The Problem

Developers leak secrets to LLM providers because AI coding agents process code without awareness of what should stay local. SonarQube CLI puts a guard between your editor and the model: it scans diffs for hardcoded credentials before they leave your machine, and gives fast server-side quality feedback without waiting on CI.

What This Does

A TypeScript CLI (561 files) that wraps SonarQube's analysis APIs and provides three surfaces: interactive terminal commands, Git hooks, and AI agent integrations. The agent support spans Claude Code, Copilot CLI, Codex, Cursor, and Antigravity through hook scripts under src/commands/hook/ and integration glue under src/commands/integrate/.

Beyond secret scanning, it handles dependency risk analysis (src/commands/analyze/dependency-risk-helpers/) with SCA scanning, and offers a scriptable JSON interface for querying issues and projects. The docs/llms.txt file provides machine-readable command docs for AI consumption.

How It Is Wired

Execution starts at src/commands/command-tree.ts, which imports 45 modules and serves as the routing hub. From there, commands dispatch to feature areas: analyze, auth, config, hook, import, integrate, and api. The CLI's integration with external systems happens through spawned processes and HTTP calls rather than a single daemon.

The most-connected module is the test harness (tests/integration/harness/index.ts) with 61 dependents — a change there affects nearly every integration test. Three hub modules carry high blast radius: src/commands/analyze/secrets.ts (23 dependents, zero imports), src/commands/hook/hook-dependencies.ts (19 dependents), and src/commands/integrate/_common/hooks.ts (19 dependents). The dependency-risk view-model module participates in an import cycle, meaning changes there ripple through connected code.

The Git hooks (git-pre-commit-secrets.ts, git-pre-push-secrets.ts) read stdin, scan for secrets, and block the commit/push if found. Agent integrations register hooks that run before tool use, filtering what gets sent to LLM providers.

How To Use It

Setup: Install dependencies with bun install (the repo uses bun.lock and bunfig.toml). Build with bun run build.

Configuration: Requires a SonarQube server URL and token. Authenticate with sonar auth login, which stores credentials locally.

Running it:

# Install
bun install

# Scan local changes
sonar analyze --file src/commands/analyze/secrets.ts

# Integrate with Claude Code
sonar integrate claude -g

# Add Git hook
sonar hook install

Real-World Use

A team using Claude Code for a Node.js service can install the CLI once, run sonar integrate claude -g, and every Claude session automatically scans code before processing. The git-pre-commit-secrets.ts hook catches a developer's hardcoded AWS key before it reaches the commit, and sonar analyze surfaces quality issues on changed lines without a CI round-trip.

Code Health & Issues

Static analysis found 91 issues: 34 high, 56 medium, 1 low. Key findings:

  • High - Import cycle members (29) — src/commands/analyze/dependency-risk-helpers/view-model/index.ts and src/core/framework/features/types.ts participate in circular imports. Extract shared types to break the cycle.
  • High - Hub modules (14) — tests/integration/harness/index.ts has 61 dependents; changes there break integration tests broadly.
  • High - Duplicated code blocks — 992 repeated 6-line blocks across 545 files, concentrated in build-scripts/ and .github/scripts/.
  • High - Oversized files (6) — src/core/server/client.ts at 787 lines and the fake SonarQube server test harness are hard to modify safely.
  • Med - High branching density (9) — src/commands/analyze/sqaa-errors.ts has 33 branch points over 115 lines.

SDLC observations from the file structure: CI exists via GitHub Actions, but build.yml discards step exit codes at line 194, so a failed build can report green. No dependency vulnerability scan gates pull requests. Twenty generated files are committed under src/, risking stale bundles. Workflow jobs lack timeout-minutes, so a wedged step runs to the six-hour platform default.

The Bottom Line

A practical tool for teams using AI coding agents who need secret scanning and fast quality feedback. The agent integrations are the differentiator; the codebase carries real maintenance debt in its hub modules and duplicated logic, but the core value — keeping secrets out of LLM context — is sound. Use it if you run Claude Code or Copilot CLI and want server-side analysis without CI latency.