for the OAuth 2.1 sign-in.

Headless setups can use an API token instead, but only if an org admin has enabled API-token authentication (Atlassian Administration → Rovo → Rovo MCP server → Authentication).

2. Add the server

This is the command Atlassian's README gives for Claude Code:

claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp

Add --scope user to make it available in every project, or --scope project to share it through .mcp.json.

3. Sign in with OAuth

Start a Claude Code session and run /mcp, select atlassian and complete the browser sign-in:

claude
/mcp

Until you do, claude mcp list shows the server as needing authentication. Access is limited to what your Atlassian account can already see.

4. Or share it with the team in `.mcp.json`

This is the entry from Atlassian's own repository:

{
  "mcpServers": {
    "atlassian": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v2/mcp"
    }
  }
}

Keep "type": "http". Claude Code reads an entry with a url but no type as a stdio server and skips it. Each teammate still signs in with their own account from /mcp.

5. Headless: authenticate with an API token

Create a scoped personal API token, base64-encode email:api_token as Atlassian's token guide shows, and pass it as a Basic Authorization header (a service account key uses Bearer instead):

echo -n "your.email@example.com:YOUR_API_TOKEN" | base64
claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp \
  --header "Authorization: Basic BASE64_ENCODED_EMAIL_AND_TOKEN"

Two things to know: Jira Service Management tools only work with token auth, and some Compass tools are not available with it.

6. Keep write tools behind a prompt

The server can create and update Jira issues, Confluence pages and Bitbucket content. An ask rule in .claude/settings.json makes Claude Code confirm every Atlassian tool call:

{
  "permissions": {
    "ask": [
      "mcp__atlassian__*"
    ]
  }
}

Don't add an allow rule for mcp__atlassian__* unless you trust every write it can make.

Good to know

The delete_jira and manage_jira permission groups are disabled by default; an admin has to turn them on. Leave them off unless you need them.
Tokens are not bound to one cloudId and skip the OAuth domain allowlist, so prefer OAuth for interactive use and keep tokens scoped to the projects the agent needs.
Atlassian suggests putting your Jira project key, Confluence space and cloudId in AGENTS.md so the agent makes fewer discovery calls.
Every tool call is recorded in your organization's audit log (Atlassian Administration → Insights → Audit log).
The legacy SSE endpoint (/v1/sse) stopped being supported after 30 June 2026. Point old configs at /v2/mcp.

More on MCP in Claude Code

New to MCP in Claude Code? The general guide covers transports, scopes and how to confirm a server connected: How to add an MCP server to Claude Code.

I keep a small catalog of MCP servers and Agent Skills organized by dev task, with the install step, credentials, permissions and documented clients taken from each project's official docs. The Atlassian Rovo MCP Server entry is based on official docs, not hands-on tested, so always check the source repo. The catalog is also available as a free, read-only remote MCP server (no account or key):

claude mcp add --transport http agenttask-atlas https://agenttaskatlas.com/api/mcp

Disclosure: I run AgentTask Atlas, the catalog linked above. This post was drafted with AI assistance from the guide on agenttaskatlas.com, whose steps summarize the official Atlassian and Claude Code docs as of 2026-10-26.

Adding MCP servers to Claude Code: remote, local and team setups that actually connect

Giuliano Buzetti — Tue, 20 Oct 2026 14:40:44 +0000

Most "my MCP server doesn't work in Claude Code" problems come down to three small things: the wrong transport, the wrong scope, or a .mcp.json entry that Claude Code silently skips. This post walks through each one with commands you can paste, then shows how to confirm the server is really connected before you rely on it.

Everything below follows the official Claude Code MCP docs (code.claude.com/docs/en/mcp). Client CLIs change often, so if a flag behaves differently on your version, the docs win. The original, shorter version of this guide lives at AgentTask Atlas: How to add an MCP server to Claude Code.

1. Know which kind of server you have

Before typing anything, look at the server's README and find out which of these two it is:

Remote (HTTP): the README gives you a URL such as https://.../mcp. The server runs somewhere else; Claude Code talks to it over HTTP. The docs recommend the HTTP transport for remote servers.
Local (stdio): the README gives you a command such as npx some-package or uvx some-tool. Claude Code starts that process on your machine and talks to it over stdin/stdout.

Picking the wrong transport is the most common reason a server shows up as failed.

2. Add a remote server

The shape is claude mcp add --transport http <name> <url>. For example, Sentry documents a remote endpoint:

claude mcp add --transport http sentry https://mcp.sentry.dev/mcp

Servers that use OAuth (like that one) don't need a token on the command line. You sign in afterwards from inside a Claude Code session with /mcp.

If a server uses a fixed API token instead, pass it as a header:

claude mcp add --transport http secure-api https://api.example.com/mcp \
  --header "Authorization: Bearer your-token"

3. Add a local (stdio) server

For stdio servers, everything after -- is the command that starts the server, passed through untouched. Claude Code's own flags (--transport, --env, --scope) go before the --:

claude mcp add --transport stdio playwright -- npx @playwright/mcp@latest

With an environment variable the server needs:

claude mcp add --env API_KEY=your-key --transport stdio example -- npx -y @example/mcp-server

If you put --env after the --, it gets passed to the server as an argument instead of being set as a variable, which is an easy mistake to miss.

4. Choose a scope on purpose

Every claude mcp add writes to one of three scopes:

Scope	Who sees it	Where it lives
`local` (default)	Only you, only this project	`~/.claude.json`, under the project's path
`project`	Everyone who clones the repo	`.mcp.json` at the project root
`user`	Only you, in all your projects	your user config

A rule of thumb: servers with personal credentials go in local or user; servers the whole team should get go in project.

claude mcp add --transport http sentry --scope user https://mcp.sentry.dev/mcp

5. Sharing with a team: the `.mcp.json` gotcha

For a team setup you can commit .mcp.json at the repo root. The detail that trips people up: a remote entry needs "type": "http". An entry with a url but no type is read as a stdio server and skipped, with a configuration warning.

{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp"
    },
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"]
    }
  }
}

Two more things worth knowing about project-scoped servers:

Claude Code asks each developer for approval before using servers from a .mcp.json it hasn't seen before. claude mcp reset-project-choices resets those choices.
.mcp.json supports ${VAR} and ${VAR:-default} expansion (in command, args, env, url and headers), so you don't have to commit secrets. The docs note that some credential variables are deliberately read as empty in a remote server's url and headers, so check that section if a header token doesn't arrive.

6. Confirm it actually connected

Adding a config doesn't mean the server works. Check:

claude mcp list          # status per server: ✔ Connected, ! Needs authentication, ✘ Failed to connect
claude mcp get sentry    # details for one server

Inside a session, /mcp shows the same status and is where OAuth sign-in happens. A "✘ Failed to connect" in claude mcp list means Claude Code couldn't reach that server, not that the list command itself failed.

Then do one real test: ask Claude to use a tool from that server and check the tool call in the transcript.

A few practical tips

Already set up servers in Claude Desktop? claude mcp add-from-claude-desktop imports them (macOS and WSL).
Slow-starting local servers: MCP_TIMEOUT=10000 claude raises the startup timeout to 10 seconds.
claude mcp remove <name> removes a server; for remote servers it also deletes the stored OAuth tokens.
Only connect servers you trust. The docs warn that servers which fetch external content can expose you to prompt injection. Read the permissions and the credentials a server asks for before adding it.

Finding a server for the task in front of you

If you're not sure which server to add, I keep a small, curated catalog of MCP servers and Agent Skills organized by dev task, with the install step, credentials, permissions and documented clients taken from each project's official README. Entries summarize official sources and are not hands-on tested, so always check the source repo.

Servers whose docs include Claude Code setup: the Claude Code guide
Compare by task, e.g. databases or debugging & observability
Browser testing options such as Playwright MCP and Chrome DevTools MCP

The catalog is also available as a free, read-only remote MCP server (no account or key), which doubles as a quick way to test step 2:

claude mcp add --transport http agenttask-atlas https://agenttaskatlas.com/api/mcp

Setup for other clients: Cursor, VS Code, Claude Desktop.

Disclosure: I run AgentTask Atlas, the catalog linked above. This post was drafted with AI assistance and every command was checked against the official Claude Code docs before publishing.

DEV Community: Giuliano Buzetti

SonarQube MCP in Claude Code: read-only setup, keeping the token out of your repo, and fewer toolsets

1. Check what you need

2. Add it for SonarQube Cloud, read-only

3. Or add it for SonarQube Server

4. Share it with the team in .mcp.json without committing the token

5. Load only the toolsets you use

6. Check the connection and try it

7. Keep write tools behind a prompt

Troubleshooting (from the official docs)

Notes

Context7 in Claude Code: setup, keeping the API key out of your repo, and fixing 401s

1. Check what you need

2. Fastest: let ctx7 set it up

3. Or install the Context7 plugin

4. Manual: hosted server with the key from an env var

5. Share it with the team without committing the key

6. Or run it locally over stdio

7. Check the connection

Troubleshooting (from the official docs)

Notes

Connecting Jira, Confluence and Bitbucket to Claude Code with Atlassian's Rovo MCP server

1. Check what you need

2. Add the server

3. Sign in with OAuth

4. Or share it with the team in .mcp.json

5. Headless: authenticate with an API token

6. Keep write tools behind a prompt

Good to know

More on MCP in Claude Code

Adding MCP servers to Claude Code: remote, local and team setups that actually connect

1. Know which kind of server you have

2. Add a remote server

3. Add a local (stdio) server

4. Choose a scope on purpose

5. Sharing with a team: the .mcp.json gotcha

6. Confirm it actually connected

A few practical tips

Finding a server for the task in front of you

4. Or share it with the team in `.mcp.json`

5. Sharing with a team: the `.mcp.json` gotcha