MCP-284 Make anonymous requests for plugins download for SQC

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-284

[sonarqubecloud]

SonarQube reviewer guide

Summary: Make SonarQube token optional in HTTP mode for SonarQube Cloud, since plugin and version check endpoints don't require authentication.

Review Focus:

• Token validation logic in McpServerLaunchConfiguration - ensures token is only required for stdio mode or SonarQube Server, not for SonarQube Cloud HTTP mode
• PluginsApi changes - uses anonymous HTTP calls on SonarQube Cloud vs authenticated calls on Server
• HttpClientAdapter constructor consolidation - unifies token and bridge client handling into single constructor
• Null safety annotations (@Nullable) added to token-related methods

Start review at: McpServerLaunchConfiguration.java. This file contains the core validation logic that determines when a token is required. Understanding the new token optionality rules here is essential before reviewing how this affects downstream HTTP client creation and API calls.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
83.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sophio-japharidze-sonarsource]

I feel like it would be easier if isSonarCloud() was part of ServerApiHelper class. It would also make PluginsApi changes easier. No strong opinion though.

[sophio-japharidze-sonarsource]