Codacy MCP Server

What is Codacy MCP Server about?

Codacy MCP Server enables programmatic access to the Codacy platform, allowing tools and IDEs to retrieve information about repositories, files, code‑quality issues, coverage, duplication, security findings, pull‑request details, and more. It acts as a bridge between the Codacy backend and client applications, delivering analysis data in real time.

How to use Codacy MCP Server?

1. Obtain a personal API token from your Codacy account (Account → Access Management).
2. Install the server using npx (the most common approach):

   {
     "mcpServers": {
       "codacy": {
         "command": "npx",
         "args": ["-y", "@codacy/codacy-mcp"],
         "env": { "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>" }
       }
     }
   }
   

   The JSON above can be placed in the IDE‑specific configuration file (e.g., .cursor/mcp.json, .codeium/windsurf/mcp_config.json, or VS Code settings.json).
3. Enable Agent mode in the IDE (e.g., VS Code Copilot → Settings → chat.agent.enabled).
4. Interact with the tools through the IDE’s “Select tools” UI or by invoking the MCP server programmatically via HTTP/RPC calls.
5. For local testing, run:

   CODACY_ACCOUNT_TOKEN=your_token npm run inspect
   

   This builds the project and launches the inspector UI.

Key features of Codacy MCP Server

• Repository management (codacy_setup_repository, codacy_get_repository_with_analysis).
• Organization‑wide listing of organizations and repositories.
• Code‑quality issue retrieval with pagination, filtering by severity, category, language, author, branch, and pattern.
• File‑level operations: list files, get file issues, coverage, duplication clones, and comprehensive analysis.
• Security‑related scanning tools covering SAST, secrets, SCA, IaC, CI/CD, DAST, and penetration testing.
• Pull‑request analysis: list PRs, fetch PR details, PR‑specific issues, diff coverage, and raw Git diff.
• Tool and pattern management: list available analysis tools, repository‑specific tool settings, pattern definitions, and issue details.
• Local CLI analysis via codacy_cli_analyze, supporting ad‑hoc runs with custom tool selection.
• Automatic installation of Codacy‑CLI v2 when required, with optional version override via CODACY_CLI_VERSION.

Use cases of Codacy MCP Server

Scenario	How the MCP server helps
Continuous quality monitoring	CI pipelines can query the server for the latest issue list, coverage, and duplication metrics to enforce quality gates.
IDE‑embedded assistance	Developers receive real‑time suggestions, issue highlights, and security warnings directly in VS Code, Cursor, or other supported IDEs.
Security posture auditing	Security teams can pull organization‑wide SRM items to assess vulnerabilities across all repositories.
Pull‑request review automation	Reviewers can view new/fixed issues, coverage diffs, and code similarity directly within the PR view.
Custom tooling	Internal tools can call the server’s endpoints to build dashboards, reporting portals, or migration scripts.

FAQ

Q: Which token should I use? A: Use a personal Account API Token generated from the Codacy account page under Access Management.

Q: Do I need to install Codacy‑CLI manually? A: No. The MCP server will attempt to install the CLI automatically. If you prefer a specific version, set CODACY_CLI_VERSION in the environment.

Q: Which languages are supported? A: All languages supported by Codacy’s analysis tools are available through the server (e.g., Java, JavaScript, Python, Go, etc.).

Q: Can I run the server locally without an IDE? A: Yes. Install the package globally (npm install -g @codacy/codacy-mcp) and run it with the same npx‑style configuration, then interact via HTTP or the provided inspector tool.

Q: What if I use NVM and the npx command fails? A: Install the package globally and reference the Node binary directly in the configuration (see the “Claude Desktop and NVM” section of the README).

Q: Is the server open‑source? A: Yes, it is released under the MIT License and the source code is hosted on GitHub.

Codacy MCP Server

MCP Server for the Codacy API, enabling access to repositories, files, quality, coverage, security and more.

Table of Contents

• Features / Tools
  • Repository Setup and Management
  • Organization and Repository Management
  • Code Quality and Analysis
  • File Management and Analysis
  • Security Analysis
  • Pull Request Analysis
  • Tool and Pattern Management
  • CLI Analysis
• Setup
  • Requirements
  • Personal API Access Token
  • Install
    • Cursor, Windsurf, and others
    • VS Code with Copilot
• Troubleshooting
• Contribute
• Codacy-CLI Support
• License

Features / Tools

The following tools are available through the Codacy MCP Server:

Repository Setup and Management

• codacy_setup_repository: Add or follow a repository in Codacy if not already present. This tool ensures the repository is registered with Codacy, allowing further analysis and management.

Organization and Repository Management

• codacy_list_organizations: List organizations with pagination support.
• codacy_list_organization_repositories: List repositories in an organization with pagination support.
• codacy_get_repository_with_analysis: Get repository with analysis information, including metrics for Grade, Issues, Duplication, Complexity, and Coverage.

Code Quality and Analysis

• codacy_list_repository_issues: Lists and filters code quality issues in a repository. This is the primary tool for investigating general code quality concerns (e.g. best practices, performance, complexity, style) but NOT security issues. For security-related issues, use the SRM items tool instead. Features include:

  • Pagination support for handling large result sets
  • Filtering by multiple criteria including severity, category, and language
  • Author-based filtering for accountability
  • Branch-specific analysis
  • Pattern-based searching

  Common use cases:

  • Code quality audits
  • Technical debt assessment
  • Style guide compliance checks
  • Performance issue investigation
  • Complexity analysis

File Management and Analysis

• codacy_list_files: List files in a repository with pagination support.
• codacy_get_file_issues: Get the issue list for a file in a repository.
• codacy_get_file_coverage: Get coverage information for a file in the head commit of a repository branch.
• codacy_get_file_clones: Get the list of duplication clones (identical or very similar code segments) for a file in a repository.
• codacy_get_file_with_analysis: Get detailed analysis information for a file, including metrics for Grade, Issues, Duplication, Complexity, and Coverage.

Security Analysis

• codacy_search_organization_srm_items: Primary tool to list security items/issues/vulnerabilities/findings across an organization. Results are related to the organization's security and risk management (SRM) dashboard on Codacy.
• codacy_search_repository_srm_items: List security items/issues/vulnerabilities/findings for a specific repository.

Both tools provide comprehensive security analysis including:

• SAST (Code scanning)
• Secrets (Secret scanning)
• SCA (Dependency scanning)
• IaC (Infrastructure-as-code scanning)
• CICD (CI/CD scanning)
• DAST (Dynamic Application Security Testing)
• PenTesting (Penetration testing)

Pull Request Analysis

• codacy_list_repository_pull_requests: List pull requests from a repository that the user has access to.
• codacy_get_repository_pull_request: Get detailed information about a specific pull request.
• codacy_list_pull_request_issues: Returns a list of issues found in a pull request (new or fixed issues).
• codacy_get_pull_request_files_coverage: Get diff coverage information for all files in a pull request.
• codacy_get_pull_request_git_diff: Returns the human-readable Git diff of a pull request.

Tool and Pattern Management

• codacy_list_tools: List all code analysis tools available in Codacy.
• codacy_list_repository_tools: Get analysis tools settings and available tools for a repository.
• codacy_get_pattern: Get the definition of a specific pattern.
• codacy_list_repository_tool_patterns: List the patterns of a tool available for a repository.
• codacy_get_issue: Get detailed information about a specific issue.

CLI Analysis

• codacy_cli_analyze: Run quality analysis locally using Codacy CLI. Features include:
  • Analyze specific files or entire directories
  • Use specific tools or all available tools
  • Get immediate results without waiting for scheduled analysis
  • Apply fixes based on Codacy configuration

Setup

Requirements

Ensure your machine has the following tools installed:

• git
• node.js
  • ensure that the npx command runs without issues.

For local analysis, the MCP Server requires the Codacy CLI to be installed. If it is not available, the MCP Server will attempt to install it for you. Codacy CLI v2 runs on macOS, Linux, and Windows (only with WSL).

Personal API Access Token

Get your Codacy's Account API Token from your Codacy Account.

You'll need it later in the setup.

Install

In supported IDEs like VS Code, Cursor, and Windsurf, the easiest way to install Codacy's MCP Server is to do it from the Codacy extension. If you haven't yet, install the extension from within your IDE, or from any of the available marketplaces (Microsoft, OpenVSX). From the extension panel, just click on Add Codacy MCP Server. Restart your IDE afterwards.

Without the extension, you can still use and install the MCP Server:

Cursor, Windsurf, and others

You can use the one-click install for Cursor:

Otherwise, depending on what you are connecting the MCP Server to, you can use the following methods:

• Cursor: edit the .cursor/mcp.json file to add the following
• Windsurf: edit the .codeium/windsurf/mcp_config.json file to add the following
• Claude Desktop: edit the claude_desktop_config.json file to add the following

{
  "mcpServers": {
    "codacy": {
      "command": "npx",
      "args": ["-y", "@codacy/codacy-mcp"],
      "env": {
        "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
      }
    }
  }
}

VS Code with Copilot

You can use the one-click install for VS Code:

Otherwise, if you wish to set it up manually:

1. For connecting the MCP Server to Copilot in VS Code, add the following to the global config of the IDE:

{
  "mcp": {
    "inputs": [],
    "servers": {
      "codacy": {
        "command": "npx",
        "args": ["-y", "@codacy/codacy-mcp"],
        "env": {
          "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
        }
      }
    }
  }
}

You can open the user settings.json file in:

View > Command Palette > Preferences: Open User Settings (JSON)

Or open the general settings.json file directly, which according to your OS should be located in:

• for macOS: ~/Library/Application Support/Code/User/settings.json
• for Windows: %APPDATA%\Code\User\settings.json
• for Linux: ~/.config/Code/User/settings.json

Don't forget to update the value of CODACY_ACCOUNT_TOKEN with your token.

2. Make sure you have Agent mode enabled: vscode://settings/chat.agent.enabled

3. Open the Copilot chat and switch the mode to Agent. You can check that the MCP server was enabled correctly by clicking on the Select tools icon, which should list all the available Codacy tools.

Troubleshooting

Claude Desktop and NVM

When using NVM with Claude Desktop, NPX may not work. You should first install the MCP Server globally, and then use Node directly:

npm install -g @codacy/codacy-mcp

{
  "mcpServers": {
    "codacy": {
      "command": "/Users/yourusername/.nvm/versions/node/vXX.X.X/bin/node",
      "args": ["/path-to/codacy-mcp/dist/index.js"],
      "env": {
        "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
      }
    }
  }
}

Contribute

To work locally on the MCP Server code, run:

npm install
npm run update-api
npm run build

Testing with Inspector

You can test the MCP server using the inspector tool. You can either set a CODACY_ACCOUNT_TOKEN environment variable or pass it inline:

CODACY_ACCOUNT_TOKEN=your_token_here npm run inspect

This will build the project and launch the MCP inspector with your Codacy token.

Testing with an Agent

You can test your local instance configuring the MCP Server as follows:

"codacy": {
  "command": "/path/to/bin/node",
  "args": [
    "/path/to/codacy-mcp-server/dist/index.js"
  ],
  "env": {
    "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
  }
}

Codacy-CLI Support

In order to use the Codacy-CLI, it needs to be installed. Whenever the MCP Server will receive a request to analyze, it will try to install the CLI and initialize it.

In case you want to use a specific version of our CLI, send a CODACY_CLI_VERSION env variable in the MCP Server configuration.

License

This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.