Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mushroomTW/MushroomTW-Skills --skill local-sonarqube-setupgit clone --depth 1 https://github.com/mushroomTW/MushroomTW-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/local-sonarqube-setup)<a href="https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/local-sonarqube-setup"><img src="https://agentmods.dev/badge/skills/mushroomtw/mushroomtw-skills/local-sonarqube-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/local-sonarqube-setup"><img src="https://agentmods.dev/badge/skills/mushroomtw/mushroomtw-skills/local-sonarqube-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01993 |
| Opus 5.5 | $0.00033 | $0.00797 |
| Sonnet 5.5 | $0.00017 | $0.00399 |
| Haiku 4.5 | $0.00008 | $0.00199 |
Grade A, and why
local-sonarqube-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Local SonarQube Setup
Local Docker at
127.0.0.1:9000· PowerShell on Windows ·SONAR_TOKENenv only · no scanner install.
TL;DR routing
pom.xml / build.gradle[.kts] exists? → use mvn/gradle plugin, not CLI
*.csproj / .sln? → .NET scanner required; it does not read SONAR_TOKEN → credential STOP
NPM / Python / Other? → sonar-scanner CLI (or Docker fallback)
shallow clone? → git fetch --unshallow before scan
Java <21 and auto-provisioning OFF? → upgrade or enable auto
Invariants
- Token only in process memory — never in args/URL/log/file; describe it only as set or not set; if it leaks, tell the user to revoke it. Read it once and run every step in the same process; no
setx; remove it from the process only after step 7 has finished. - Never fake Gate with
Accepted/False positive/disabling rules/server-side threshold edits; never change production code/build semantics to pass. - Do not add services, modify CI/compose, commit or push unless explicitly asked; preserve uncommitted changes; do not overwrite unrelated files.
- Output only non-sensitive summaries (status, key, CE, Gate, URL), never full logs; query issues/measures only on failure or request.
- Discover language/build/coverage from repo, not defaults; Community Build loads only supported languages.
Workflow — 4 phases, 7 steps
| Phase | Step | Action | Output | 🛑 Checkpoint |
|---|---|---|---|---|
| A · Preflight | 1 Discovery | Read AGENTS.md/README/build docs/sonar config; git status --short; derive language/sources/tests/reports. Shallow=true→git fetch --unshallow. Not git→note no rollback. |
Evidence table (path→source) | — |
| 2 Service+Scanner+Java | GET /api/system/status=UP; sonar-scanner --version; java -version 21+ (or 11+ if auto-provisioning ON — CLI 6.0+ default). Scanner per table: Maven mvn verify sonar:sonar · Gradle gradle sonar · .NET requires dotnet sonarscanner, which does not read SONAR_TOKEN (its SONARQUBE_SCANNER_PARAMS JSON variable is an untested env-only path; see reference/commands.md §2) · Other CLI. Docker CLI permission fail ≠ blocker. |
UP + version + chosen scanner |
🔴 Confirm scanner and Java with the user when the repo mixes toolchains; 🔴 .NET credential STOP | |
| B · Setup | 3 Project | Key order: sonar.projectKey → .sonarlint/connectedMode.json → git remote → dir name; sanitize [A-Za-z0-9-_.:] not all digits; monorepo ambiguity→ask. Look it up with the SonarQube MCP project search when the host has one, otherwise GET /api/projects/search (reference/commands.md §4); host mismatch→stop. Reuse or POST /api/projects/create. |
key / name / dashboard URL |
🔴 Key/name before create (this skill never deletes a project) |
| 4 Config | Minimal merge into sonar-project.properties (create only if none). Exclude only confirmed artifacts, never whole src/tests. Hierarchy Global < Project < file < CLI (file/CLI not persisted; Global Exclusions cannot override). sonar.projectBaseDir/project.settings in reference/commands.md §5. |
Diff shown | 🔴 Diff before write | |
| C · Execute | 5 Reports | Run repo checks/tests first (report failures). Then native coverage before scanner; format per reference/coverage.md (JaCoCo jacoco.xml→sonar.coverage.jacoco.xmlReportPaths, JS lcov.info→sonar.javascript.lcov.reportPaths, Python coverage.xml→sonar.python.coverage.reportPaths, .NET Coverlet/dotCover→sonar.cs.*, Generic→sonar.coverageReportPaths). Verify non-empty. None→state none. |
path (bytes, format) list |
— |
| 6 Scan | Same process: SONAR_HOST_URL + SONAR_TOKEN → run chosen scanner. Need EXECUTION SUCCESS + exit 0 + key/URL match. Docker fallback: sonar-scanner-cli (runs as user 1000, which needs RW on every mount) with the named volume -v sonar-cache:/opt/sonar-scanner/.sonar/cache and host.docker.internal as the host (Linux also needs --add-host=host.docker.internal:host-gateway); see reference/commands.md §8. OOM→SONAR_SCANNER_JAVA_OPTS="-Xmx512m" (pre-6.0 SONAR_SCANNER_OPTS). |
3-line summary | — | |
| D · Verify | 7 CE+Gate+Wrap | CE: parse .scannerwork/report-task.txt → poll GET /api/ce/task?id= to SUCCESS/FAILED (5m; timeout→report taskId+status). Gate: the SonarQube MCP Quality Gate tool when the host has one, otherwise GET /api/qualitygates/project_status (reference/commands.md §7); ERROR→list name: actual vs threshold, hand back. Wrap: add .scannerwork//coverage to ignore, git diff --check+git status --short, report key/Gate/imported types/URL. Debug: sonar.scanner.internal.dumpToFile or Background Tasks > Show SonarScanner Context. |
CE / Gate / URL |
— |
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed d98dd8dc69b7
- 2mo ago First seen · 73 lines · 83 tokens per session scan A bf981ec8e926
local-sonarqube-setup is a skill published in the GitHub repository mushroomTW/MushroomTW-Skills (0 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 1,993 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
local-sonarqube-setup compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| local-sonarqube-setupmushroomTW/MushroomTW-Skills | Skill | 0 | today | MIT | A | 83 | Codex |
| ai-development-guideshinpr/claude-code-workflows | Skill | 712 | 2d ago | MIT | A | 44 | Claude Code |
| dorodangoathola/claude-night-market | Skill | 348 | yesterday | MIT | A | 31 | Claude Code |
| ring:searching-codeLerianStudio/ring | Skill | 218 | 7d ago | Apache-2.0 | A | 74 | Claude Code, Cursor |
| ring:using-assertLerianStudio/ring | Skill | 218 | 7d ago | Apache-2.0 | A | 99 | Cursor |
| ring:fixing-lintLerianStudio/ring | Skill | 218 | 7d ago | Apache-2.0 | A | 96 | Cursor |
| ring:test-driven-developmentLerianStudio/ring | Skill | 218 | 7d ago | Apache-2.0 | A | 89 | Cursor |