Remote MCP · read only

Connect Codex, Claude, and other coding agents to coverage.

The 9to5 MCP server gives agents exact coverage summaries, uncovered changed lines, comparisons, and regressions. It returns stored coverage metadata only; source stays in the agent's local checkout.

https://coverage.9to5.software/mcp

OAuth — recommended

Standards-aware clients discover the authorization server automatically. Sign in with the existing GitHub identity, review the read-only consent screen, and grant coverage:read. Access tokens last one hour; refresh tokens rotate and last up to 30 days.

API token — explicit fallback

Create a token in MCP settings. Select every currently accessible repository or a narrower list. The secret is shown once, expires after 90 days by default, and can be revoked at any time.

Client setup

Copy-ready configurations

Codex with OAuth

Add this to ~/.codex/config.toml, then authorize: 

[mcp_servers.9to5_coverage]
url = "https://coverage.9to5.software/mcp"
codex mcp login 9to5_coverage

API-token alternative

[mcp_servers.9to5_coverage]
url = "https://coverage.9to5.software/mcp"
bearer_token_env_var = "NINE_TO_FIVE_COVERAGE_TOKEN"

Claude Code

Register the Streamable HTTP endpoint, then complete OAuth when prompted: 

claude mcp add --transport http 9to5-coverage https://coverage.9to5.software/mcp

Claude browser connector

Open Settings → Connectors → Add custom connector, enter the endpoint above, then authorize the connection. Organization policy may require an administrator to approve custom connectors.

Recommended agent workflow

  1. 1

    Resolve

    Use list_repositories if owner/name is not already known.

  2. 2

    Inspect the PR

    Call get_pr_coverage before requesting line detail.

  3. 3

    Prioritize

    Paginate get_uncovered_changed_lines and inspect source locally.

  4. 4

    Verify

    Rerun tests, upload coverage, then check regressions and patch coverage.

Tool contracts

Eight focused coverage queries

Every repository-bound tool takes repository as owner/name. Optional format resolves multi-format uploads explicitly.

list_repositories

Discover authorized repositories with search and cursor pagination.

list_coverage_runs

List summaries filtered by branch, PR, commit prefix, or format.

get_pr_coverage

Latest PR project, patch, baseline, conclusions, and changed files.

get_uncovered_changed_lines

Exact uncovered changed lines grouped into contiguous ranges.

get_file_coverage

File totals and covered/uncovered ranges for a commit and optional bounds.

compare_coverage

Project/file deltas; with path, exact line-state changes.

get_coverage_regressions

Only regressions against the exact persisted PR baseline.

get_test_suggestions_context

Hit states around up to 200 lines; no source and no invented tests.

Selectors and pagination

  • Commit selectors are exact SHAs or unique prefixes of at least seven characters.
  • Pages default to 100 items and accept at most 250.
  • Use the returned signed opaque next_cursor unchanged.
  • Results are capped at 32 KiB and report truncated.
  • Lines and counts are integers; percentages are JSON numbers; times are ISO 8601.

Recoverable errors

repository_not_found_or_forbidden coverage_run_not_found baseline_unavailable ambiguous_format invalid_selector invalid_cursor

A missing and unauthorized repository deliberately return the same error. Never guess a baseline: upload the matching base commit/format and retry.

Security and privacy

Tools are annotated read-only, idempotent, non-destructive, and closed-world. 9to5 checks organization membership and token repository scope on every call, validates Origin, limits request and response sizes, and rate-limits by credential and IP. Telemetry records tool name, timing, credential type, and status—not tokens, source, or line payloads.