# sonar-dependency-risks

> Claude/Codex skill by [@sonarsource](https://omgskills.com/library/sonarsource/index.md) · 113 stars · Updated 2026-10-22

Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)

Tags: agent, ai, sonarqube

## Install

```sh
git clone https://github.com/SonarSource/sonarqube-agent-plugins /tmp/sonarqube-agent-plugins && ln -s /tmp/sonarqube-agent-plugins/skills/sonar-dependency-risks ~/.claude/skills/sonar-dependency-risks
```

## From README

SonarQube — Dependency Risks Search for dependency risks (software composition analysis issues) in a SonarQube project, paired with the releases that appear in the analysed project, application, or portfolio. Prerequisites This skill requires SonarQube Advanced Security (available on SonarQube Cloud Enterprise plan, or SonarQube Server 2025.4 Enterprise edition or higher), the SonarQube MCP Server to be configured, and the tool mcpsonarqubesearchdependencyrisks to be available in your session. Before proceeding, verify the tool is accessible. If it is not, try the CLI fallback in Step 3 before giving up — don't invent other CLI commands (e.g. sonar mcp call or sonar dependency-risks do not exist). If the CLI fallback also fails or doesn't apply, narrow down the cause — check whether the sonarqube MCP server is enabled in this agent's configuration.

## Links

- HTML page: https://omgskills.com/library/sonarsource/sonarqube-agent-plugins/skills/sonar-dependency-risks/
- GitHub: https://github.com/SonarSource/sonarqube-agent-plugins
- Author: [@sonarsource](https://omgskills.com/library/sonarsource/index.md)

## More from this repo

- [sonar-analyze](https://omgskills.com/library/sonarsource/sonarqube-agent-plugins/skills/sonar-analyze/index.md) — Used to analyze a file for quality and security issues using SonarQube
   - [@sonarsource](https://omgskills.com/library/sonarsource/index.md) · 113 stars
- [sonar-coverage](https://omgskills.com/library/sonarsource/sonarqube-agent-plugins/skills/sonar-coverage/index.md) — Used to find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when...
   - [@sonarsource](https://omgskills.com/library/sonarsource/index.md) · 113 stars
- [sonar-duplication](https://omgskills.com/library/sonarsource/sonarqube-agent-plugins/skills/sonar-duplication/index.md) — Used to find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key...
   - [@sonarsource](https://omgskills.com/library/sonarsource/index.md) · 113 stars