A pull request can be answered in one pass — diff, new issues, diff coverage — rather than by alt-tabbing between a review page and a dashboard. The split between quality and security is enforced by the tool set rather than by a filter, so a question about vulnerabilities asked of the issues call returns the wrong class of finding rather than nothing.
The Codacy API as 24 tools spanning organizations, repositories, files, pull requests and analysis patterns, with security findings on their own security-and-risk-management calls and a local CLI analysis path.
- Code quality issues for a repository, kept separate from security findings, which have their own organization-scope and repository-scope calls
- Pull request review material in one place: the human-readable git diff, new or fixed issues, and diff coverage for every file the PR touches
- File-level detail — its issue list, its coverage at the head commit of a branch, and its duplication clones
- Grade, Issues, Duplication, Complexity and Coverage reported for a repository and for a single file
- File listings sortable by coverage or grade, so the files worth opening surface without reading the whole tree
- The definition of the pattern behind a finding, the patterns a tool offers for a repository, and the analysis tools a repository has enabled
- Local analysis through the Codacy CLI, including installing it, plus repository setup that adds the organization first when it is missing
A Codacy account token, and the provider, organization and repository names that nearly every call takes. npx on your PATH.
One command plus a key — npx -y @codacy/codacy-mcp, then supply credentials