codacy

Glossary: See glossary.md for shared definitions of Codacy concepts (issues, findings, severity, coverage, tools, patterns, etc.).

Codacy provides two CLI tools:

• Analysis CLI (codacy-analysis): Runs static analysis locally without pushing code to Codacy Cloud
• Cloud CLI (codacy): Queries remote Codacy data (repositories, issues, PRs, security findings)

Both share credentials at ~/.codacy/credentials. Logging in with either CLI applies to both.

When to Use

• User wants to analyze code locally without pushing to Codacy Cloud
• Need to run CLI-based linting (ESLint, Ruff, Semgrep, RuboCop)
• Scanning staged changes or setting up local Codacy tooling
• User wants to check code quality metrics on Codacy Cloud
• Need to inspect remote PR analysis results or browse vulnerabilities
• Enabling/disabling tools or searching patterns on Codacy Cloud
• Even if they just say "run codacy" or "check code quality"

Setup

# Install Analysis CLI (local analysis)
npm i -g @codacy/analysis-cli

# Install Cloud CLI (remote queries)
npm install -g @codacy/codacy-cloud-cli

# Verify
codacy-analysis --help
codacy --help

Authentication (optional for local, required for cloud)

# Option 1: Interactive login (shared by both CLIs)
codacy login

# Option 2: Token flag
codacy login --token <your-api-token>

# Option 3: Environment variable
export CODACY_API_TOKEN=<your-api-token>

# Obtain tokens: Codacy > My Account > Access Management
# Remove credentials
codacy logout

Shared session: Both CLIs share ~/.codacy/credentials. Logging in/out with either applies to both.

Local Analysis (Analysis CLI)

The Analysis CLI (codacy-analysis) runs static analysis locally. It detects languages, selects tools, and reports issues — without pushing code to Codacy.

Always use --output-format json for structured output in agentic workflows.

Analysis Workflow

1. Initialize configuration
2. Inspect tool availability (dry-run)
3. Install missing dependencies
4. Run analysis
5. Interpret results