← Back to directory

Codacy MCP Server

Official

Query Codacy's code quality, security, and coverage analysis via MCP.

GitHub source repository ↗

★ 62 Stars Category · Dev Tools Popular Source revision b6dda4a02d32

56FMRS · C

Reliability

8/20

Security and permissions

10/20

Maintenance

10/20

Documentation

15/20

Setup experience

13/20

Codacy MCP Server is Codacy's official MCP implementation, exposing the platform's code quality, security, and coverage analysis over standard stdio transport. Documentation is clear, covering repository management, issue queries, pull request analysis, security item search, and local CLI analysis, with install instructions for Cursor, Windsurf, VS Code Copilot, and Claude Desktop. The main risks center on safeguarding the account token and on the automatic installation and execution of the local CLI.

Read the FMRS scoring method →

Codacy MCP Server is Codacy's officially maintained MCP implementation, bridging the Codacy API for MCP-enabled clients. It exposes organization and repository management, code quality issue listings, security findings (SAST, secrets, SCA/dependency scanning, IaC, CI/CD, DAST), file-level coverage and duplication data, pull request analysis (issues, diff coverage, git diff), and analysis tool/pattern configuration. It also includes a CLI analysis tool that invokes the Codacy CLI locally to run immediate quality analysis on specified files or directories, without waiting for scheduled analysis.

Tools

codacy_setup_repository

Add or follow a repository in Codacy if it isn't already registered, enabling further analysis and management.

codacy_list_organizations

List organizations the user has access to, with pagination.

codacy_list_organization_repositories

List repositories within an organization, with pagination.

codacy_get_repository_with_analysis

Get a repository along with analysis metrics such as Grade, Issues, Duplication, Complexity, and Coverage.

codacy_list_repository_issues

List and filter code quality issues in a repository by severity, category, language, author, branch, or pattern (excludes security issues).

codacy_list_files

List files in a repository, with pagination.

codacy_get_file_issues

Get the list of issues for a specific file in a repository.

codacy_get_file_coverage

Get coverage information for a file at the head commit of a repository branch.

codacy_get_file_clones

Get duplication clones (identical or very similar code segments) for a file in a repository.

codacy_get_file_with_analysis

Get detailed analysis for a file, including Grade, Issues, Duplication, Complexity, and Coverage metrics.

codacy_search_organization_srm_items

List security items/issues/vulnerabilities/findings across an entire organization (Security and Risk Management dashboard).

codacy_search_repository_srm_items

List security items/issues/vulnerabilities/findings for a specific repository.

codacy_list_repository_pull_requests

List pull requests from a repository the user has access to.

codacy_get_repository_pull_request

Get detailed information about a specific pull request.

codacy_list_pull_request_issues

Return the list of issues found in a pull request (newly introduced or fixed).

codacy_get_pull_request_files_coverage

Get diff coverage information for all files in a pull request.

codacy_get_pull_request_git_diff

Return the human-readable Git diff of a pull request.

codacy_list_tools

List all code analysis tools available in Codacy.

codacy_list_repository_tools

Get analysis tool settings and available tools for a repository.

codacy_get_pattern

Get the definition of a specific analysis pattern (rule).

codacy_list_repository_tool_patterns

List the patterns of a given tool available for a repository.

codacy_get_issue

Get detailed information about a specific issue.

codacy_cli_analyze

Run quality analysis locally using the Codacy CLI on specific files or directories, using specific or all available tools, with immediate results and optional fix application.

Setup

Ensure git and Node.js are installed locally, and that npx runs without issues. 2. Get a Codacy Account API Token from your Codacy account access-management settings. 3. Add a codacy server entry to your MCP client's config (Cursor's .cursor/mcp.json, Windsurf's mcp_config.json, or Claude Desktop's claude_desktop_config.json), using npx -y @codacy/codacy-mcp as the command and passing the token via the CODACY_ACCOUNT_TOKEN environment variable; VS Code with Copilot can be configured similarly in its mcp settings, or via the one-click install links in the README. 4. Restart the IDE and confirm the Codacy tools appear in Agent/Copilot mode. 5. For local file analysis, the server will attempt to auto-install Codacy CLI v2 (a specific version can be pinned via CODACY_CLI_VERSION).

claude_desktop_config.json

{"mcpServers":{"codacy":{"command":"npx","args":["-y","@codacy/codacy-mcp"],"env":{"CODACY_ACCOUNT_TOKEN":"<YOUR_TOKEN>"}}}}

Generate and validate client config

Fit and risk

Best for

Teams already using the Codacy platform for code quality and security management
Developers who want Codacy analysis results directly inside Cursor, Windsurf, VS Code Copilot, or Claude Desktop
Teams that want to check pull request issues and coverage as part of an AI coding assistant workflow

Not for

Users without a Codacy account, or who don't intend to register repositories with Codacy
Scenarios requiring generic static analysis or security scanning independent of the Codacy platform
Restricted environments where Node.js/npx or the Codacy CLI cannot be installed

Required permissions

Accesses organizations and repositories the user has permission to on Codacy, via the CODACY_ACCOUNT_TOKEN personal account token
Reads repository analysis results, issues, coverage, security findings, and pull request data
Executes the Codacy CLI locally to analyze code on the filesystem (attempts automatic installation of the CLI)

Risks and side effects

CODACY_ACCOUNT_TOKEN is a sensitive credential; if leaked it could grant access to all Codacy organizations and repositories tied to the account
codacy_cli_analyze installs and runs the Codacy CLI locally, which involves executing a third-party binary
Security-related tools (SRM items) surface repository vulnerability and secret-scanning results, so access and downstream handling should be controlled
The server depends on network access to the Codacy API; misconfigured credentials could expose data to unintended clients

Troubleshooting

Verify git and Node.js are installed and that the npx command runs without issues
Check that CODACY_ACCOUNT_TOKEN is correctly set in the MCP client's env configuration
Claude Desktop users on NVM may find npx doesn't work; install @codacy/codacy-mcp globally and launch dist/index.js directly with node instead
Confirm Agent mode is enabled in the IDE (e.g. VS Code's chat.agent.enabled) and check the tools panel to verify Codacy tools are listed
For local CLI analysis, confirm Codacy CLI v2 can be auto-installed or is already installed (Windows requires WSL)
Use the repository's built-in MCP Inspector (`npm run inspect`) with a token set to debug the server

Use cases

Querying a repository's code quality, coverage, and duplication metrics directly from an AI coding assistant

Reviewing pull requests for newly introduced or fixed issues and diff coverage

Searching for security findings (SAST, secrets, dependencies, IaC, CI/CD, DAST) across an organization

Running immediate local quality analysis on files or directories via the Codacy CLI, with optional fixes

Supported clients

Claude DesktopFull support

CursorFull support

WindsurfFull support

VS Code (Copilot)Full support

Related MCP servers

Compare with other MCP servers