TL;DR
Code Quality Gates is a testing workflow that chains GitHub + SonarQube to automate a common task. SonarQube analyzes every PR for code smells, coverage drops, and security hotspots. PRs below the quality gate are blocked. Once configured, it runs through Claude Code, Cursor, Windsurf or any MCP-compatible AI agent.
Code Quality Gates
SonarQube analyzes every PR for code smells, coverage drops, and security hotspots. PRs below the quality gate are blocked.
How it works
Partial support — 1 of 2 MCPs hostable
Hosted execution needs every MCP on the whitelist. Use the local CLI for this recipe until the missing MCPs are added.
Not yet hostable:
mcpizy recipe install github-sonarqube-code-qualityWhy this combo?
SonarQube has deep static analysis rules built over years; GitHub provides the code diff and the merge gate. Together they enforce quality standards automatically — no manual code review step needed for coverage, duplication, or common security patterns.
Without this workflow
Code review relies on human reviewers catching coverage drops, duplicate code, and security issues — which they miss when the PR is large.
With MCPizy
Every PR is automatically scanned. Quality gate fails block merge. SonarQube comments inline on the exact offending lines.
Business value
Concrete ROI — not marketing fluff.
Time saved
- Frees senior engineers from nitpicking PRs — they focus on architecture instead of coverage numbers
- Objective quality metrics replace subjective 'LGTM' reviews — engineering culture becomes merit-based
Workflow steps
- 1PR opened — trigger SonarQube scan
- 2Analyze new code for smells and duplication
- 3Check coverage didn't drop below threshold
- 4Scan for security hotspots (OWASP)
- 5Report quality gate pass/fail on PR
Use cases
- Enforce minimum test coverage on new code, block PRs that drop it
- Catch OWASP Top 10 security patterns before they reach main
- Prevent code duplication from accumulating across the codebase
- Inline PR comments on exactly which lines have quality issues
Agent prompt (copy into Claude Code)
This prompt is the workflow. Paste into Claude Code, Cursor, or Windsurf.
You are a code-quality gate agent. Runs on every PR. On pull_request opened / synchronize: 1. Call github.get_pull_request(pr_number) to get head SHA + changed files 2. Call sonarqube.scan(project_key, branch=head_branch, sources=changed_files) 3. Poll sonarqube.get_analysis_status until DONE 4. Call sonarqube.get_quality_gate_status(project_key) — read conditions (coverage, duplications, vulnerabilities, bugs) 5. For each failing condition, call github.create_review_comment on the offending line with the SonarQube issue text 6. Call github.create_status(context="sonarqube", state=gate_status === "OK" ? "success" : "failure") Post a summary comment: "Quality Gate: <status> — coverage <n>%, <n> vulnerabilities, <n> code smells".
Trigger & credentials
How this workflow fires and what env vars you need.
POST /webhook/github (events: pull_request opened, synchronize)
One-command deploy
Install everything — MCPs, prompt, env template — in a single call.
$ mcpizy recipe install github-sonarqube-code-quality ✓ Installs all 2 MCP servers ✓ Writes prompt to ~/.mcpizy/prompts/github-sonarqube-code-quality.md ✓ Generates .env.example in current directory ✓ Ready to paste into Claude Code
Requires mcpizy CLI v1.1+ — install via npm i -g mcpizy.
Quick install (MCPs only)
$ mcpizy install github && mcpizy install sonarqubeMore Testing recipes
Visual Regression on PRs
Playwright captures screenshots of key pages on every PR and diffs them against the baseline. Regressions block merge.
Full CI Pipeline with Slack Alerts
Tests run on every push. Failures post a Slack message with the failing test name, screenshot, and a link to the run.
Cross-Browser Testing on PRs
Run your test suite across Chrome, Firefox, Safari, and Edge on BrowserStack automatically when a PR is opened.
Frequently asked questions
What is this workflow?
Code Quality Gates is a testing automation that uses GitHub + SonarQube together via the Model Context Protocol. SonarQube analyzes every PR for code smells, coverage drops, and security hotspots. PRs below the quality gate are blocked.
How long does setup take?
Setup takes around 20 min setup, quality gates on every PR. You install the required MCP servers with `mcpizy install github && mcpizy install sonarqube`, connect your accounts, and the workflow is ready to run.
What does this workflow change in practice?
Frees senior engineers from nitpicking PRs — they focus on architecture instead of coverage numbers; Objective quality metrics replace subjective 'LGTM' reviews — engineering culture becomes merit-based.
Which MCP servers do I need for this?
You need 2 MCP servers: GitHub (mcpizy install github), SonarQube (mcpizy install sonarqube). All are installable in one command via the MCPizy CLI and configured in your `.claude.json` or `.cursor/mcp.json`.
Does this work with Claude Code, Cursor, and Windsurf?
Yes. The workflow runs with any MCP-compatible AI agent — Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with Copilot, and custom agents built on the MCP SDK. The MCP servers are identical across clients; only the config file path (`.claude.json` vs `.cursor/mcp.json`) changes.
Start building this workflow
Install the required MCPs from the directory and automate this in 20 min setup.
$ mcpizy install github && mcpizy install sonarqube
Free to install. Connect your accounts and this workflow runs itself.