SonarQube MCP measure tool drops periods values for New Code metrics on branches

SonarQube MCP Server
,
1

Environment

  • SonarQube Cloud US
  • VS Code Copilot

Description

The SonarQube MCP get_component_measures tool does not expose values for New Code metrics when the SonarQube API returns those values inside the periods array.

This affects branch analysis, where New Code measures are represented using a period object rather than a top-level value.

Project

Project key: ...
Branch: master
SonarQube URL: https://sonarqube.us

Requested metrics

new_blocker_violations
new_critical_violations
new_major_violations
new_minor_violations

Reproduction

The raw SonarQube API returns populated New Code measures:

curl -sS \
  "https://sonarqube.us/api/measures/component?component=${PROJECT_KEY}&branch=master&metricKeys=new_blocker_violations,new_critical_violations,new_major_violations,new_minor_violations" \
  --user "${TOKEN}:" | jq

The response includes:

{
  "component": {
    "key": "...",
    "measures": [
      {
        "metric": "new_major_violations",
        "periods": [
          {
            "index": 1,
            "value": "2",
            "bestValue": false
          }
        ]
      },
      {
        "metric": "new_minor_violations",
        "periods": [
          {
            "index": 1,
            "value": "0",
            "bestValue": true
          }
        ]
      },
      {
        "metric": "new_critical_violations",
        "periods": [
          {
            "index": 1,
            "value": "0",
            "bestValue": true
          }
        ]
      },
      {
        "metric": "new_blocker_violations",
        "periods": [
          {
            "index": 1,
            "value": "0",
            "bestValue": true
          }
        ]
      }
    ]
  }
}

However, the MCP tool returns the measures without their values:

{
  "measures": [
    {
      "metric": "new_major_violations"
    },
    {
      "metric": "new_minor_violations"
    },
    {
      "metric": "new_critical_violations"
    },
    {
      "metric": "new_blocker_violations"
    }
  ]
}

The periods property and its contents are missing from the MCP response.

Expected behavior

The MCP tool should preserve the New Code period data, or normalize it into a usable value. For example:

{
  "measures": [
    {
      "metric": "new_major_violations",
      "value": "2",
      "period": 1,
      "bestValue": false
    },
    {
      "metric": "new_minor_violations",
      "value": "0",
      "period": 1,
      "bestValue": true
    },
    {
      "metric": "new_critical_violations",
      "value": "0",
      "period": 1,
      "bestValue": true
    },
    {
      "metric": "new_blocker_violations",
      "value": "0",
      "period": 1,
      "bestValue": true
    }
  ]
}

At minimum, the adapter should read the value from the first New Code period:

measure.periods[index=1].value

It should also continue supporting metrics that use the top-level form:

measure.value

Actual values for this reproduction

new_major_violations:   2
new_minor_violations:   0
new_critical_violations: 0
new_blocker_violations:  0

The SonarQube UI independently confirms that the master branch has 2 New Code issues, both Major severity.

Impact

Consumers of the MCP get_component_measures tool cannot retrieve branch New Code violation counts. This can result in:

  • Missing New Code metrics in generated reports
  • Incorrect quality summaries
  • False conclusions that the project has no New Code data
  • Inability to distinguish branch New Code metrics from PR-specific metrics
  • Incorrect downstream processing when the response contains a metric without a value

Scope

This issue concerns long-lived branch analysis. For branches, SonarQube returns New Code values under measures[].periods[].

PR analysis may use a different response shape and should be tested separately. The fix should avoid assuming that all SonarQube measures have a top-level value.

Suggested validation

Test the MCP tool with:

Project: ...
Branch: master
Metrics:
- new_blocker_violations
- new_critical_violations
- new_major_violations
- new_minor_violations

The result should expose new_major_violations=2 and zero for the other three metrics.