Overview

The Codacy MCP Server is a lightweight HTTP server that exposes Codacy functionality (repository metadata, code quality issues, vulnerabilities, and coverage) as simple API endpoints. It acts as a protocol adapter for tools and AI agents that need to fetch analysis results from Codacy without dealing with the Codacy API surface directly. Use it to query issues, security findings (SRM), duplication and complexity metrics, file-level coverage, and pull-request diffs programmatically.

This server is useful for integrating Codacy insights into IDE extensions, CI jobs, automation scripts, chatbots, or LLM agents that require structured access to code quality and security data. It supports local analysis via the Codacy CLI and can be run locally or inside CI containers.

Features

Repository and organization discovery (list organizations, repositories)
Code quality query (list and filter issues by severity, category, language, branch)
Security/SRM queries (SAST, secrets, SCA, IaC, DAST, CI/CD findings)
File-level analysis (issues, coverage, duplication clones, complexity)
Pull request support (list PRs, PR issues, diff coverage, human-readable git diffs)
Tools and pattern introspection (list tools, list patterns, get pattern details)
Local analysis via Codacy CLI (run analysis and return results synchronously)
Pagination and rich filtering on large result sets

Installation / Configuration

Prerequisites:

git
Node.js (npx available)
Codacy account API token (Account → Access Management)
Codacy CLI v2 for local analysis (optional — if missing, server may install it)

Quick start:

# clone the repo
git clone https://github.com/codacy/codacy-mcp-server.git
cd codacy-mcp-server

# install dependencies
npm install

Create a local environment file (copy example and set your Codacy token):

cp .env.example .env
# edit .env and set CODACY_API_TOKEN and PORT (if needed)
# Example .env
# CODACY_API_TOKEN=your_codacy_account_token_here
# PORT=9000

Start the server:

# run in foreground
npm start

# or with node directly
node src/server.js

Note: When running in CI or containerized environments, set CODACY_API_TOKEN as an environment variable rather than storing it in a file.

Available Resources

The MCP server exposes endpoints that correspond to the “tools” the project implements. Each endpoint accepts JSON input (filters and identifiers) and returns JSON responses. Common endpoints include:

Endpoint (POST)	Purpose
/tools/codacy_list_organizations	List organizations (paginated)
/tools/codacy_list_organization_repositories	List repositories in an organization
/tools/codacy_get_repository_with_analysis	Repository overview + analysis metrics
/tools/codacy_list_repository_issues	List code quality issues with filters
/tools/codacy_search_repository_srm_items	List security findings for a repository
/tools/codacy_search_organization_srm_items	List security findings for an organization
/tools/codacy_get_file_coverage	Get coverage for a specific file at repo head
/tools/codacy_get_pull_request_files_coverage	Get diff coverage for PR files
/tools/codacy_cli_analyze	Run Codacy CLI analysis locally

Example request to list repository issues (replace host/port and values):

curl -X POST http://localhost:9000/tools/codacy_list_repository_issues \
  -H "Content-Type: application/json" \
  -d '{
    "organizationId": "my-org",
    "repositoryId": "my-repo",
    "branch": "main",
    "page": 1,
    "pageSize": 50,
    "filters": { "severity": ["MAJOR","CRITICAL"], "language": "python" }
  }'

Example request to search SRM items (security vulnerabilities):

curl -X POST http://localhost:9000/tools/codacy_search_repository_srm_items \
  -H "Content-Type: application/json" \
  -d '{
    "organizationId": "my-org",
    "repositoryId": "my-repo",
    "page": 1,
    "pageSize": 50,
    "filters": { "types": ["SAST", "SCA"], "severity

Codacy MCP Server: Code Quality, Vulnerabilities, Coverage

Overview

Features

Installation / Configuration

Available Resources