Merge Unified's SonarQube Cloud integration Merge Agent Handler's SonarQube Cloud MCP server

Connect your AI Agents to SonarQube Cloud in minutes

Merge lets you securely connect your agents to SonarQube Cloud and thousands of tools instantly

Start building for free

Read docs

SonarQube Cloud

Learn more about Merge Agent Handler

Available tools

search_project_analyses

List a project's analyses (newest first) with their events, filtered by branch, event category and date window, paginated. Needs the project key from searchprojects. Analysis keys feed createanalysisevent; event keys feed update/deleteanalysis_event.

create_analysis_event

Add a VERSION or OTHER event (a marker such as a release) to a project analysis. Needs the analysis key from searchprojectanalyses. Returns the event key for updateanalysisevent / deleteanalysisevent.

update_analysis_event

Rename a VERSION or OTHER analysis event. Needs the event key from createanalysisevent or searchprojectanalyses. Returns the updated event.

delete_analysis_event

Delete a VERSION or OTHER event from a project analysis. Needs the event key from createanalysisevent or searchprojectanalyses.

list_ce_activity

List background (Compute Engine) tasks that processed analysis reports: status, timings and errors, filtered by project, text, status, type and dates. Use to see why an analysis failed. Task ids feed getcetask and listwebhookdeliveries. Requires project admin.

get_ce_task

Get one background (Compute Engine) task by id: status, timings, error message and optionally warnings or scanner context. Needs the task id from listceactivity.

get_component

Get a project, directory or file by key: name, qualifier, path, language, tags, last analysis and version, plus its ancestors. Keys come from searchprojects or listcomponent_tree.

list_component_tree

Browse the directories and files under a project or directory, filtered by type and name, sorted and paginated (assumed 10,000-result cap). Returns file keys for getrawsource, getscminfo, getduplications and measures tools. Needs a project key from searchprojects.

get_raw_source

Read a file's source code as plain text, optionally a fromline/toline range, bounded by maxchars with a truncated flag and totallines for paging. Needs a file key from listcomponenttree or a searchissues result. Use getscm_info for blame.

get_scm_info

Get SCM blame for a file (author, date and revision per line or per run of lines), optionally for a line range. Needs a file key from listcomponenttree. Use getrawsource to read the code itself.

get_duplications

Get the duplicated code blocks in a file and the files they are duplicated with (line ranges per block). Needs a file key from listcomponenttree; find heavily duplicated files with getcomponenttreemeasures (metric 'duplicatedlines_density').

search_issues

Search code issues by organization, project/file keys, branch or PR, status, impact, rule, tag, language, assignee, author, dates, security standards; sort, facets, pagination (assumed 10,000-result cap). Needs organization (listorganizations), componentkeys (searchprojects) or issuekeys. Lean items unless include_raw.

get_issue_changelog

Get the change history of an issue (status, assignee, severity and tag changes with who and when). Needs the issue key from search_issues.

list_issue_tags

List tags used on issues, optionally scoped to an organization or project and filtered by text. Use them with searchissues (tags) or setissuetags. Not paginated: raise pagesize (max 100) for more.

add_issue_comment

Add a comment to an issue. Needs the issue key from searchissues. Returns the issue with its comments; the new comment's key is the input of deleteissue_comment (the inverse).

delete_issue_comment

Delete one of your own comments from an issue. Needs the comment key from addissuecomment or searchissues (additionalfields ['comments']). Returns the issue without the comment.

assign_issue

Assign an issue to a user by login ('me' for yourself), or unassign it by passing assignee null. Call listorganizationmembers first for valid logins; the issue key comes from searchissues. Returns the updated issue.

transition_issue

Change an issue's status: confirm, accept, falsepositive, resolve, or undo with reopen/unconfirm. Call searchissues with additionalfields ['transitions'] first to see which transitions the issue allows. Returns the updated issue.

set_issue_tags

Replace an issue's tags with the given set (pass [] to clear). Needs the issue key from searchissues; listissue_tags shows tags in use. Returns the updated issue.

get_component_measures

Get metric values (coverage, bugs, ncloc, duplicatedlinesdensity, ...) for a project, directory or file, on a branch or PR. Needs a component key (searchprojects / listcomponenttree) and metric keys (searchmetrics). For pass/fail use getprojectqualitygatestatus.

get_project_quality_gate_status

Get whether a project (or a branch / pull request) passes its quality gate: overall 'OK' or 'ERROR' plus every condition with its threshold and actual value, and the failing ones. Needs the project key from search_projects.

get_component_tree_measures

Get measures for every file/directory under a project or directory, filtered by type or name and sortable by a metric (e.g. lowest-coverage files: sort ['metric'], metricsort 'coverage'). Needs the component key (searchprojects) and metric keys (search_metrics). Paginated.

get_measures_history

Get how metrics (e.g. coverage, bugs) changed across a project's analyses, optionally in a date window, for trend questions. Needs the project key (searchprojects) and metric keys (searchmetrics). Paginated by history point.

search_metrics

List metric definitions (key, name, type, domain, integer id), paginated. Metric keys feed the measures tools; the integer 'id' is the legacymetricid for createqualitygate_condition.

list_organizations

List the SonarQube Cloud organizations the token's user is a member of. Each has a 'key' (the 'organization' input of v1 tools like searchprojects, searchissues, listwebhooks) and a 'uuidv4' (the 'organizationid' input of quality gate and listprojects tools). Call this first.

list_enterprises

List the SonarQube Cloud enterprises visible to the caller (Enterprise plan). Each 'id' is the 'enterpriseid' input of listportfolios. Returns an empty list when the user has no enterprise.

list_portfolios

List enterprise portfolios (Enterprise plan) with name search and pagination. Requires enterpriseid from listenterprises, unless favorite=true. Use include_children to include sub-portfolios.

list_organization_members

List an organization's members (login, name), filtered by text or role, paginated. Needs the org's uuidv4 from listorganizations. Logins are the assignee input of assignissue and the assignees filter of searchissues and searchdependencyrisks.

search_projects

Search an organization's projects by name/key text, keys, UUIDs, last-analysis date or provisioned state, paginated (assumed 10,000-result cap). Needs the organization key from listorganizations. Returns project keys (the 'project' input of v1 tools). Use listprojects instead to get legacy_id or filter by tag.

list_projects

List projects (v2) by organization UUID (uuidv4 from listorganizations), project keys, ids, legacy ids or tags, with pagination. Returns each project's id, key and legacyid: legacyid is the projectid for associatequalitygateproject. At least one of organizationids/ids/keys/legacyids is required.

get_project

Get one project (v2) by its UUIDv4 id: key, name, visibility, organizationid, tags, links and legacyid. Find the id with listprojects or searchprojects (uuidv4). Use getcomponent for a project by key.

create_project

Create (provision) a project. Needs the organization key from listorganizations, a unique projectkey and a name. Returns the key; listprojects(keys=[key]) then gives the legacyid that associatequalitygateproject needs. Requires 'Create Projects'. Inverse: deleteproject.

delete_project

Permanently delete a project and all its analyses, issues and measures. Needs the project key from search_projects. Requires 'Administer' permission on the project. Cannot be undone.

search_project_tags

Search the project tags in use, optionally by text. Use the tags with listprojects (tags filter) or setprojecttags. Not paginated: raise pagesize (max 100) for more.

set_project_tags

Replace a project's tags with the given set (at least one tag). Clearing all tags is not supported: the docs don't define an empty tags value (live-verify item). Needs the project key from searchprojects; searchproject_tags lists tags in use. Requires 'Administer' on the project.

list_branches

List a project's analyzed branches with their quality gate status and last analysis. Needs the project key from searchprojects (or branchids). Branch names are the 'branch' input of issue, measure and source tools.

list_pull_requests

List a project's analyzed pull requests with quality gate status and issue counts. Needs the project key from searchprojects. Each 'key' is the 'pullrequest' input of issue, measure and source tools.

list_quality_gates

List an organization's quality gates (built-in and custom), filtered by name, paginated. Needs the organization's uuidv4 from listorganizations. Gate ids feed get/update/deletequalitygate, condition and association tools.

get_quality_gate

Get one quality gate by UUID: name, built-in flag, Clean as You Code and AI-qualified flags. Find the id with listqualitygates. Use listqualitygate_conditions for its conditions.

create_quality_gate

Create a quality gate in an organization (organizationid is the uuidv4 from listorganizations), empty or copied from another gate. Returns the new gate id for createqualitygatecondition and associatequalitygateproject. Inverse: deletequality_gate.

update_quality_gate

Rename a custom quality gate or change its AI-qualified flag. Needs the gate id from listqualitygates; built-in gates cannot be changed. Returns the updated gate.

delete_quality_gate

Delete a custom quality gate with its conditions; its projects fall back to the organization default. Needs the gate id from listqualitygates. Built-in and default gates cannot be deleted.

list_quality_gate_conditions

List a quality gate's conditions (metric id, operator LT/GT, threshold). Needs the gate id from listqualitygates. Map legacymetricid to a metric key with search_metrics.

create_quality_gate_condition

Add a condition to a custom quality gate. Call searchmetrics first: legacymetricid is a metric's integer id. Gate id from listqualitygates or createqualitygate. Returns the condition id. Inverse: deletequalitygatecondition.

update_quality_gate_condition

Change a quality gate condition's metric, operator or threshold. Needs the condition id from listqualitygateconditions; a new metric id comes from searchmetrics. Returns the updated condition.

delete_quality_gate_condition

Delete a condition from a custom quality gate. Needs the condition id from listqualitygate_conditions.

list_quality_gate_projects

List explicit project-to-quality-gate associations in an organization (uuidv4 from listorganizations), filtered by gate (listqualitygates) or project legacy ids (listprojects); one is required. Paginated. Association ids feed dissociatequalitygateproject. Projects on the org default gate may not be listed.

associate_quality_gate_project

Make a project use a quality gate, replacing its previous gate. Call listprojects first: projectid is the project's legacyid. Gate id from listqualitygates. Returns the association id. Inverse: dissociatequalitygateproject.

dissociate_quality_gate_project

Remove a project's explicit quality gate association so it uses the organization default gate. Needs the association id from listqualitygateprojects or associatequalitygateproject.

search_rules

Search an organization's coding rules by text, language, repository, impact severity/quality, tag, key, status, security standard, template, or activation in a quality profile (searchqualityprofiles); sortable, paginated (assumed 10,000 cap), lean fields by default. Needs the org key (listorganizations). Use getrule for a full description.

get_rule

Get a coding rule's full description (why it is an issue, how to fix it), impacts and tags, optionally with its quality-profile activations. Needs the organization key and a rule key from searchrules or a searchissues result.

list_rule_tags

List the tags used on an organization's rules, optionally filtered by text, for searchrules (tags). Needs the organization key from listorganizations. Not paginated: raise page_size (max 100) for more.

search_quality_profiles

Search an organization's quality profiles (the rule sets used per language), by language, project, name or default. Needs the organization key from listorganizations. Profile keys feed searchrules (qualityprofilekey + activation).

list_languages

List the programming languages SonarQube Cloud analyzes (key and name), optionally filtered by text. Language keys feed the 'languages' filters of searchissues and searchrules.

search_dependency_risks

Search a project's dependency risks (vulnerable, malicious or license-prohibited packages) by type, severity, status, package, CVE, scope or assignee (logins from listorganizationmembers); sortable, paginated. Needs a project key from searchprojects. Keys feed changedependencyriskstatus. SCA plans only.

change_dependency_risk_status

Change a dependency risk's status (CONFIRM, ACCEPT, SAFE, FIXED, or REOPEN to undo) with an optional comment. Call searchdependencyrisks first for the key and its allowed 'transitions'. Returns the risk.

validate_credential

Validate the SonarQube Cloud token by calling api/authentication/validate. Returns success and a message. Use this first to confirm the token (and region) before running other tools.

list_webhooks

List the webhooks of an organization (projectkey null) or of one project. Needs the organization key from listorganizations. Webhook keys feed updatewebhook, deletewebhook and listwebhookdeliveries.

create_webhook

Create a webhook that SonarQube Cloud calls after each analysis, at organization or project level. Needs the organization key from listorganizations. Returns the webhook key. Inverse: deletewebhook.

update_webhook

Update a webhook's name, URL and secret (name and url are both required; send current values to keep them). Needs the webhook key from list_webhooks. Pass secret '' to remove it, null to keep it.

delete_webhook

Delete a webhook and its delivery history. Needs the webhook key from listwebhooks or createwebhook.

list_webhook_deliveries

List recent webhook delivery attempts (success, HTTP status, duration) for exactly one of: a webhook (listwebhooks), a project (searchprojects) or a CE task (listceactivity). Paginated. Use getwebhookdelivery for a payload.

get_webhook_delivery

Get one webhook delivery with the payload that was sent, to debug a failing webhook. Needs the delivery id from listwebhookdeliveries.

View all tools by creating a free account See more tools

How to set up Merge Agent Handler

In an mcp.json file, add the configuration below, and restart Cursor.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "url": "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
5      "headers": {
6        "Authorization": "Bearer yMt*****"
7      }
8    }
9  }
10}
11

Copy Code

Open your Claude Desktop configuration file and add the server configuration below. You'll also need to restart the application for the changes to take effect.

Make sure Claude is using the Node v20+.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "command": "npx",
5      "args": [
6        "-y",
7        "mcp-remote@latest",
8        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
9        "--header",
10        "Authorization: Bearer ${AUTH_TOKEN}"
11      ],
12      "env": {
13        "AUTH_TOKEN": "yMt*****"
14      }
15    }
16  }
17}

Copy Code

Open your Windsurf MCP configuration file and add the server configuration below.
Click on the refresh button in the top right of the Manage MCP server page or in the top right of the chat box in the box icon.

Learn more in the official documentation ↗

1{
2    "mcpServers": {
3      "agent-handler": {
4        "command": "npx",
5        "args": [
6          "-y",
7          "mcp-remote@latest",
8          "https://ah-api.merge.dev/api/v1/tool-packs/<tool-pack-id>/registered-users/<registered-user-id>/mcp",
9          "--header",
10          "Authorization: Bearer ${AUTH_TOKEN}"
11        ],
12        "env": {
13          "AUTH_TOKEN": "<ah-production-access-key>"
14        }
15      }
16    }
17  }

Copy Code

In Command Palette (Cmd+Shift+P on macOS, Ctrl+Shift+P on Windows), run "MCP: Open User Configuration".

You can then add the configuration below and press "start" right under servers. Enter the auth token when prompted.

Learn more in the official documentation ↗

1{
2  "inputs": [
3    {
4      "type": "promptString",
5      "id": "agent-handler-auth",
6      "description": "Agent Handler AUTH_TOKEN", // "yMt*****" when prompt
7      "password": true
8    }
9  ],
10  "servers": {
11    "agent-handler": {
12      "type": "stdio",
13      "command": "npx",
14      "args": [
15        "-y",
16        "mcp-remote@latest",
17        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
18        "--header",
19        "Authorization: Bearer ${input:agent-handler-auth}"
20      ]
21    }
22  }
23}