[INSTRUCTIONS] Runs analysis LOCALLY — does NOT require authentication or send code to the cloud. Results are in SARIF format. Common mistakes: (1) If CLI is not installed, suggest codacy_cli.install first. (2) Provide an ABSOLUTE path for directory — relative paths may fail. (3) On Windows, the CLI requires WSL. Tool redirection: For cloud-based analysis results, use codacy_issues.list instead.

Run local code analysis using the Codacy CLI. Requires the CLI to be installed.. Select operation via the action parameter. Actions: analyze, install

Workflow:

• 'analyze': [INSTRUCTIONS] Runs analysis LOCALLY — does NOT require authentication or send code to the cloud. Results are in SARIF format. Common mistakes: (1) If CLI is not installed, suggest codacy_cli.install first. (2) Provide an ABSOLUTE path for directory — relative paths may fail. (3) On Windows, the CLI requires WSL. Tool redirection: For cloud-based analysis results, use codacy_issues.list instead.

Run local code analysis using the Codacy CLI. Requires the CLI to be installed.. Requires: directory

• 'install': [INSTRUCTIONS] Downloads and installs the Codacy CLI. On macOS/Linux uses curl. On Windows requires WSL — the CLI does NOT run natively on Windows. Common mistake: running install without network access — requires internet connectivity to download the binary.

Install the Codacy CLI for local analysis. [Cache-Control: no-store]

[INSTRUCTIONS] Returns ONLY issues introduced by this specific commit — not the full repository issue list. Common mistake: using this to see all repository issues — use codacy_issues.list for that.

Get issues introduced by a specific commit (delta issues only).. Select operation via the action parameter. Actions: issues, get, list

Workflow:

• 'issues': [INSTRUCTIONS] Returns ONLY issues introduced by this specific commit — not the full repository issue list. Common mistake: using this to see all repository issues — use codacy_issues.list for that.

Get issues introduced by a specific commit (delta issues only).. Requires: commitSha

• 'get': [INSTRUCTIONS] Requires a full 40-char commit SHA. Short SHAs or branch names are NOT valid. Use codacy_commits.issues to see the specific issues introduced by this commit.

Get commit details with delta statistics (new/fixed issues, coverage change).. Requires: commitSha

• 'list': [INSTRUCTIONS] Shows commits with delta metrics (new/fixed issues per commit). Analysis reflects COMMITTED code only. Common mistake: confusing delta metrics (new issues introduced by this commit) with total repository metrics — use codacy_repositories.get for totals.

List repository commits with their analysis status and delta metrics. [Cache-Control: no-store]

[INSTRUCTIONS] Returns code clone blocks — duplicated code segments. Requires a valid fileId. Common mistake: looking at individual files when codebase-wide duplication analysis is needed — for that, check file duplication metrics via codacy_files.list.

Get duplication blocks (clones) detected in a file.. Select operation via the action parameter. Actions: clones, coverage, get, list

Workflow:

• 'clones': [INSTRUCTIONS] Returns code clone blocks — duplicated code segments. Requires a valid fileId. Common mistake: looking at individual files when codebase-wide duplication analysis is needed — for that, check file duplication metrics via codacy_files.list.

Get duplication blocks (clones) detected in a file.. Requires: fileId

• 'coverage': [INSTRUCTIONS] Returns line-by-line coverage data (covered, uncovered, partial). Requires a valid fileId. Coverage must be uploaded to Codacy first — if no coverage data exists, consider suggesting the user configure coverage reporting.

Get line-by-line code coverage for a file.. Requires: fileId

• 'get': [INSTRUCTIONS] Requires a valid fileId — get it from codacy_files.list. Common mistake: using the file PATH instead of the fileId. Paths like 'src/index.ts' are NOT valid fileId values.

Get file details with analysis metrics (grade, issues, complexity, coverage, duplication).. Requires: fileId

• 'list': [INSTRUCTIONS] Lists files with five metrics: Grade, Issues, Duplication, Complexity, Coverage. Common mistakes: (1) If a file has isIgnored=true, Codacy does NOT analyze it — metrics will be empty. (2) Use the fileId from results for file-specific queries (codacy_files.get, codacy_issues.file_issues, codacy_files.clones). Tool redirection: For file-level issues, use codacy_issues.file_issues with the fileId. For file coverage, use codacy_files.coverage.

List files in a repository with analysis metrics. [Cache-Control: no-store]

[INSTRUCTIONS] Use when the user wants to ignore many issues of the same pattern or category. Provide issue IDs, reason, and an optional comment. Common mistakes: (1) Do NOT bulk-ignore without user confirmation — always list the issues first and confirm. (2) Reason must be FalsePositive, WontFix, or NotRelevant. (3) Verify issue IDs exist before sending — invalid IDs silently fail. This action is idempotent — safe to retry if the request times out.

Batch ignore multiple issues at once with a comment.. Select operation via the action parameter. Actions: bulk_ignore, file_issues, get, ignore, list, pr_issues, quickfix_patch

Workflow:

• 'bulk_ignore': [INSTRUCTIONS] Use when the user wants to ignore many issues of the same pattern or category. Provide issue IDs, reason, and an optional comment. Common mistakes: (1) Do NOT bulk-ignore without user confirmation — always list the issues first and confirm. (2) Reason must be FalsePositive, WontFix, or NotRelevant. (3) Verify issue IDs exist before sending — invalid IDs silently fail. This action is idempotent — safe to retry if the request times out.

Batch ignore multiple issues at once with a comment.. Requires: issueIds, reason [DESTRUCTIVE]

• 'file_issues': [INSTRUCTIONS] Requires a valid fileId. Common mistake: using the file PATH instead of the fileId — get the fileId from codacy_files.list first. If unsure about the file identifier, call codacy_files.list to browse available files.

Get issues for a specific file in the repository.. Requires: fileId

• 'get': Get detailed information about a specific issue.. Requires: issueId

• 'ignore': [INSTRUCTIONS] Use when the user explicitly wants to ignore an issue. Always provide a reason: FalsePositive, WontFix, or NotRelevant. Common mistakes: (1) Do NOT invent reasons — only the three listed are valid. (2) Ignoring without asking the user first — this is destructive, always confirm intent. This action is idempotent — calling it twice with the same issueId and reason has no additional effect.

Mark a specific issue as ignored with a reason.. Requires: issueId, reason [DESTRUCTIVE]

• 'list': [INSTRUCTIONS] Code quality issues ONLY — for security findings, use codacy_security. Common mistakes: (1) Do NOT search issues without specifying filters when the repository is large. (2) Severity levels: Info, Warning, Error — do NOT invent levels like 'Critical' or 'High'. (3) Categories: Security, Performance, CodeStyle, Compatibility, ErrorProne, UnusedCode, Complexity, BestPractice, Comprehensibility, Documentation — do NOT invent categories. (4) Analysis reflects COMMITTED code only — local edits are NOT visible until pushed. Tool redirection: For security vulnerabilities (CVEs, OWASP), use codacy_security.search_repo. For file-level issues, use codacy_issues.file_issues with the fileId.

Search and filter repository code quality issues.

• 'pr_issues': Get code quality issues introduced or found in a pull request.. Requires: pullRequestNumber

• 'quickfix_patch': [INSTRUCTIONS] Returns a unified diff patch. Use ONLY after confirming hasQuickfix=true on the relevant issues. Common mistakes: (1) Calling this without checking quickfix availability first — verify with codacy_issues.list. (2) The patch is a unified diff — apply it with git apply, not git am. The response can be large for repositories with many fixable issues — the egress guard will truncate if necessary.

Download auto-fix patches for issues that have quickfix suggestions available. [Cache-Control: no-store]

[INSTRUCTIONS] Lists repositories within the organization. Use search to filter by name. Common mistake: searching for repositories without first confirming the organization exists — use codacy_organizations.list first. Repositories must be added/followed in Codacy to appear — use codacy_repositories.setup to add new ones.

List repositories in an organization.. Select operation via the action parameter. Actions: list_repos, list

Workflow:

• 'list_repos': [INSTRUCTIONS] Lists repositories within the organization. Use search to filter by name. Common mistake: searching for repositories without first confirming the organization exists — use codacy_organizations.list first. Repositories must be added/followed in Codacy to appear — use codacy_repositories.setup to add new ones.

List repositories in an organization.

• 'list': [INSTRUCTIONS] Entry point for discovering available organizations. Filter by provider (gh, gl, bb) to narrow results. Common mistake: skipping this step and guessing organization names — always list organizations first to get the exact provider and name.

List organizations the authenticated user belongs to. [Cache-Control: no-store]

[INSTRUCTIONS] Returns category-level counts — use these to identify which category has the most issues, then drill down with codacy_issues.list filtering by that category.

Get issue count breakdown by quality category (Security, Performance, CodeStyle, etc.).. Select operation via the action parameter. Actions: categories, issues

Workflow:

• 'categories': [INSTRUCTIONS] Returns category-level counts — use these to identify which category has the most issues, then drill down with codacy_issues.list filtering by that category.

Get issue count breakdown by quality category (Security, Performance, CodeStyle, etc.).

• 'issues': [INSTRUCTIONS] Returns server-rendered ECharts pie charts. Do NOT try to recalculate or re-render — present them as-is. Use the breakdown to identify highest-impact areas, then drill down with codacy_issues.list using appropriate filters.

Get aggregated issue overview with server-rendered pie charts by category and severity. [Cache-Control: no-store]

[INSTRUCTIONS] Use ONLY when the user explicitly wants to override the quality gate — this is a deliberate decision with security implications. Common mistakes: (1) Bypassing without user confirmation. (2) Bypassing for quality issues that could be fixed — suggest fixing first. This action is idempotent — calling it twice has no additional effect.

Bypass the analysis quality gate for a pull request. Allows merging even if quality standards are not met.. Select operation via the action parameter. Actions: bypass, get, list, coverage, diff, trigger_ai_review

Workflow:

• 'bypass': [INSTRUCTIONS] Use ONLY when the user explicitly wants to override the quality gate — this is a deliberate decision with security implications. Common mistakes: (1) Bypassing without user confirmation. (2) Bypassing for quality issues that could be fixed — suggest fixing first. This action is idempotent — calling it twice has no additional effect.

Bypass the analysis quality gate for a pull request. Allows merging even if quality standards are not met.. Requires: pullRequestNumber [DESTRUCTIVE]

• 'get': [INSTRUCTIONS] isUpToStandards=false means the quality gate FAILED. Investigate with codacy_issues.pr_issues and codacy_pull_requests.coverage. Common mistake: treating isUpToStandards=null as passed — null means analysis is not yet complete.

Get pull request details with quality analysis results (isUpToStandards, new/fixed issues, coverage).. Requires: pullRequestNumber

• 'list': [INSTRUCTIONS] Lists PRs with quality analysis status. Analysis reflects COMMITTED code only — local changes are NOT visible. Common mistake: expecting analysis to update in real-time after a push — there is processing delay. Use codacy_pull_requests.get to check if isAnalysed=true.

List pull requests in a repository with analysis status.

• 'coverage': Get file-level coverage data for the pull request diff.. Requires: pullRequestNumber

• 'diff': Get the Git diff for a pull request.. Requires: pullRequestNumber

• 'trigger_ai_review': [INSTRUCTIONS] This triggers NEW work — use ONLY when the user explicitly asks for an AI code review. NOT idempotent — each call dispatches a new review. Prerequisite: the PR must be analysed (isAnalysed=true). If not, suggest waiting for analysis to complete. Common mistake: triggering review on unanalysed PRs — check with codacy_pull_requests.get first.

Trigger a Codacy AI-powered code review on a pull request.. Requires: pullRequestNumber [DESTRUCTIVE] [Cache-Control: no-store]

[INSTRUCTIONS] Returns the full threshold configuration for a policy. Use the policyId from codacy_quality.list_policies. Thresholds define pass/fail conditions for issues, coverage, complexity, and duplication.

Get details of a specific gate policy including all thresholds.. Select operation via the action parameter. Actions: get_policy, get_settings, list_policies

Workflow:

• 'get_policy': [INSTRUCTIONS] Returns the full threshold configuration for a policy. Use the policyId from codacy_quality.list_policies. Thresholds define pass/fail conditions for issues, coverage, complexity, and duplication.

Get details of a specific gate policy including all thresholds.. Requires: policyId

• 'get_settings': [INSTRUCTIONS] Returns the quality gate configuration — thresholds for issues, coverage, complexity, and duplication. These settings determine what isUpToStandards means for PRs and commits.

Get quality settings for a repository (commit/PR/repository thresholds).

• 'list_policies': [INSTRUCTIONS] Gate policies are organization-level quality rules applied to repositories. Common mistake: confusing policies with repository-specific settings — policies are templates, settings are per-repo. isDefault=true means this policy applies to all repos without explicit overrides.

List gate policies for an organization. [Cache-Control: no-store]

[INSTRUCTIONS] Returns the overall repository health: Grade (A-F scale), coverage %, complexity, issue count. Common mistake: assuming Grade=A means zero issues — the grade is a composite score. Use codacy_issues.list for the actual issue breakdown.

Get repository details with analysis metrics (grade, coverage, complexity, issues).. Select operation via the action parameter. Actions: get, list_branches, setup

Workflow:

• 'get': [INSTRUCTIONS] Returns the overall repository health: Grade (A-F scale), coverage %, complexity, issue count. Common mistake: assuming Grade=A means zero issues — the grade is a composite score. Use codacy_issues.list for the actual issue breakdown.

Get repository details with analysis metrics (grade, coverage, complexity, issues).

• 'list_branches': [INSTRUCTIONS] Lists all branches tracked by Codacy analysis. The default branch is the one being analyzed — other branches may have limited or no analysis data.

List branches of a repository.

• 'setup': [INSTRUCTIONS] Use ONLY when the user explicitly wants to add a new repository for analysis. This is a multi-step action: it will (1) find the organization, (2) join it if needed, (3) find the repository, and (4) add or follow it. Common mistake: calling setup on an already-tracked repository — it will return a success message without re-adding. This action invalidates organization and repository caches.

Add or follow a repository in Codacy. This sets up analysis tracking. [DESTRUCTIVE] [Cache-Control: no-store]

Get the security dashboard summary for a repository.. Select operation via the action parameter. Actions: dashboard, ignore, ossf_scorecard, sbom_search, search_org, search_repo

Workflow:

• 'dashboard': Get the security dashboard summary for a repository.

• 'ignore': [INSTRUCTIONS] Use when the user explicitly wants to mark a security finding as ignored. Always provide a reason: FalsePositive, WontFix, or NotRelevant. Common mistakes: (1) Do NOT invent reasons. (2) Ignoring without user confirmation — this is a security decision, always confirm. This action is idempotent — calling it twice with the same srmItemId has no additional effect.

Ignore or unignore a security finding.. Requires: srmItemId, reason [DESTRUCTIVE]

• 'ossf_scorecard': [INSTRUCTIONS] Accepts either a repository URL (e.g., https://github.com/org/repo) or a purl (e.g., maven:ch.qos.logback:logback-classic:1.2.3). At least one is required. Common mistake: not providing either url or purl — the API requires at least one identifier. Use the purl from SBOM search results.

Get the OSSF Scorecard for a repository or package. Returns security posture score.

• 'sbom_search': [INSTRUCTIONS] Supply chain security investigation — search SBOM dependencies by name, vulnerability severity, or risk category. Common mistakes: (1) Confusing SBOM search with security findings — SBOM shows dependencies, use codacy_security.search_repo for code-level findings. (2) Risk categories: Forbidden, Risky, Normal — do NOT invent categories. Use purl (Package URL) as the universal identifier for cross-referencing with OSSF Scorecard.

Search SBOM dependencies across the organization. Find vulnerable packages by name, severity, or risk category.

• 'search_org': [INSTRUCTIONS] Cross-repository security overview at the organization level. For repository-specific findings, use codacy_security.search_repo instead. Scan types: SAST, SCA, Secrets, IaC, CICD (repo-level). DAST and PenTesting are organization-level only. Common mistakes: (1) Using this for code quality issues — use codacy_issues instead. (2) Status values: OnTrack, DueSoon, Overdue (open), ClosedOnTime, ClosedLate, Ignored (closed) — do NOT invent statuses.

Search organization-level security findings across all repositories.

• 'search_repo': [INSTRUCTIONS] Repository-scoped security search. Uses the organization-level API filtered by this repository. Scan types available at repo level: SAST, SCA, Secrets, IaC, CICD. For DAST and PenTesting, use codacy_security.search_org instead. Common mistake: using DAST or PenTesting scan types here — those are organization-level only.

Search security findings within a specific repository. [Cache-Control: no-store]

[INSTRUCTIONS] Full tool configuration for a repository. Requires toolUuid from codacy_tools.repo_tools. Common mistakes: (1) Using the tool name instead of toolUuid. (2) Enabling useConfigurationFile without having a config file in the repository — this will cause the tool to use no patterns. For enabling/disabling specific patterns, use codacy_tools.update_patterns instead. This action is idempotent — safe to retry.

Configure a tool for a repository — enable/disable the tool, set configuration file usage, and configure individual patterns with parameters.. Select operation via the action parameter. Actions: configure, get_pattern, list, repo_patterns, repo_tools, update_patterns

Workflow:

• 'configure': [INSTRUCTIONS] Full tool configuration for a repository. Requires toolUuid from codacy_tools.repo_tools. Common mistakes: (1) Using the tool name instead of toolUuid. (2) Enabling useConfigurationFile without having a config file in the repository — this will cause the tool to use no patterns. For enabling/disabling specific patterns, use codacy_tools.update_patterns instead. This action is idempotent — safe to retry.

Configure a tool for a repository — enable/disable the tool, set configuration file usage, and configure individual patterns with parameters.. Requires: toolUuid [DESTRUCTIVE]

• 'get_pattern': [INSTRUCTIONS] Global pattern definition — does NOT require authentication. Returns the pattern description, category, severity, and recommended status. Common mistake: confusing patternId with toolUuid — patternId identifies a specific rule (e.g., ESLint_no-unused-vars), toolUuid identifies the tool. Both are required.

Get the definition of a specific code pattern.. Requires: toolUuid, patternId

• 'list': [INSTRUCTIONS] Global catalog of available analysis tools — does NOT require authentication. This returns tool names and UUIDs. Use the toolUuid when configuring tools for a specific repository with codacy_tools.configure or codacy_tools.repo_patterns.

List all analysis tools available in Codacy (ESLint, PMD, Semgrep, etc.).

• 'repo_patterns': List code patterns for a specific tool in a repository with their enabled/disabled status.. Requires: toolUuid

• 'repo_tools': List tools configured for a specific repository with their enabled/disabled status.

• 'update_patterns': [INSTRUCTIONS] Enable or disable specific patterns. Requires toolUuid from codacy_tools.repo_tools. Common mistakes: (1) Not listing current patterns first — use codacy_tools.repo_patterns to see current state before making changes. (2) Using patternId from a different tool. For enabling/disabling the entire tool, use codacy_tools.configure instead. This action is idempotent — safe to retry.

Enable or disable specific code patterns for a tool in a repository.. Requires: toolUuid, patternsJson [DESTRUCTIVE] [Cache-Control: no-store]