codyswanngt/sonarcloud-access
plugins/lisa-agy/skills/sonarcloud-access/SKILL.md
Vendor-neutral access layer for SonarCloud/SonarQube Cloud. Sonar triage skills MUST delegate through this skill rather than calling Sonar MCP tools or REST directly. Resolves Sonar MCP first when available, then falls back to SONAR_TOKEN + SonarCloud Web API.
$ install --global
skillsauthnpx skillsauth add codyswanngt/lisa sonarcloud-accessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 24, 2026, 3:47 AM119.4s1 file scanned
SKILL.md
- name:
- sonarcloud-access
- description:
- Vendor-neutral access layer for SonarCloud/SonarQube Cloud. Sonar triage skills MUST delegate through this skill rather than calling Sonar MCP tools or REST directly. Resolves Sonar MCP first when available, then falls back to SONAR_TOKEN + SonarCloud Web API.
- allowed-tools:
- ["Bash", "Read", "Skill"]
SonarCloud Access: $ARGUMENTS
Single chokepoint for SonarCloud operations. Caller skills MUST NOT call
mcp__sonarqube__* tools directly or curl https://sonarcloud.io/api/
themselves.
Invocation Contract
operation: gate-status project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: issues project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>] [types:<csv>] [severities:<csv>]
operation: hotspots project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: rule-detail key:<RULE_KEY>
operation: source-snippet component:<COMPONENT_KEY> from:<N> to:<N>
Return parsed JSON in a <result> block.
Substrate Selection
Probe in order:
- Sonar MCP, if available and authenticated.
SONAR_TOKENagainst the SonarCloud Web API.
SonarCloud documents bearer-token authentication for the Web API. Use:
sonar_api() {
local path="$1"
[ -n "$SONAR_TOKEN" ] || {
echo "Error: SONAR_TOKEN is not set." >&2
return 1
}
curl -sS "https://sonarcloud.io/api${path}" \
-H "Authorization: Bearer $SONAR_TOKEN"
}
If a host still requires the legacy token-as-basic-auth form, make that an explicit adapter branch in this skill; consumers do not choose auth style.
If neither tier works, fail with:
Error: no SonarCloud access substrate available. Authenticate the Sonar MCP or set SONAR_TOKEN.
REST Dispatch
| Operation | REST path |
|---|---|
| gate-status | /qualitygates/project_status?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
| issues | /issues/search?componentKeys=<KEY>[&branch=<BRANCH>][&pullRequest=<N>]... |
| hotspots | /hotspots/search?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
| rule-detail | /rules/show?key=<RULE_KEY> |
| source-snippet | /sources/lines?key=<COMPONENT_KEY>&from=<N>&to=<N> |
Invariants
- Fallback is gated on
SONAR_TOKEN. - SonarCloud host access requires
sonarcloud.ioin any custom remote network allowlist. - Consumers ask for analysis data by operation name; this skill owns the Web API path shape.
Related Skills
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026