How to build SonarQube dashboards in Metabase

SonarQube is a code quality and code security platform that scans repositories for bugs, vulnerabilities, security hotspots, and code smells, and gates releases on quality standards. Metabase is where you turn those security signals into shared, trustworthy dashboards. This guide covers two complementary paths: a lightweight MCP + CLI route that pulls live data with the SonarQube MCP Server and loads a CSV into Metabase with the Metabase CLI, and a durable pipeline route that syncs SonarQube findings into a database so you can build dashboards anyone can read.

How do you connect SonarQube to Metabase?

Most teams combine both routes: use MCP and CLI uploads for a fast first pass, then move recurring security reporting to a warehouse-backed model.

What can you analyze from SonarQube data in Metabase?

• Quality gate pass rate by project — built from issues (findings) and the related security hotspots, projects, quality gates data your sync exposes.
• New vs. resolved findings — built from issues (findings) and the related security hotspots, projects, quality gates data your sync exposes.
• Security hotspot review backlog — built from issues (findings) and the related security hotspots, projects, quality gates data your sync exposes.
• Technical debt and coverage trend — built from issues (findings) and the related security hotspots, projects, quality gates data your sync exposes.
• Findings by rule and severity — built from issues (findings) and the related security hotspots, projects, quality gates data your sync exposes.

Which SonarQube dashboards should you build in Metabase?

How do you use the SonarQube MCP Server with the Metabase CLI?

Pair the SonarQube MCP Server with the Metabase CLI for fast, hands-on analysis. MCP is useful for scoped lookups and summarized exports; the Metabase CLI's upload command loads CSV data into Metabase and creates a ready-to-query table and model.

Example workflow

• Ask the MCP server for the open critical and high issues (findings) with severity, status, and first-seen dates.
• Export the result as CSV, keeping stable IDs, severities, statuses, owners, and timestamps.
• Run mb upload csv to load it into Metabase as a table and model, then build questions and dashboards on top.

Be honest about the limits

• MCP lookups are excellent for exploration, not scheduled reporting.
• A CSV upload is a snapshot; refresh it with mb upload replace or move to the pipeline for real history.
• First-seen and resolved timestamps are required for remediation-time and SLA metrics; daily snapshots are required for open-findings trends.
• mb upload csv needs an uploads database configured under Admin → Settings → Uploads.

How do you set up SonarQube MCP and the Metabase CLI?

{
  "mcpServers": {
    "sonarqube": {
      "url": "https://api.sonarcloud.io/mcp",
      "headers": {
        "Authorization": "Bearer <SONARQUBE_CLOUD_TOKEN>",
        "SONARQUBE_ORG": "your-organization-key"
      }
    }
  }
}

Self-hosted? Run the Docker image (mcp/sonarqube) over stdio, and SonarQube Server 2026.3+ ships an embedded /mcp endpoint. The hosted server exposes a smaller fixed toolset than self-hosted. Works on the free tier.

# Install the Metabase CLI
npm install -g @metabase/cli

# Log in (opens your browser; requires Metabase v62+)
mb auth login --url https://your-metabase.example.com

# Load a issues-(findings) export — creates a table AND a model
mb upload csv --file sonarqube-issues-(findings).csv --collection root

# Refresh that same table later from a new export
mb upload replace <table-id> --file sonarqube-issues-(findings).csv

Can you generate a SonarQube dashboard with AI?

Yes. Use the prompt below with any assistant that can run the SonarQube MCP Server and the Metabase CLI. It works end to end: if SonarQube tables already exist in Metabase it analyzes those; otherwise it pulls scoped, summarized data over MCP, loads it with mb upload csv, then builds the dashboard and caveats any metric that needs missing history.

Create a polished Metabase dashboard for SonarQube vulnerability management analytics.
Work end to end: get the data into Metabase if it isn't there yet, then build.

Goal: Help security and engineering leaders understand open exposure, remediation velocity, SLA compliance, and the riskiest assets from SonarQube data.

Step 1 — Find or load the data:
- First, check what already exists in Metabase (search for sonarqube tables and
  models). If durable SonarQube data is already present — synced from a warehouse
  or uploaded earlier — use it and skip to Step 2.
- If nothing is there, pull a scoped, summarized export with the SonarQube MCP Server:
  issues (findings), plus security hotspots, projects, quality gates.
  Prefer aggregated or entity-grain views over raw events. Write each result to a
  CSV, then load it with the Metabase CLI — run "mb upload csv --file <export>.csv"
  so each upload creates a table and a ready-to-query model. Use "mb upload replace
  <table-id> --file <export>.csv" to refresh an existing table instead of creating
  duplicates.

Step 2 — Inspect before querying:
Do not assume exact table or column names. Inspect available fields, severities,
statuses, timestamps, and whether snapshots or history exist before creating
duration or trend cards.

Important:
- Build on whatever data is present; don't claim Metabase connects natively to
  SonarQube — it reads a database or CLI-uploaded tables.
- Never try to load raw security telemetry or event firehoses into Metabase; use
  findings, detections, entities, and daily rollups.
- Only compute durations (time to remediate, time to triage, time to detect)
  when the required timestamps exist.
- Exclude test environments and suppressed or accepted-risk items from headline
  cards, and keep them visible in a labeled register instead.
- A single CSV is a point-in-time snapshot: only build trend cards if there is a
  usable date column or multiple periods have been uploaded.

Dashboard title: SonarQube Vulnerability Management Overview

Sections:
1. Executive summary: Open criticals; New findings last 30 days; Remediated last
   30 days; SLA compliance; Median time to remediate.
2. Exposure: Open findings by severity and asset group; aging buckets.
3. Remediation: New vs. remediated by week; median remediation days by severity.
4. SLA: Compliance by severity; findings past due with owner.
5. Ownership: Open findings by team; oldest criticals; accepted-risk register.

Filters: Date range, Severity, Status, Team or owner, Environment or asset group.

Output: Build the dashboard if you have permission; otherwise provide the exact
questions, SQL, model definitions, and layout. Include caveats for any metric
that cannot be calculated from the available data.

How do you sync SonarQube data into a database or warehouse?

For dashboards that need history and reliability, land SonarQube findings and metadata in a database first, then connect Metabase to that database.

Connector options

• Managed ETL — use a connector when one covers the objects you need.
• Custom pipeline — use the SonarQube Web API for control over fields, snapshot cadence, and refresh schedule.
• MCP + CSV — use this for quick exploration and one-off slices.

Sync issues, measures, and quality gates with Fivetran's SonarQube connector, the Airbyte community source, or Web API scripts. Snapshot project measures daily so coverage and debt trends survive.

Notes

• Decide the snapshot cadence first (daily is the norm for security data) — posture trends only exist if you build the history.
• Land raw entity tables first, then build clean Metabase models on top.
• Normalize asset, severity (one scale across scanners), status, first-seen, resolved-at, and source-scanner fields.

How should you model SonarQube data in Metabase?

Core tables

Modeling advice

• Build a clean vulnerability_findings model with common columns across tools, so multi-source dashboards don't fork definitions.
• Separate entity tables (assets, users, controls) from findings, events, and daily snapshot tables.
• Exclude test environments and suppressed or accepted-risk items from headline metrics; keep them in a labeled register instead.
• Use stable IDs for asset, user, and finding joins; display names change.

Which SonarQube metrics should you track in Metabase?

What SQL powers SonarQube dashboards in Metabase?

These assume a cleaned analytical model in a warehouse (PostgreSQL dialect). Adjust table and column names to match your pipeline.

SELECT
  a.asset_group,
  COUNT(*) AS open_critical_findings,
  COUNT(*) FILTER (
    WHERE f.first_seen_at < CURRENT_DATE - INTERVAL '30 days'
  ) AS older_than_30d,
  COUNT(*) FILTER (
    WHERE f.first_seen_at < CURRENT_DATE - INTERVAL '90 days'
  ) AS older_than_90d
FROM vulnerability_findings f
JOIN assets a ON a.id = f.asset_id
WHERE f.status = 'open'
  AND f.severity IN ('critical', 'high')
GROUP BY a.asset_group
ORDER BY open_critical_findings DESC;

SELECT
  date_trunc('month', resolved_at) AS month,
  severity,
  percentile_cont(0.5) WITHIN GROUP (
    ORDER BY EXTRACT(EPOCH FROM (resolved_at - first_seen_at)) / 86400
  ) AS median_days_to_remediate
FROM vulnerability_findings
WHERE resolved_at IS NOT NULL
GROUP BY 1, 2
ORDER BY 1, 2;

SELECT
  severity,
  COUNT(*) AS findings_due,
  COUNT(*) FILTER (
    WHERE resolved_at IS NOT NULL AND resolved_at <= sla_due_at
  ) AS closed_within_sla,
  ROUND(
    100.0 * COUNT(*) FILTER (
      WHERE resolved_at IS NOT NULL AND resolved_at <= sla_due_at
    ) / NULLIF(COUNT(*), 0), 1
  ) AS sla_compliance_pct
FROM vulnerability_findings
WHERE sla_due_at < CURRENT_DATE
GROUP BY severity
ORDER BY severity;

What are common mistakes when analyzing SonarQube in Metabase?

Related

Related analytics

Related dashboards

Related integrations

FAQ