mcp-sonar-analysis: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What this project is

A local, server-free MCP server + CLI that brings Sonar-grade static analysis (BUG, VULNERABILITY, CODE_SMELL, SECURITY_HOTSPOT) to TypeScript/TSX and C# repos. TS/TSX is analyzed via ESLint + eslint-plugin-sonarjs; C# via dotnet build + SonarAnalyzer.CSharp SARIF output. Results are cached in a per-repo SQLite database. No SonarQube server, no Docker.

Commands

npm run build   # tsc -p tsconfig.json && copy src/dashboard/public -> dist/dashboard/public
npm run lint    # eslint . --ext .ts
npm test        # node --import tsx --test test/**/*.test.ts

• Run a single test file: node --import tsx --test test/core.test.ts
• test/cli.test.ts and parts of test/dashboard.test.ts spawn dist/cli.js as a subprocess — run npm run build before running those tests or they'll exercise stale compiled output.
• Tests that touch the global registry set MCP_SONAR_DASHBOARD_HOME to a temp dir (via registry.ts's homeDirOverride/env var) so they never write to the real ~/.mcp-sonar-analysis/registry.json.
• C# analysis tests are skipped gracefully if dotnet isn't on PATH (same S3 degradation as production code).

Architecture

Entry points

• src/cli.ts — Commander-based CLI. Subcommands: register-repo, analyse-repo, get-file-analysis, analyse-file, serve (MCP stdio), dashboard. A repo can be referenced by numeric ID or by path — parseRepoIdOrPath treats all-digit args as repoId, everything else as a path.
• src/mcp/server.ts — MCP stdio server exposing 4 tools (register_repo, analyse_repo, get_file_analysis, analyse_file) with Zod input schemas. Each tool is a thin wrapper that calls the corresponding src/core/* function and JSON-stringifies the result; errors are returned as { error: message } with isError: true, never thrown across the MCP boundary.