| name | lisa-sonarcloud-access |
| description | Vendor-neutral access layer for SonarCloud/SonarQube Cloud. Sonar triage skills MUST delegate through this skill rather than calling Sonar MCP tools or REST directly. Resolves Sonar MCP first when available, then falls back to SONAR_TOKEN + SonarCloud Web API. |
| allowed-tools | ["Bash","Read","Skill"] |
SonarCloud Access: $ARGUMENTS
Single chokepoint for SonarCloud operations. Caller skills MUST NOT call
mcp__sonarqube__* tools directly or curl https://sonarcloud.io/api/
themselves.
Invocation Contract
operation: gate-status project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: issues project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>] [types:<csv>] [severities:<csv>]
operation: hotspots project_key:<KEY> [branch:<BRANCH>] [pull_request:<N>]
operation: rule-detail key:<RULE_KEY>
operation: source-snippet component:<COMPONENT_KEY> from:<N> to:<N>
Return parsed JSON in a <result> block.
Substrate Selection
Probe in order:
- Sonar MCP, if available and authenticated.
SONAR_TOKEN against the SonarCloud Web API.
SonarCloud documents bearer-token authentication for the Web API. Use:
sonar_api() {
local path="$1"
[ -n "$SONAR_TOKEN" ] || {
echo "Error: SONAR_TOKEN is not set." >&2
return 1
}
curl -sS "https://sonarcloud.io/api${path}" \
-H "Authorization: Bearer $SONAR_TOKEN"
}
If a host still requires the legacy token-as-basic-auth form, make that an
explicit adapter branch in this skill; consumers do not choose auth style.
If neither tier works, fail with:
Error: no SonarCloud access substrate available. Authenticate the Sonar MCP or set SONAR_TOKEN.
REST Dispatch
| Operation | REST path |
|---|
gate-status | /qualitygates/project_status?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
issues | /issues/search?componentKeys=<KEY>[&branch=<BRANCH>][&pullRequest=<N>]... |
hotspots | /hotspots/search?projectKey=<KEY>[&branch=<BRANCH>][&pullRequest=<N>] |
rule-detail | /rules/show?key=<RULE_KEY> |
source-snippet | /sources/lines?key=<COMPONENT_KEY>&from=<N>&to=<N> |
Invariants
- Fallback is gated on
SONAR_TOKEN.
- SonarCloud host access requires
sonarcloud.io in any custom remote network
allowlist.
- Consumers ask for analysis data by operation name; this skill owns the Web API
path shape.
