Security

Read-only agent access with explicit authorization boundaries.

9to5 coverage processes coverage reports, serves tightly scoped metadata through MCP, and reports results to GitHub without becoming part of your source-code hosting path.

GitHub App permissions

The integration uses metadata read and pull requests read to identify repositories and changes, checks read/write to publish results, issues read/write for PR comments, and actions read to download coverage artifacts. Review the permissions shown by GitHub when installing the app.

Upload tokens

Upload tokens authenticate CI uploads. Repository tokens can be rotated from repository settings, and organization tokens simplify shared CI setup.

Coverage data

Coverage uploads are parsed into project, patch, and file-level results. Keep the original reports in CI: the free preview does not include a guaranteed retention period.

Billing data

The current preview is free and does not require a credit card or paid subscription.

MCP OAuth

Remote MCP clients use Authorization Code with PKCE S256, one-hour opaque access tokens, rotating 30-day refresh tokens, exact redirect URIs, and the single coverage:read scope.

Revocable API tokens

API-token secrets are displayed once. Only a prefix and SHA-256 digest are stored; every call rechecks expiry, revocation, organization membership, and optional repository scope. Coverage-upload tokens are rejected at MCP.

Coverage metadata, not source

MCP tools are read-only and return summaries, line numbers, hit states, ranges, and comparisons. They do not fetch or return repository source, write tests, or modify GitHub.