M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
C

Codacy MCP Server

Official
Query Codacy's code quality, security, and coverage analysis via MCP.
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #176 of 438
Stars
★ 59 Popular
Transport
stdio (local process)
Runtime
Node.js
Credentials
API key / credential required
License
Other / unspecified
Last commit
Tools
23
56FMRS · C

Codacy MCP Server is Codacy's official MCP implementation, exposing the platform's code quality, security, and coverage analysis over standard stdio transport. Documentation is clear, covering repository management, issue queries, pull request analysis, security item search, and local CLI analysis, with install instructions for Cursor, Windsurf, VS Code Copilot, and Claude Desktop. The main risks center on safeguarding the account token and on the automatic installation and execution of the local CLI.

Strongest · Documentation 15/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
10/20
Maintenance
10/20
Documentation
15/20
Setup experience
13/20
Why each score
Reliability 8/20
The README lists ~20+ tools with descriptions that are broadly consistent with the stdio transport and npm package declared in server.json (e.g., codacy_list_repository_issues, codacy_cli_analyze), suggesting a coherent design. However, no CI workflow or test files are present in the provided evidence, the package version is still 0.0.1, and the automatic CLI install/initialization behavior lacks documented error handling, so key paths cannot be confirmed as reproducible or diagnosable from static evidence alone. Per the static calibration rule, reliability is capped below 12 absent CI+test evidence, so this is scored 8.
Security and permissions 10/20
CODACY_ACCOUNT_TOKEN is correctly marked as a secret, optional, and passed via environment variable — no hardcoded credentials or evidence of covert exfiltration were found. However, two under-disclosed risks remain: (1) the server automatically attempts to install and initialize the external Codacy CLI binary whenever an analysis request is received, with no stated user-confirmation step; (2) the codacy_cli_analyze tool can 'Apply fixes' to local code automatically, again with no described confirmation or scoping mechanism. These are moderate automated side-effect risks rather than red-line violations (no malware or irreversible destructive default was evidenced), but the incomplete confirmation/least-privilege disclosure warrants a deduction, landing at 10.
Maintenance 10/20
The repository is not archived, has 62 stars and 3 open issues, indicating some visibility, but no release cadence, commit history, or security-response channel evidence was supplied. Notably, there is a license contradiction: the repository metadata shows License: NOASSERTION, while the README states 'This MCP server is licensed under the MIT License' — an unresolved inconsistency with no LICENSE file confirmation available. The package version remains at 0.0.1, suggesting an early-stage project. These issues bring the score down to 10.
Documentation 15/20
The README is well organized, covering a categorized feature/tool list, install instructions for multiple IDEs (Cursor, Windsurf, VS Code Copilot, Claude Desktop), NVM troubleshooting, a contribution guide, and local Inspector testing instructions — overall solid documentation quality. It lacks per-tool input parameter schemas, rate limits, or cost/quota disclosure (Codacy account/API limits), and there is no dedicated section on security boundaries or data flow, so it falls short of full marks at 15.
Setup experience 13/20
Clear multi-client JSON configuration examples are provided (Cursor one-click install, VS Code one-click install, Windsurf, manual Claude Desktop config), plus NVM-specific troubleshooting, making the install path generally clear. However, full functionality (local CLI analysis) depends on the server automatically downloading/installing an external Codacy CLI binary at runtime, with no default confirmation or version pinning beyond an optional CODACY_CLI_VERSION variable, adding fragility. Per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence (CI+tests), so this is scored 13.

Static review · not runListed 2026-08-26

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Teams already using the Codacy platform for code quality and security management
  • Developers who want Codacy analysis results directly inside Cursor, Windsurf, VS Code Copilot, or Claude Desktop
  • Teams that want to check pull request issues and coverage as part of an AI coding assistant workflow

Not for

  • Users without a Codacy account, or who don't intend to register repositories with Codacy
  • Scenarios requiring generic static analysis or security scanning independent of the Codacy platform
  • Restricted environments where Node.js/npx or the Codacy CLI cannot be installed

Required permissions

  • Accesses organizations and repositories the user has permission to on Codacy, via the CODACY_ACCOUNT_TOKEN personal account token
  • Reads repository analysis results, issues, coverage, security findings, and pull request data
  • Executes the Codacy CLI locally to analyze code on the filesystem (attempts automatic installation of the CLI)

Risks and side effects

  • CODACY_ACCOUNT_TOKEN is a sensitive credential; if leaked it could grant access to all Codacy organizations and repositories tied to the account
  • codacy_cli_analyze installs and runs the Codacy CLI locally, which involves executing a third-party binary
  • Security-related tools (SRM items) surface repository vulnerability and secret-scanning results, so access and downstream handling should be controlled
  • The server depends on network access to the Codacy API; misconfigured credentials could expose data to unintended clients

Setup

Before you start

Runtime：Node.js

CODACY_ACCOUNT_TOKEN requiredsecret Codacy Account API token, required; obtain it from your account at https://app.codacy.com/account/access-management.
Other optional settings (1)
CODACY_CLI_VERSION optional Optional; pin a specific Codacy CLI version for local analysis — otherwise the server auto-installs the CLI.
  1. Ensure git and Node.js are installed locally, and that npx runs without issues.
  2. Get a Codacy Account API Token from your Codacy account access-management settings.
  3. Add a codacy server entry to your MCP client's config (Cursor's .cursor/mcp.json, Windsurf's mcp_config.json, or Claude Desktop's claude_desktop_config.json), using npx -y @codacy/codacy-mcp as the command and passing the token via the CODACY_ACCOUNT_TOKEN environment variable; VS Code with Copilot can be configured similarly in its mcp settings, or via the one-click install links in the README.
  4. Restart the IDE and confirm the Codacy tools appear in Agent/Copilot mode.
  5. For local file analysis, the server will attempt to auto-install Codacy CLI v2 (a specific version can be pinned via CODACY_CLI_VERSION).
claude_desktop_config.json 
{"mcpServers":{"codacy":{"command":"npx","args":["-y","@codacy/codacy-mcp"],"env":{"CODACY_ACCOUNT_TOKEN":"<YOUR_TOKEN>"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "codacy": {
      "command": "npx",
      "args": [
        "-y",
        "@codacy/codacy-mcp"
      ],
      "env": {
        "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add codacy -e 'CODACY_ACCOUNT_TOKEN=<YOUR_TOKEN>' -- npx -y @codacy/codacy-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

In your client (VS Code Copilot, Cursor, etc.), the tool list should show Codacy tools like codacy_list_organizations and codacy_setup_repository; alternatively ask 'list my Codacy organizations' — a returned result confirms the connection works.

Troubleshooting

  1. Verify git and Node.js are installed and that the npx command runs without issues
  2. Check that CODACY_ACCOUNT_TOKEN is correctly set in the MCP client's env configuration
  3. Claude Desktop users on NVM may find npx doesn't work; install @codacy/codacy-mcp globally and launch dist/index.js directly with node instead
  4. Confirm Agent mode is enabled in the IDE (e.g. VS Code's chat.agent.enabled) and check the tools panel to verify Codacy tools are listed
  5. For local CLI analysis, confirm Codacy CLI v2 can be auto-installed or is already installed (Windows requires WSL)
  6. Use the repository's built-in MCP Inspector (`npm run inspect`) with a token set to debug the server

Things to try

Once connected, you can ask your AI assistant things like:

  • Register my repository with Codacy and show me its overall grade, issue count, and coverage.
  • List the top security issues in my organization's SRM dashboard, including SAST, secrets, and dependency scanning findings.
  • Show the quality issues, duplication clones, and coverage for the file src/index.ts.
  • Get the Git diff, new issues, and per-file diff coverage for the latest pull request in my repository.

Tools 23

codacy_setup_repository writes
Add or follow a repository in Codacy if it isn't already registered, enabling further analysis and management.
codacy_list_organizations read-only
List organizations the user has access to, with pagination.
codacy_list_organization_repositories read-only
List repositories within an organization, with pagination.
codacy_get_repository_with_analysis read-only
Get a repository along with analysis metrics such as Grade, Issues, Duplication, Complexity, and Coverage.
codacy_list_repository_issues read-only
List and filter code quality issues in a repository by severity, category, language, author, branch, or pattern (excludes security issues).
codacy_list_files read-only
List files in a repository, with pagination.
codacy_get_file_issues read-only
Get the list of issues for a specific file in a repository.
codacy_get_file_coverage read-only
Get coverage information for a file at the head commit of a repository branch.
Show 15 more tools
codacy_get_file_clones read-only
Get duplication clones (identical or very similar code segments) for a file in a repository.
codacy_get_file_with_analysis read-only
Get detailed analysis for a file, including Grade, Issues, Duplication, Complexity, and Coverage metrics.
codacy_search_organization_srm_items read-only
List security items/issues/vulnerabilities/findings across an entire organization (Security and Risk Management dashboard).
codacy_search_repository_srm_items read-only
List security items/issues/vulnerabilities/findings for a specific repository.
codacy_list_repository_pull_requests read-only
List pull requests from a repository the user has access to.
codacy_get_repository_pull_request read-only
Get detailed information about a specific pull request.
codacy_list_pull_request_issues read-only
Return the list of issues found in a pull request (newly introduced or fixed).
codacy_get_pull_request_files_coverage read-only
Get diff coverage information for all files in a pull request.
codacy_get_pull_request_git_diff read-only
Return the human-readable Git diff of a pull request.
codacy_list_tools read-only
List all code analysis tools available in Codacy.
codacy_list_repository_tools read-only
Get analysis tool settings and available tools for a repository.
codacy_get_pattern read-only
Get the definition of a specific analysis pattern (rule).
codacy_list_repository_tool_patterns read-only
List the patterns of a given tool available for a repository.
codacy_get_issue read-only
Get detailed information about a specific issue.
codacy_cli_analyze writes
Run quality analysis locally using the Codacy CLI on specific files or directories, using specific or all available tools, with immediate results and optional fix application.

Use cases

Querying a repository's code quality, coverage, and duplication metrics directly from an AI coding assistant
Reviewing pull requests for newly introduced or fixed issues and diff coverage
Searching for security findings (SAST, secrets, dependencies, IaC, CI/CD, DAST) across an organization
Running immediate local quality analysis on files or directories via the Codacy CLI, with optional fixes

Supported clients

Claude Desktop
Cursor
Windsurf
GitHub Copilot

Listed from the project's documentation, not tested by this site.

Overview

Codacy MCP Server is Codacy's officially maintained MCP implementation, bridging the Codacy API for MCP-enabled clients. It exposes organization and repository management, code quality issue listings, security findings (SAST, secrets, SCA/dependency scanning, IaC, CI/CD, DAST), file-level coverage and duplication data, pull request analysis (issues, diff coverage, git diff), and analysis tool/pattern configuration. It also includes a CLI analysis tool that invokes the Codacy CLI locally to run immediate quality analysis on specified files or directories, without waiting for scheduled analysis.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision f89c1b14b803 Data synced 2026-10-12 Read the FMRS scoring method