Developer & CI · wired today

SonarQube, wired into your agent workforce

Build, review and release state is where agents earn their keep. The SonarQube connector is one of 205 executable connectors and gives agents 7 read-only tools, with the credential held in the vault and every call receipted.

Connecting SonarQube takes one credential

You provide base URL, token from your SonarQube account; Quox sends it as HTTP basic credentials. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Where to get it: SonarQube's own API documentation ↗ covers creating and scoping the credential.

What agents can run against SonarQube

system_status

Get the running status of the SonarQube instance this credential points at: id, version and status (STARTING, UP, DOWN, RESTARTING, DB_MIGRATION_NEEDED, DB_MIGRATION_RUNNING)

system_health

Get the health status of the SonarQube instance: GREEN (fully operational), YELLOW (usable but needs attention) or RED (not operational), with the causes and per-application-node detail. Requires the token's user to hold 'Administer System'

list_projects

List the projects on this SonarQube instance (key, name, visibility, last analysis date, analysed revision). Requires the token's user to hold 'Administer System'

project_measures

Get the current quality measures for one SonarQube component: bugs, vulnerabilities, code smells and coverage. A metric with no analysis is absent from the list rather than zero

list_issues

Search issues on this SonarQube instance, optionally narrowed to given components, impact severities or issue statuses (rule, severity, status, file, line, message, effort)

list_quality_gates

List the quality gates configured on this SonarQube instance, with which one is the default, which are built in, and each gate's clean-as-you-code compliance status

list_metrics

List the metric keys this SonarQube instance knows about (key, name, type, domain, direction), which is what project_measures accepts as metric keys

Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.

How proven is this?

LIVE-PROVEN: every tool on this page was executed with real credentials against a real running SonarQube instance (provisioned for the proof, then destroyed), and every call answered successfully. The strongest proof class a connector can carry before it runs inside your own deployment.

SonarQube integration FAQ

What can Quox agents do with SonarQube?

Agents can run 7 read-only tools against SonarQube: system status, system health, list projects, project measures, list issues and more. Every call is receipted in the evidence trail.

What does the SonarQube integration need?

You provide base URL, token from your SonarQube account; Quox sends it as HTTP basic credentials. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Do agents see my SonarQube credentials?

No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.

How proven is the SonarQube connector?