Using SonarCube is not very effective: most of the Java code that is present is either generated or downloaded from the app store (i.e. not something that your developers have created). The microflows that developers create are not converted to Java, and so they cannot be scanned.
There are currently there tools for automated code scans that work with Mendix (listed alphabetically):