Codacy MCP Server

Content

The Codacy MCP Server is the official Model Context Protocol server maintained by Codacy. It exposes the Codacy API to LLMs and agentic clients for code quality, security, and coverage — listing repository and pull-request issues, retrieving file coverage and duplication, searching security (SRM) findings, inspecting analysis tools and patterns, and running local analysis with the Codacy CLI.

It ships as the npm package @codacy/codacy-mcp (v0.6.22, MIT), runs over stdio via npx, and authenticates with a Codacy Account API Token (CODACY_ACCOUNT_TOKEN). For local analysis it uses the Codacy CLI v2, installing it automatically if it is not already present. Setup details live in the repository README.

Source Review

The following real repository and package sources were fetched and reviewed for this entry:

• README.md — the npx install command, the CODACY_ACCOUNT_TOKEN env var and client config blocks, the Codacy CLI requirement for local analysis, and the full tool catalog (repository, quality, security, coverage, pull-request, and pattern tools).
• npm: @codacy/codacy-mcp — package name and version (0.6.22), MIT license, and the codacy-mcp-server bin entry.
• LICENSE — MIT License (Codacy).

Repository facts confirmed at review time: official codacy organization, repository codacy/codacy-mcp-server, default branch master, not archived, actively maintained, and released as @codacy/codacy-mcp v0.6.22 on npm.

Features

• Repository & organization — codacy_setup_repository, codacy_list_organizations, codacy_list_organization_repositories, and codacy_get_repository_with_analysis (Grade, Issues, Duplication, Complexity, Coverage).
• Code-quality issues — codacy_list_repository_issues and codacy_get_issue investigate best-practice, performance, complexity, and style issues.
• File analysis — codacy_list_files, codacy_get_file_issues, codacy_get_file_coverage, codacy_get_file_clones, and codacy_get_file_with_analysis.
• Security (SRM) — codacy_search_organization_srm_items and codacy_search_repository_srm_items list security findings across SAST, DAST, SCA, secrets, and IaC.
• Pull requests — list PRs and PR issues, and get PR file coverage and the Git diff (codacy_get_pull_request_files_coverage, codacy_get_pull_request_git_diff).
• Tools & patterns — codacy_list_tools, codacy_list_repository_tools, codacy_get_pattern, and codacy_list_repository_tool_patterns.
• Local CLI analysis — codacy_cli_analyze runs Codacy CLI analysis on files or directories locally.
• Account-token auth — authenticates with a single Codacy Account API Token over HTTPS.
• One-command install — runs via npx -y @codacy/codacy-mcp with no clone or build step.

Installation

Run the published package with npx, providing your Codacy Account API Token:

export CODACY_ACCOUNT_TOKEN="your_codacy_account_token"
npx -y @codacy/codacy-mcp

Add it to an MCP client (e.g. Cursor / Claude Desktop):

{
  "mcpServers": {
    "codacy": {
      "command": "npx",
      "args": ["-y", "@codacy/codacy-mcp"],
      "env": {
        "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>"
      }
    }
  }
}

Create an Account API Token in Codacy Account → Access management. For local analysis the server uses the Codacy CLI v2 and installs it automatically if it is not present. Supported IDEs (VS Code, Cursor, Windsurf) can also add the server from the Codacy extension.

Use Cases

• Code-quality triage — ask an agent to list and explain a repository's or file's quality issues.
• Security review — surface SAST/DAST/SCA/secrets/IaC findings from Codacy's security dashboard.
• Coverage inspection — check file and pull-request coverage, including diff coverage on a PR.
• Duplication analysis — find duplicated code segments (clones) in a file.
• Local analysis — run Codacy CLI analysis on files or directories during development.

Safety and Privacy

• Runs and installs software locally. codacy_cli_analyze runs Codacy CLI analysis on your files and will download/install the CLI if it is missing.
• Token is broad. The Account API Token can read the organizations and repositories your account sees (including private ones); scope it tightly and treat it as a secret.
• Mostly read, one write. Most tools are read-only analysis, but codacy_setup_repository adds or follows a repository in Codacy.
• Source and findings flow to the model. PR Git diffs, file analysis, and security findings are returned to the LLM/MCP client and can include real source code and vulnerability details.
• Credential hygiene. CODACY_ACCOUNT_TOKEN lives in your MCP client config — keep it out of version control and restrict access.

Duplicate Check

No existing entry in the directory matches this server. A search of all directory entries for "codacy" across slugs, titles, repository URLs, and install commands returned no results, and there is no prior entry pointing at github.com/codacy/codacy-mcp-server or the npm package @codacy/codacy-mcp. This is therefore a net-new, non-duplicate entry.

• Source repositorygithub.com 2026-07-09T08:15:57+00:00
• Documentationgithub.com
• Websitecodacy.com
• Submitted by davion-knight2026-07-08