Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Coverity MCP Server List all Coverity projects"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A TypeScript Model Context Protocol (MCP) server that connects AI agents to Black Duck Coverity Connect for static analysis defect management.
Give your AI coding assistant direct access to Coverity projects, streams, and defect data — so it can find issues, understand their root cause via event traces, and fix them in your codebase.
List projects — browse all Coverity projects you have access to
List streams — view analysis streams, optionally filtered by project
Search issues — find defects by stream with filters for checker, impact, status, and pagination
Get issue details — retrieve full defect info including the event trace (code path leading to the defect) and triage data
Two transport modes — stdio for Claude Desktop / CLI, HTTP for web-based integrations
Related MCP server: Polarion MCP Server
Node.js >= 20.11.0
Access to a Coverity Connect instance with REST API enabled
A Coverity authentication key (generated from your Coverity Connect user settings)
git clone https://github.com/baxishrey/Coverity-MCP-Server-Typescript.git
cd Coverity-MCP-Server-Typescript
npm install
npm run buildCreate a .env file from the example:
cp .env.example .envEdit .env with your Coverity Connect credentials:
COVERITY_HOST=coverity.example.com
COVERITY_PORT=8443
COVERITY_SSL=true
COVERITY_USER=your_username
COVERITY_AUTH_KEY=your_auth_keyRun the server:
npm start # stdio transport (default)
npm run start:http # HTTP transport on port 3000Add this to your claude_desktop_config.json:
{
"mcpServers": {
"coverity": {
"command": "node",
"args": ["/path/to/Coverity-MCP-Server-Typescript/build/index.js"],
"env": {
"COVERITY_HOST": "coverity.example.com",
"COVERITY_PORT": "8443",
"COVERITY_SSL": "true",
"COVERITY_USER": "your_username",
"COVERITY_AUTH_KEY": "your_auth_key"
}
}
}
}For HTTP transport mode, use the MCP endpoint URL instead:
{
"mcpServers": {
"coverity": {
"type": "http",
"url": "http://localhost:3000/mcp"
}
}
}list_projectsList all Coverity projects the authenticated user can access.
Parameters: none
Returns: project name, key, description, and associated streams.
list_streamsList Coverity streams, optionally filtered by project name.
Parameter | Type | Required | Description |
| string | no | Filter streams by project name |
Returns: stream name, language, description, and parent project.
search_issuesSearch for static analysis defects in a Coverity stream.
Parameter | Type | Required | Description |
| string | yes | Stream name or ID to search in |
| string | no | Filter by checker (e.g. |
| string | no | Filter by impact: |
| string | no | Filter by status: |
| number | no | Max results, 1–200 (default 25) |
| number | no | Pagination offset (default 0) |
Returns: CID, checker, type, impact, status, file, and function for each defect.
get_issue_detailsGet full details for a specific defect, including the event trace that shows the code path leading to the issue.
Parameter | Type | Required | Description |
| number | yes | Coverity Issue ID |
| string | yes | Stream name or ID containing the issue |
Returns: complete defect information with triage data (action, classification, severity, owner) and event chain (step-by-step code path with file and line numbers).
coverity://server-infoRead-only resource showing the current Coverity server connection configuration (host, port, SSL, user). Does not expose the authentication key.
A code agent using this server would typically:
list_projects — discover available projects
list_streams — find the relevant stream for the codebase
search_issues — find defects (filter by impact: "High" for critical ones)
get_issue_details — get the event trace for a specific defect
Read the source file at the reported location and apply a fix based on the event trace
Variable | Required | Default | Description |
| yes | — | Coverity Connect server hostname |
| no |
| Server port |
| no |
| Use HTTPS |
| yes | — | Username |
| yes | — | Authentication key |
| no |
| Transport mode: |
| no |
| HTTP server port (only with |
npm run dev # run from source without compiling
npm run build # compile TypeScript → build/
npm test # run tests
npm run lint # type-check without emittingsrc/
├── index.ts # Entry point
├── server/boot.ts # MCP server init, transport selection
├── registry/ # Auto-discovers modules in tools/resources/prompts
├── client/coverity-client.ts # Coverity REST API client
├── tools/ # MCP tool implementations
│ ├── list-projects.ts
│ ├── list-streams.ts
│ ├── search-issues.ts
│ └── get-issue-details.ts
└── resources/
└── server-info.ts # Server connection info resourceCreate a file in src/tools/ — it will be auto-discovered at startup:
import { z } from "zod";
import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import type { RegisterableModule } from "../registry/types.js";
export default {
type: "tool",
name: "my-tool",
description: "Does something useful",
register(server: McpServer) {
server.tool("my_tool", "Description", {
param: z.string().describe("A parameter"),
}, async ({ param }) => {
return { content: [{ type: "text", text: `Result: ${param}` }] };
});
},
} satisfies RegisterableModule;MIT
Get full details for a Coverity defect by CID, including the event trace (code path that leads to the defect), triage information, and file/line details useful for resolving the issue.
| Name | Required | Description | Default |
|---|---|---|---|
| cid | Yes | The Coverity Issue ID (CID) | |
| streamId | Yes | The stream name or ID containing the issue |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It transparently details the return content (event trace, triage info, file/line details) and the 'Get' wording signals a read-only operation. It doesn't explicitly state non-modification or error behavior, but for a getter this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-structured sentence that leads with the action and resource, then adds meaningful specifics. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two required parameters and no output schema, the description covers the tool's purpose and expected return fields well. It doesn't mention related tools or potential errors, but the essentials for correct invocation and result understanding are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters already described ('The Coverity Issue ID (CID)' and 'The stream name or ID containing the issue'). The tool description adds no parameter-specific meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Get full details for a Coverity defect by CID', and enumerates what's included (event trace, triage information, file/line details). This distinguishes it from siblings like search_issues, which would locate issues rather than fetch full detail for one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys clear use context: call this when you have a specific CID and want comprehensive defect detail. It doesn't explicitly exclude alternatives or state when to prefer search_issues, but the intent is clear from the wording.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all Coverity projects the authenticated user can access
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the operation is a read-only listing and importantly scopes results to what the authenticated user can access, which is meaningful authorization context. However, it doesn't mention pagination, ordering, or response format behavior — leaving an agent to guess at the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero wasted words. The verb and resource are front-loaded, and the access-scoping qualifier adds the only needed nuance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema listing tool, the description covers the essential operational context: what is listed and under what authorization scope. The only gaps are response format and pagination details, which are minor for such a simple read-only tool and could plausibly follow conventional list semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, which sets the baseline at 4 per the rubric since there is nothing for the description to explain. The empty schema is fully covered at 100%, and the description correctly avoids fabricating parameter details that don't exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), a distinct resource ('Coverity projects'), and a precise scope ('the authenticated user can access'). This clearly distinguishes it from siblings that target different resources: list_streams targets streams, while get_issue_details and search_issues target issues. An agent can select this tool without opening any schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear — this is the tool for enumerating all projects visible to the authenticated user, and the resource distinction from siblings (streams vs. issues) makes the use case apparent. However, it doesn't explicitly state when not to use it or name an alternative, so it misses the top bar for explicit when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List Coverity streams for the configured project.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of explaining behavior. 'List' implies a read-only enumeration operation, but the description does not explicitly mention lack of side effects, authentication requirements, or what happens if no project is configured. It is adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the action, the object, and the scope in under ten words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list operation, the description is nearly sufficient. It would be more complete with an explicit note about what is returned (e.g., stream names and metadata), but the lack of parameters and straightforward intent keep the gap small.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema is trivially complete and there is nothing for the description to add. A baseline of 4 is appropriate because no parameter ambiguity exists.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('Coverity streams') scoped to 'the configured project'. This clearly distinguishes it from siblings like list_projects, get_issue_details, and search_issues by identifying a distinct domain object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for the configured project' provides clear context for when this tool applies, and the contrast with sibling names makes its role evident. However, it does not explicitly state when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search for static analysis defects in the configured Coverity project. Returns CID, checker, file, function, impact, and status for each issue.
| Name | Required | Description | Default |
|---|---|---|---|
| cid | No | Filter by specific CID (Coverity Issue ID) | |
| limit | No | Maximum number of results (default 25, max 200) | |
| impact | No | Filter by impact: High, Medium, or Low | |
| offset | No | Pagination offset (default 0) | |
| status | No | Filter by status: New, Triaged, Fixed, Dismissed | |
| checker | No | Filter by checker name (e.g. RESOURCE_LEAK, NULL_RETURNS) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It states the search scope, that it returns results per issue, and the specific fields provided, which strongly implies a read-only search operation. It does not mention pagination, sorting, or failure behavior, but these are secondary for a read-only query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler. The first sentence states the action and scope; the second lists the return fields. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the six optional parameters, the 100% schema coverage, and the lack of an output schema, the description provides sufficient context to call the tool correctly, especially with its list of returned fields. Minor omissions — such as explicit guidance about sibling tools or project configuration prerequisites — prevent a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters (cid, limit, impact, offset, status, checker) are already documented in the schema. The description adds no parameter-level semantics, but it is not required to because the schema fully covers them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Search'), the resource ('static analysis defects in the configured Coverity project'), and the returned fields (CID, checker, file, function, impact, status). This distinguishes it from sibling tools like list_projects and get_issue_details, though it does not explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is used when searching for static-analysis defects, but it gives no explicit guidance on when to prefer it over get_issue_details or when to use alternatives. There are no stated exclusions or prerequisites, leaving usage somewhat to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0get_issue_detailslist_projectslist_streamssearch_issuesEach tool targets a distinctly different resource or level of detail: projects vs streams vs issue summaries vs full issue detail. There is no meaningful overlap between the tools.
All tool names use a consistent lowercase snake_case verb_noun pattern: list_projects, list_streams, get_issue_details, search_issues. The verbs map predictably to the action being performed.
Four tools is a reasonable, focused set for a read-only Coverity query server. Each tool serves a necessary step in navigating from projects and streams down to specific defect details.
The tool set covers the core read-only workflow: identify project, identify stream, search defects, and view full issue details. Minor gaps exist, such as no triage update or project/stream detail endpoints, but they do not block the primary use case.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
A TypeScript MCP server for Home Assistant, enabling programmatic management of entities, automati…
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/baxishrey/Coverity-MCP-Server-Typescript'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
