Skip to main content

Quick Start

Get your first code quality analysis in under 5 minutes.

Your First Scan​

Step 1: Open Your Project​

Navigate to your project directory and start your AI assistant:

cd /path/to/your/project
claude

Step 2: Run Auto-Setup Scan​

For your first scan of a new project, use autoSetup: true:

Scan this project with Bob the Fixer, use autoSetup: true since this is the first scan

Bob the Fixer will automatically:

  1. Discover your project type, languages, and frameworks
  2. Create a SonarQube project with an appropriate quality gate
  3. Generate a project token
  4. Run the analysis
  5. Return a summary of all issues found

Step 3: Review the Results​

After scanning, you'll see a comprehensive report:

📊 SonarQube Analysis Complete
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Project: my-awesome-app
Quality Gate: ❌ FAILED

📈 Summary:
  Total Issues: 47

  🔴 BLOCKER:   2 (security vulnerabilities)
  🟠 CRITICAL:  5 (critical bugs)
  🟡 MAJOR:    15 (significant code smells)
  đŸŸĸ MINOR:    20 (minor improvements)
  ℹī¸  INFO:      5 (suggestions)

📊 Metrics:
  Coverage:     67.3%
  Duplication:   4.2%
  Tech Debt:    3d 4h

💡 Recommendation: Start with BLOCKER and CRITICAL issues

Fixing Issues​

Get Issue Details​

Ask for details on specific issues:

Show me the details of the BLOCKER issues

Bob the Fixer provides:

  • Issue description and severity
  • File path and line number
  • Code context (lines around the issue)
  • Rule explanation from SonarQube
  • Compliant vs non-compliant code examples
  • Suggested fix approach

Example response:

🔴 BLOCKER: SQL Injection Vulnerability
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Issue Key: AYx123abc456
File: src/db/users.ts:45
Rule: typescript:S3649

📍 Affected Code:
──────────────────────────────────────
  43 │ async function getUser(id: string) {
  44 │   const query = `SELECT * FROM users
> 45 │     WHERE id = '${id}'`;  // ❌ Vulnerable
  46 │   return db.execute(query);
  47 │ }
──────────────────────────────────────

📖 Rule Explanation:
User-provided data should never be directly
concatenated into SQL queries. This allows
attackers to inject malicious SQL commands.

✅ Compliant Example:
  const query = 'SELECT * FROM users WHERE id = ?';
  return db.execute(query, [id]);

🔧 Suggested Fix:
Use parameterized queries instead of string
interpolation. Replace template literal with
placeholder and pass id as parameter.

Apply the Fix​

Ask your AI assistant to fix the issue:

Fix this SQL injection vulnerability using parameterized queries

The AI will:

  1. Read the affected file
  2. Apply the suggested fix
  3. Show you the changes made

Verify the Fix​

Run another scan to confirm (use autoSetup: false for subsequent scans):

Scan again with autoSetup: false to verify the fix

Common Workflows​

Focus on Security Issues​

Show me all security vulnerabilities and hotspots in this project

Uses: sonar_scan_project with typeFilter: ["VULNERABILITY"] + sonar_get_security_hotspots

Analyze Technical Debt​

What's the technical debt situation? Show me the breakdown and time estimates

Uses: sonar_get_technical_debt with budget analysis

Find Code Duplication​

Which files have the most duplicated code? Show me the top 10

Uses: sonar_get_duplication_summary sorted by lines

Check Quality Gate​

Did we pass the quality gate? What failed?

Uses: sonar_get_quality_gate for status and conditions

Analyze Issue Patterns​

Group all issues by fixability and show me what I can auto-fix

Uses: sonar_analyze_patterns with groupBy: "fixability"

Generate Quality Report​

Generate a detailed quality report for this project

Uses: sonar_generate_report with format: "detailed"

Tool Usage Patterns​

First Scan vs Subsequent Scans​

ScenarioCommand
First scan of new projectautoSetup: true
Re-scan after fixesautoSetup: false, projectPath: "/full/path"
Scan specific severitiesAdd severityFilter: ["BLOCKER", "CRITICAL"]
Scan specific typesAdd typeFilter: ["BUG", "VULNERABILITY"]

Issue Investigation Flow​

Severity Priority​

Fix issues in this order:

  1. BLOCKER - Security vulnerabilities, critical bugs
  2. CRITICAL - High-impact bugs
  3. MAJOR - Code smells affecting maintainability
  4. MINOR - Style issues, minor improvements
  5. INFO - Suggestions and best practices

Example: Complete Workflow​

Here's a complete session fixing multiple issues:

User: Scan my TypeScript project for the first time

AI: I'll run the first scan with auto-setup enabled.
    [Uses sonar_scan_project with autoSetup: true]

    Found 23 issues: 1 BLOCKER, 3 CRITICAL, 12 MAJOR, 7 MINOR.

    The BLOCKER is a SQL injection in src/api/users.ts:67.
    Would you like me to show the details?

User: Yes, show the blocker details

AI: [Uses sonar_get_issue_details]

    The issue is unsafe string concatenation in a database query.
    Here's the code context and suggested fix...

    Shall I fix this now?

User: Yes, fix it

AI: [Edits src/api/users.ts to use parameterized queries]

    Fixed! Changed from template literal to parameterized query.
    Would you like me to re-scan to verify?

User: Yes, scan again

AI: [Uses sonar_scan_project with autoSetup: false]

    ✅ BLOCKER resolved!
    Remaining: 3 CRITICAL, 12 MAJOR, 7 MINOR.

    Want me to tackle the CRITICAL issues next?

Troubleshooting First Scan​

"No project configuration found"​

Run project discovery first:

Analyze this project structure and recommend configuration

Uses: sonar_project_discovery with deep: true

"Source files not found"​

Generate a custom config:

Generate a sonar-project.properties file for this project with sources in src/

Uses: sonar_generate_config

"Authentication failed"​

Check your token:

Diagnose the SonarQube connection and permissions

Uses: sonar_diagnose_permissions

Next Steps​