Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add d-o-hub/github-template-ai-agents --skill codacygit clone --depth 1 https://github.com/d-o-hub/github-template-ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/d-o-hub/github-template-ai-agents/codacy)<a href="https://agentmods.dev/skills/d-o-hub/github-template-ai-agents/codacy"><img src="https://agentmods.dev/badge/skills/d-o-hub/github-template-ai-agents/codacy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/d-o-hub/github-template-ai-agents/codacy"><img src="https://agentmods.dev/badge/skills/d-o-hub/github-template-ai-agents/codacy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01506 |
| Opus 5.5 | $0.00048 | $0.00602 |
| Sonnet 5.5 | $0.00024 | $0.00301 |
| Haiku 4.5 | $0.00012 | $0.00151 |
Grade A, and why
codacy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Glossary: See glossary.md for shared definitions of Codacy concepts (issues, findings, severity, coverage, tools, patterns, etc.).
Codacy provides two CLI tools:
- Analysis CLI (
codacy-analysis): Runs static analysis locally without pushing code to Codacy Cloud - Cloud CLI (
codacy): Queries remote Codacy data (repositories, issues, PRs, security findings)
Both share credentials at ~/.codacy/credentials. Logging in with either CLI applies to both.
When to Use
- User wants to analyze code locally without pushing to Codacy Cloud
- Need to run CLI-based linting (ESLint, Ruff, Semgrep, RuboCop)
- Scanning staged changes or setting up local Codacy tooling
- User wants to check code quality metrics on Codacy Cloud
- Need to inspect remote PR analysis results or browse vulnerabilities
- Enabling/disabling tools or searching patterns on Codacy Cloud
- Even if they just say "run codacy" or "check code quality"
Setup
# Install Analysis CLI (local analysis)
npm i -g @codacy/analysis-cli
# Install Cloud CLI (remote queries)
npm install -g @codacy/codacy-cloud-cli
# Verify
codacy-analysis --help
codacy --help
Authentication (optional for local, required for cloud)
# Option 1: Interactive login (shared by both CLIs)
codacy login
# Option 2: Token flag
codacy login --token <your-api-token>
# Option 3: Environment variable
export CODACY_API_TOKEN=<your-api-token>
# Obtain tokens: Codacy > My Account > Access Management
# Remove credentials
codacy logout
Shared session: Both CLIs share ~/.codacy/credentials. Logging in/out with either applies to both.
Local Analysis (Analysis CLI)
The Analysis CLI (codacy-analysis) runs static analysis locally. It detects languages, selects tools, and reports issues — without pushing code to Codacy.
Always use --output-format json for structured output in agentic workflows.
Analysis Workflow
1. Initialize configuration
2. Inspect tool availability (dry-run)
3. Install missing dependencies
4. Run analysis
5. Interpret results
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 985 B
- references/analysis-files.md 390 B
- references/analysis-init.md 4.6 KB
- references/analysis-interpret.md 1.0 KB
- references/analysis-logs.md 0 B
- references/analysis-run.md 2.6 KB
- references/analysis-troubleshooting.md 1.7 KB
- references/analysis-workflows.md 1.9 KB
- references/cloud-commands.md 8.3 KB
- references/cloud-workflows.md 807 B
- references/config-format.md 1.0 KB
- references/glossary.md 1.1 KB
- references/output-format.md 925 B
- references/supported-tools.md 1.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 195 lines · 120 tokens per session scan A 66c626d8796a
codacy is a skill published in the GitHub repository d-o-hub/github-template-ai-agents (2 stars, last pushed yesterday), licensed MIT. It adds 120 tokens to every session and 1,506 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
slopmop
Trigger when you would normally reach for pytest, gh, mypy, black, or other raw repo tooling. Redirect to sm swab, sm scour, sm buff, sm sail, sm refit, or sm doctor so remediation follows the established rails. Also trigger when asked to "install" or "set up" slop-mop in a repo, or when you find a repo with sm…
performance-patterns
Use when user asks about N+1 queries, performance optimization, query optimization, reduce API calls, improve render performance, fix slow code, optimize database, or reduce bundle size. Provides guidance on identifying and fixing performance anti-patterns across database, backend, frontend, and API layers.
codebase-refactoring
Three-part workflow to improve overall codebase health with jscpd — find and fix duplicated code, find and remove or refactor dead code, then find and simplify the largest/most complex files. Starts from --dashboard/--health to prioritize and ends by re-measuring the score.
report-issue-local
File a bug or feature request against this MCP server's own repo. Use for server-specific issues — tool logic, service integrations, config problems, or domain bugs that aren't caused by the framework.
dorodango
Polishes working code through successive quality passes in fresh subagents. Use after tests pass when code needs multi-dimension refinement before release.
ring:searching-code
Forensic code search and analysis with optional Chain of Draft (CoD) ultra-concise mode. Five-phase methodology (clarification, planning, execution, analysis, synthesis) with severity assessment. Use for targeted investigation of specific patterns, bugs, or vulnerabilities. Skip for broad architecture mapping (use…