Comparison

Ramparts Security Scanner vs SonarQube MCP Server

Ramparts Security Scanner is an MCP server published by highflame-ai. Marketplaces we read that list it: 1 (Docker MCP Catalog). SonarQube MCP Server is an MCP server published by SonarSource. Marketplaces we read that list it: 2 (Official MCP Registry, Docker MCP Catalog). As of our marketplace pass on 2026-10-19. This pair was picked by a reader, not by our comparison rule, so search engines are asked not to index the page.

Where each is published

Where each is published
Marketplace	Ramparts Security Scanner	SonarQube MCP Server
Docker MCP Catalog	Listed Version: sha256:1ddf4303800e Forks (GitHub): 20 Pulls (Docker Hub): 35 240 Stars (Docker Hub): 0 Stars (GitHub): 98 Not marked · First seen 2026-10-11	Listed Version: sha256:925c88bc7cab Forks (GitHub): 105 Pulls (Docker Hub): 1 543 661 Stars (Docker Hub): 23 Stars (GitHub): 665 Not marked · First seen 2026-10-11
Official MCP Registry	Not listed	Listed Version: 1.21.0 Forks (GitHub): 105 Stars (GitHub): 665 Not marked · First seen 2026-10-11

Each figure is the marketplace's own and is never added up across marketplaces. A marketplace that publishes no figure shows none: no number is not zero.

The facts side by side

Ramparts Security Scanner vs SonarQube MCP Server
Fact	Ramparts Security Scanner	SonarQube MCP Server
Marketplaces that list it (differs)	1 (worse)	2 (better)
Stars (GitHub) (differs)	98 (worse)	665 (better)
Pulls (Docker Hub) (differs)	35 240 (worse)	1 543 661 (better)
Forks (GitHub) (differs)	20 (worse)	105 (better)
Last release	Not published	Not published
Where it runs (differs)	On your machine (mcp/ramparts)	On your machine (docker.io/sonarsource/sonarqube-mcp)
Transport	stdio	stdio
Tools it declares (differs)	2	25
Environment variables it asks for (differs)	1, secrets among them: 0	3, secrets among them: 3
Licence (differs)	Apache-2.0	NOASSERTION
Repository (differs)	github.com/getjavelin/ramparts	github.com/sonarsource/sonarqube-mcp-server
Changes in the last 7 days	0	0
First seen	2026-10-11	2026-10-11

Lines where the two differ have a tinted background and bold values. Where the data itself says which value is better (more marketplaces, a larger figure of the same marketplace, a fresher release, a verified mark on a marketplace that lists both), the better one is also marked green with ▲ and the worse one red with ▼. Where it runs, the transport, the tools, the settings, hooks, the bundle's parts, the licence and the week's changes are marked only as different: more or fewer is not better in itself.

What each says it does

Ramparts Security Scanner

In its own words, on Docker MCP Catalog:

A comprehensive security scanner for MCP servers with YARA rules and static analysis capabilities.

SonarQube MCP Server

In its own words, on Official MCP Registry:

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

How to run each

Ramparts Security Scanner As a local MCP server: Docker image

Claude Code

claude mcp add --transport stdio ramparts -- docker run -i --rm mcp/ramparts

SonarQube MCP Server As a local MCP server: Docker image

Claude Code

claude mcp add --env "SONARQUBE_ORG=<YOUR_SONARQUBE_ORG>" --env "SONARQUBE_TOKEN=<YOUR_SONARQUBE_TOKEN>" --env "SONARQUBE_URL=<YOUR_SONARQUBE_URL>" --transport stdio sonarqube-mcp-server -- docker run -i --rm -e SONARQUBE_ORG -e SONARQUBE_TOKEN -e SONARQUBE_URL docker.io/sonarsource/sonarqube-mcp

Requires: SONARQUBE_ORG (secret), SONARQUBE_TOKEN (secret), SONARQUBE_URL (secret)

Commands built only from what the marketplaces declare; the full set for every client is on each card.

Tools each declares

Only Ramparts Security Scanner declares

scan
scan-config

Only SonarQube MCP Server declares

analyze_code_snippet
analyze_file_list
change_sonar_issue_status
create_webhook
get_component_measures
get_project_quality_gate_status
get_raw_source
get_scm_info
get_system_health
get_system_info
get_system_logs
get_system_status

Show the remaining 13

list_enterprises
list_languages
list_portfolios
list_quality_gates
list_rule_repositories
list_webhooks
ping_system
search_dependency_risks
search_metrics
search_my_sonarqube_projects
search_sonar_issues_in_projects
show_rule
toggle_automatic_analysis

Both declare

None

Tool names as each marketplace publishes them. More tools is not better in itself: compare what each needs for the job.

Settings each asks for

Only Ramparts Security Scanner asks for

RUST_LOG

Only SonarQube MCP Server asks for

SONARQUBE_ORG (secret)
SONARQUBE_TOKEN (secret)
SONARQUBE_URL (secret)

Settings as each marketplace publishes them. Asking for fewer is not better in itself.

What it can do: Ramparts Security Scanner · What it can do: SonarQube MCP Server · Compare two other plugins

Data comes from the Docker MCP Catalog (desktop.docker.com/mcp/catalog) and Docker Hub. Data comes from the Official MCP Registry (registry.modelcontextprotocol.io), CC0 1.0. Figures come from our own regular passes over the marketplaces, last read on 2026-10-19. We publish no contact details for plugin publishers.