mcpField
S
sonar-fix-issue

sonar-fix-issue

github.com/sonarsourceTesting & quality11444 installsUpdated today
Repository

About sonar-fix-issue

A skill that guides coding agents through resolving SonarQube code-quality or security findings with minimal, behavior-preserving edits. It can use rule details from SonarQube before changing code.

Key features

  1. 01Parse rule, file, and line inputs
  2. 02Look up SonarQube rule guidance
  3. 03Read full file context
  4. 04Apply minimal behavior-preserving fixes
  5. 05Explain the change and suggest checks

Use cases

  1. 01Fix a finding identified by rule key
  2. 02Address a finding in a specified file
  3. 03Resolve an issue described in plain language

MCP support

When available, it calls the SonarQube MCP tool `mcp__sonarqube__show_rule` to retrieve rule guidance.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sonarsource/sonarqube-agent-plugins --skill sonar-fix-issue

After installing, type/sonar-fix-issuein Claude Code to confirm it loaded.

Details

From the project README

SonarQube — Fix Issue

Fix a code quality or security issue identified by SonarQube.

Usage

sonar-fix-issue java:S1481 src/main/java/MyClass.java:42
sonar-fix-issue python:S2077 src/auth/login.py
sonar-fix-issue Remove unused variable in MyClass.java

Instructions

Step 1: Identify the issue

Parse the user-provided arguments for:

  • A rule key (e.g. java:S1481, python:S2077)
  • A file path and optional line number (e.g. src/auth/login.py:34)
  • Or a plain-language description if no rule key is given

If neither a rule key nor a file path can be determined, ask: "Which rule and file should I fix?"

Step 2: Look up the rule (if a key was given)

Call mcp__sonarqube__show_rule with the rule key to retrieve the full rule description, rationale, and remediation guidance before touching any code. Do not add extra parameters (such as projectKey) unless the tool schema requires them — after integration, rule lookup usually needs only the rule key.

If the MCP tool is unavailable, fall back to sonar api get "/api/rules/show?key=<rule-key>". If sonar is also unavailable or unauthenticated, rely on built-in knowledge of SonarQube rules.

Step 3: Read the file

Read the full file content. If a line number was given, focus analysis around that line but read the whole file to understand context.

Step 4: Apply the fix
  • Make the minimal change that resolves the rule violation
  • Do not refactor surrounding code or fix unrelated issues
  • Preserve existing behaviour — the fix must not change what the code does
Step 5: Explain the change

After editing, briefly explain:

  • What the violation was
  • Why the rule flags it
  • What was changed and why it resolves the issue
Step 6: Suggest next steps
  • "Invoke the sonar-analyze skill with <file> to confirm no new issues were introduced."
  • "Invoke the sonar-list-issues skill with the project key (or sonar.projectKey in sonar-project.properties) — the CLI always uses -p."

Comments

Markdown supported