# Codacy

> Use Codacy static analysis CLIs to query PR analysis, triage issues, suppress false positives, and run local analysis. Use when Codacy blocks a PR, when asked to fix Codacy issues, suppress false positives, query PR quality data, or integrate Codacy into CI/CD workflows. Also use when the user mentions "Codacy", "static analysis check", "code quality gate", or "Codacy is failing".

- **Type:** Skill
- **Install:** `agentstack add skill-d-oit-rust-2026-template-codacy`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [d-oit](https://agentstack.voostack.com/s/d-oit)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [d-oit](https://github.com/d-oit)
- **Source:** https://github.com/d-oit/rust-2026-template/tree/main/.agents/skills/codacy
- **Website:** https://d-oit.github.io/rust-2026-template/

## Install

```sh
agentstack add skill-d-oit-rust-2026-template-codacy
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Codacy Static Analysis

## When to Use

- User asks for this skill's functionality

Orchestrate static analysis using Codacy Analysis CLI (local) and Codacy Cloud CLI (remote).

## Installation & Auth

```bash
# Analysis CLI (for local runs)
npm i -g @codacy/analysis-cli

# Cloud CLI (for PR data and suppressions)
npm i -g @codacy/codacy-cloud-cli

export CODACY_API_TOKEN=
```

## PR Triage Workflow

1. **Get PR analysis**:
   `codacy pull-request gh    --output json > /tmp/codacy-pr.json`

2. **Categorize issues**:
   - False positives → Suppress via Cloud CLI.
   - Real issues → Fix in code.

3. **Suppress false positives**:
   `codacy pull-request gh    --ignore-issue  --ignore-reason FalsePositive`
   *Note: Use numeric `resultDataId`, NOT hash IDs.*

4. **Fix issues**: Batch fix patterns and verify with local lint/tests.

## Local Analysis

```bash
# Initialize configuration (generates .codacy.yml)
codacy-analysis init --default

# Run local analysis
codacy-analysis analyze --pr --output-format json
```

## Known Limitations

| Tool Category | Status | Note |
|---------------|--------|------|
| JS/TS/Shell | ✅ Works | ESLint9, Stylelint, ShellCheck |
| Rust | ⚠️ Limited | Local analysis uses `jscpd` and `Lizard`; Cloud uses `Opengrep` |
| Python/Ruby | ❌ Fails | Missing runtimes/venv issues |
| Java/PMD | ❌ Fails | Missing Java runtime |

Always cross-reference with Cloud CLI for full PR data.

## Rationalizations

| Rationalization | Reality |
|-----------------|---------|
| "Local analysis shows 0 issues, so we are good." | Analysis CLI has limited local tool support; Cloud CLI is the source of truth. |
| "I'll use the issue hash for suppression." | Codacy CLI requires the numeric `resultDataId` for suppressions. |

## Red Flags

- [ ] Relying solely on local `codacy-analysis` for Rust/Python/Java projects.
- [ ] Attempting to suppress issues without a valid `--ignore-reason`.
- [ ] Ignoring the `resultDataId` field in JSON output in favor of hashes.

## References

- `references/config-format.md` - `.codacy.yml` schema and advanced options
- `references/output-format.md` - JSON schema for PR analysis
- `references/supported-tools.md` - Local vs Cloud tool availability

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [d-oit](https://github.com/d-oit)
- **Source:** [d-oit/rust-2026-template](https://github.com/d-oit/rust-2026-template)
- **License:** MIT
- **Homepage:** https://d-oit.github.io/rust-2026-template/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-d-oit-rust-2026-template-codacy
- Seller: https://agentstack.voostack.com/s/d-oit
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.