Skip to main content
Create a User token under My Account → Security on the intended SonarQube instance. Prefer a dedicated service user with only the project read permissions needed for the review; an analysis token is not a substitute for all Web API reads. Open Connectors → Connect → SonarQube as an Administrator. Enter a label, the instance URL and the user token. Nuphos validates it against that instance and stores it encrypted. This connector does not upload source code for analysis.

​
Use and verify

Select the binding and ask for one project’s latest completed analysis and Quality Gate. The agent can inspect code issues, vulnerability findings, Security Hotspots and measures through the server-side proxy. Check the analysis date and branch before treating a finding as a statement about the current code.

​
Troubleshooting and removal

If an instance is unreachable, check URL reachability and the connection’s URL restrictions. If a project is missing, check the service user’s project access. Do not broaden the token to administrator just to bypass a missing read grant. Remove the connection and revoke the token when ending access. See SonarQube token management.