We are using the official SonarQube MCP Server (Docker image mcp/sonarqube) to integrate
SonarCloud with Claude Code for AI-assisted code review.
Environment
- SonarQube MCP Server: mcp/sonarqube (latest Docker image)
- Platform: SonarCloud (not self-hosted)
Issue
The search_sonar_issues_in_projects tool consistently returns 0 issues, even when the
Quality Gate clearly shows violations exist.
What works 
get_project_quality_gate_status(projectKey=“”,
pullRequest=“1115”)
Returns:
- Status: ERROR
- new_code_smells: 8 (threshold: 0)
- new_violations: 8 (threshold: 0)
- new_duplicated_lines_density: 14.3% (threshold: 3%)
get_component_measures(projectKey=“”, pullRequest=“1115”,
metricKeys=[“new_code_smells”, “new_violations”])
Returns: 8 code smells, 8 violations correctly.
What doesn’t work 
search_sonar_issues_in_projects(projects=[“”],
pullRequestId=“1115”)
Returns: {“issues”:[], “paging”:{“total”:0}}
We also tried:
- Without pullRequestId filter → 0 issues
- With severities=[“INFO”,“LOW”,“MEDIUM”,“HIGH”,“BLOCKER”] → 0 issues
- Without any project filter (organization-wide) → 0 issues
- With branch=“main” → 0 issues
Additional observation
search_my_sonarqube_projects()
Returns: Error 404 on
https://sonarcloud.io/api/components/search?p=1&organization=
Questions
- Is there a known limitation where “New Code” issues from Pull Requests are not exposed
via the /api/issues/search endpoint? - Are there specific token permissions required beyond “Execute Analysis” to access the
issues search API? - Is the search_my_sonarqube_projects 404 error expected behavior, or is there a
configuration issue?
Expected behavior
We expect search_sonar_issues_in_projects to return the 8 code smells/violations that are
visible in the Quality Gate status for PR #1115.
Critical finding: The 8 code smells ARE visible in the SonarCloud Web UI for PR #1115.
The user has confirmed “Browse” permission (can view issues in UI). However, the same
issues are NOT returned by
/api/issues/search?componentKeys=&pullRequest=1115 - even
when called directly in browser with active session (no token).