Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

SonarCloud (BYOK) — connector documentation

  • MCP endpoint: https://byok-sonarcloud.connectorbay.com/mcp
  • REST API: POST https://byok-sonarcloud.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-sonarcloud.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own SonarCloud user token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-sonarcloud.connectorbay.com/health · Tool schemas: https://byok-sonarcloud.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-sonarcloud · agent@connectorbay.com

What SonarCloud (BYOK) is for

SonarCloud (BYOK) lets an AI assistant read your own SonarCloud data through the SonarCloud API with a key you supply (user token). Read-only: 8 tools (validate_token, search_projects, search_issues, get_component_measures, get_measures_history, list_branches, list_analyses, search_metrics). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to sonarcloud.io. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by SonarCloud. SonarCloud and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Is my SonarCloud token valid?"
  • "What projects are in my SonarCloud organization?"
  • "What open security issues does my SonarCloud project have?"
  • "What is the code coverage and bug count of my SonarCloud project?"
  • "How has the coverage of my SonarCloud project changed over time?"
  • "Which branches of my SonarCloud project have a failing quality gate?"

What it does

  • validate_token: Check whether the SonarCloud token is accepted; returns valid true or false (true is also returned for anonymous access).
  • search_projects: List the projects of a SonarCloud organization with key, name, visibility and last analysis date. Page with page and page_size.
  • search_issues: Search SonarCloud issues (bugs, vulnerabilities, code smells) by project or component, organization, severity, status and software quality. Only the first 10,000 results are reachable.
  • get_component_measures: Get measures (metrics such as coverage, bugs, vulnerabilities, ncloc, duplicated_lines_density) for a SonarCloud project or file. Metric keys come from search_metrics.
  • get_measures_history: Get the history of measures of a SonarCloud project over time: dates and values per metric, oldest first.
  • list_branches: List the branches of a SonarCloud project with type, main flag, quality gate status, bug, vulnerability and code smell counts and last analysis date.
  • list_analyses: List the analyses of a SonarCloud project (newest first) with date, project version, revision and events such as quality gate changes.
  • search_metrics: List the metrics SonarCloud knows (key, name, domain, type, description) so you can choose keys for measures tools. Page with page and page_size.

BYOK key

You bring your own SonarCloud user token (https://sonarcloud.io/account/security). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to sonarcloud.io over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the SonarCloud API (sonarcloud.io) with a BYOK key; documentation: https://docs.sonarsource.com/sonarqube-cloud/appendices/web-api/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by SonarCloud. SonarCloud and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your SonarCloud account.

Built for: Worldwide. Languages: English.