codyswanngt/sonarcloud-access
plugins/src/base/skills/sonarcloud-access/SKILL.md
Vendor-neutral access layer for SonarCloud/SonarQube Cloud. Sonar triage skills MUST delegate through this skill rather than calling Sonar MCP tools or REST directly. Resolves Sonar MCP first when available, then falls back to SONAR_TOKEN + SonarCloud Web API.
$ install --global
skillsauthnpx skillsauth add codyswanngt/lisa sonarcloud-accessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security scan pending...
This skill is queued for security scanning. Results will appear when the scan completes.
SKILL.md
- name:
- sonarcloud-access
- description:
- Vendor-neutral access layer for SonarCloud/SonarQube Cloud. Sonar triage skills MUST delegate through this skill rather than calling Sonar MCP tools or REST directly. Resolves Sonar MCP first when available, then falls back to SONAR_TOKEN + SonarCloud Web API.
- allowed-tools:
- ["Bash", "Read", "Skill"]
SonarCloud Access: $ARGUMENTS
Single chokepoint for SonarCloud operations. Caller skills MUST NOT call
mcp__sonarqube__* tools directly or curl https://sonarcloud.io/api/
themselves.
Invocation Contract
operation: gate-status project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: issues project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>] [types:<csv>] [severities:<csv>]
operation: hotspots project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: rule-detail key:<RULE_KEY>
operation: source-snippet component:<COMPONENT_KEY> from:<N> to:<N>
Return parsed JSON in a <result> block.
Substrate Selection
Probe in order:
- Sonar MCP, if available and authenticated.
SONAR_TOKENagainst the SonarCloud Web API.
SonarCloud documents bearer-token authentication for the Web API. Use:
sonar_api() {
local path="$1"
[ -n "$SONAR_TOKEN" ] || {
echo "Error: SONAR_TOKEN is not set." >&2
return 1
}
curl -sS "https://sonarcloud.io/api${path}" \
-H "Authorization: Bearer $SONAR_TOKEN"
}
If a host still requires the legacy token-as-basic-auth form, make that an explicit adapter branch in this skill; consumers do not choose auth style.
If neither tier works, fail with:
Error: no SonarCloud access substrate available. Authenticate the Sonar MCP or set SONAR_TOKEN.
REST Dispatch
| Operation | REST path |
|---|---|
| gate-status | /qualitygates/project_status?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
| issues | /issues/search?componentKeys=<KEY>[&branch=<BRANCH>][&pullRequest=<N>]... |
| hotspots | /hotspots/search?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
| rule-detail | /rules/show?key=<RULE_KEY> |
| source-snippet | /sources/lines?key=<COMPONENT_KEY>&from=<N>&to=<N> |
Invariants
- Fallback is gated on
SONAR_TOKEN. - SonarCloud host access requires
sonarcloud.ioin any custom remote network allowlist. - Consumers ask for analysis data by operation name; this skill owns the Web API path shape.
Related Skills
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026
codyswanngt/lisa-setup-sonar
tools
VerifiedTrustedCommunity
Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged.
1SKILL.mdUpdated Jul 24, 2026