MCP-84 Add a new tool to fetch dependency risks from SonarQube Server

[nquinquenel]

MCP-84

[sonarqubecloud]

🤖 Pull Request summary

This PR adds support for dependency risk analysis through SonarQube's Advanced Security features.

Main Changes:

• New dependency risks tool - Adds search_dependency_risks tool to search for SCA issues with version/feature gating (SonarQube Server 2025.4+ Enterprise with Advanced Security enabled)
• Enhanced version checking - Extends SonarQubeVersionChecker with version comparison and SCA enablement detection methods
• New API integrations - Implements ScaApi for dependency risks and SettingsApi for configuration checking
• Comprehensive testing - Adds extensive test coverage for the new functionality including edge cases

Key Review Focus:

• Version/feature gating logic in SonarQubeMcpServer - ensure proper fallback when requirements aren't met
• Settings API error handling in SonarQubeVersionChecker.isScaEnabled() - verify graceful degradation on API failures
• Complex response parsing in SearchDependencyRisksTool.buildResponseFromDependencyRisksResponse() - validate null-safety for optional fields

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
0 Security Hotspots
92.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud