Security

Read-only agent access with explicit authorization boundaries.

9to5 coverage processes coverage reports, serves tightly scoped metadata through MCP, and reports results to GitHub without becoming part of your source-code hosting path.

GitHub App permissions

The GitHub App is used to discover installed repositories, create checks, and update pull request feedback.

Upload tokens

Upload tokens authenticate CI uploads. Repository tokens can be rotated from repository settings, and organization tokens simplify shared CI setup.

Coverage data

Coverage uploads are parsed into project, patch, and file-level results. Retention limits will be tied to the selected plan.

Billing data

Payment processing will be handled by our payment processor. The app will store subscription state and payment references, not card details.

MCP OAuth

Remote MCP clients use Authorization Code with PKCE S256, one-hour opaque access tokens, rotating 30-day refresh tokens, exact redirect URIs, and the single coverage:read scope.

Revocable API tokens

API-token secrets are displayed once. Only a prefix and SHA-256 digest are stored; every call rechecks expiry, revocation, organization membership, and optional repository scope. Coverage-upload tokens are rejected at MCP.

Coverage metadata, not source

MCP tools are read-only and return summaries, line numbers, hit states, ranges, and comparisons. They do not fetch or return repository source, write tests, or modify GitHub.