This guide explains the comprehensive Codecov integration for the CyberChef MCP Server project, including Coverage Analytics, Bundle Analysis, and Test Analytics.
The CyberChef MCP Server uses Codecov for three main purposes:
- Coverage Analytics - Track code coverage over time and enforce minimum thresholds
- Bundle Analysis - Monitor bundle size changes and detect regressions
- Test Analytics - Track test performance, flaky tests, and execution time
- GitHub repository with Actions enabled
- Codecov account connected to GitHub
CODECOV_TOKENconfigured in GitHub Secrets (Actions)
The main Codecov configuration file defines coverage thresholds, status checks, and reporting options.
Location: /codecov.yml
Key settings:
- Coverage precision: 2 decimal places
- Project coverage target: 70% minimum
- Patch coverage target: 75% minimum (higher bar for new code)
- Coverage range: Red below 70%, yellow 70-90%, green above 90%
- Threshold: Allow 1% decrease without failing
Flags:
mcp-tests- MCP server and library testscore-tests- Core operation testsnode-api- Node.js API tests
Components:
mcp-server- MCP server implementationcore-operations- CyberChef operationsnode-api- Node.js API wrapper
Path exclusions:
- Web UI (
src/web/**) - Vendor code (
src/core/vendor/**) - Legacy operations (
src/core/operations/legacy/**) - Test files (
tests/**,**/*.test.mjs) - Configuration files (
**/*.config.{js,mjs})
Vitest test runner configuration for coverage generation and test reporting.
Location: /vitest.config.mjs
Coverage settings:
- Provider: V8 (fast, accurate)
- Reporters: text, lcov, json, html
- Reports directory:
./coverage - Thresholds: 70% lines, 70% functions, 65% branches, 70% statements
Test reporting:
- Reporters: default, junit
- JUnit output:
./test-results/junit.xml
CI/CD workflow that uploads coverage and test results to Codecov.
Location: .github/workflows/core-ci.yml
Codecov integration steps:
-
MCP Tests with Coverage - Run tests and generate coverage reports
npm run test:coverage
-
Upload Coverage to Codecov - Upload coverage data
- uses: codecov/codecov-action@v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage/lcov.info flags: mcp-tests name: codecov-mcp-coverage
-
Upload Test Results to Codecov - Upload JUnit XML for Test Analytics
- uses: codecov/test-results-action@v1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./test-results/junit.xml flags: mcp-tests name: codecov-test-results
-
Build Production Bundle - Trigger bundle analysis
- name: Build Production Bundle env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} run: npm run build
Webpack configuration with Codecov bundle analysis plugin.
Location: /Gruntfile.js
Bundle analysis configuration:
codecovWebpackPlugin({
enableBundleAnalysis: process.env.CODECOV_TOKEN !== undefined,
bundleName: "cyberchef-mcp-bundle",
uploadToken: process.env.CODECOV_TOKEN,
gitService: "github",
dryRun: process.env.CODECOV_TOKEN === undefined,
})Behavior:
- Enabled only when
CODECOV_TOKENis set (CI environment) - Dry run mode for local development
- Uploads bundle stats to Codecov automatically during production build
Generate coverage reports locally:
npm run test:coverageOutputs:
coverage/lcov.info- LCOV format for Codecovcoverage/coverage-final.json- JSON formatcoverage/index.html- HTML report (open in browser)test-results/junit.xml- JUnit XML test results
Open the HTML coverage report:
# Linux
xdg-open coverage/index.html
# macOS
open coverage/index.html
# Windows
start coverage/index.htmlBuild production bundle (triggers bundle analysis in CI):
npm run buildLocal behavior:
- Bundle analysis runs in dry-run mode (no upload)
- Webpack Bundle Analyzer generates
build/prod/BundleAnalyzerReport.html
Coverage, test results, and bundle analysis are automatically uploaded to Codecov when:
- Code is pushed to master - Full CI run with all analytics
- Pull requests are created - Coverage diff and bundle size comparison
- Tags are pushed - Release builds include all metrics
Codecov provides status checks on pull requests:
- Project Coverage - Overall project coverage vs. target (70%)
- Patch Coverage - Coverage of changed lines vs. target (75%)
- Bundle Size - Bundle size change vs. base branch
Codecov automatically comments on pull requests with:
- Coverage summary (project and patch)
- Files with coverage changes
- Coverage trends
- Bundle size changes
Visit the Codecov dashboard for comprehensive analytics:
- Coverage trends - Historical coverage data
- File browser - Line-by-line coverage visualization
- Pull requests - Coverage impact of PRs
- Flags - Coverage by test type (mcp-tests, core-tests, node-api)
- Components - Coverage by component (mcp-server, core-operations, node-api)
- Bundle analysis - Bundle size trends and composition
- Test analytics - Test performance, flaky tests, slowest tests
- Lines - Percentage of executed lines
- Functions - Percentage of called functions
- Branches - Percentage of executed conditional branches
- Statements - Percentage of executed statements
Problem: Coverage reports not appearing in Codecov
Solutions:
- Verify
CODECOV_TOKENis set in GitHub Secrets - Check workflow logs for upload errors
- Verify coverage files exist (
coverage/lcov.info) - Ensure workflow uses
codecov/codecov-action@v5
Problem: CI fails due to coverage below thresholds
Solutions:
- Add tests to increase coverage
- Adjust thresholds in
vitest.config.mjs(not recommended) - Exclude files from coverage in
vitest.config.mjs(use sparingly)
Problem: Bundle size data not appearing in Codecov
Solutions:
- Verify
CODECOV_TOKENis available during build step - Check Gruntfile.js for correct plugin configuration
- Ensure production build is triggered in workflow
- Verify webpack build completes successfully
Problem: Test results not appearing in Codecov
Solutions:
- Verify JUnit XML file is generated (
test-results/junit.xml) - Check workflow uses
codecov/test-results-action@v1 - Ensure tests run before upload step
- Verify
if: always()condition on upload step
Purpose: Authentication token for Codecov uploads
Configuration:
- GitHub Actions: Set in repository secrets (Settings → Secrets → Actions)
- Local development: Not required (dry-run mode)
Security:
- Never commit token to repository
- Never log token in CI output
- Rotate token if compromised
- Write tests first - TDD approach ensures high coverage
- Focus on critical paths - Prioritize coverage of core functionality
- Avoid coverage gaming - Don't write tests just to hit numbers
- Review uncovered lines - Understand why code isn't tested
- Monitor trends - Watch for unexpected size increases
- Review large changes - Investigate PRs with significant bundle growth
- Optimize dependencies - Remove unused or replace large dependencies
- Code splitting - Split large bundles into smaller chunks
- Fix flaky tests - Unstable tests reduce confidence
- Optimize slow tests - Improve CI performance
- Track trends - Monitor test suite health over time
- Investigate failures - Understand test failure patterns
- Codecov Documentation
- Codecov YAML Reference
- GitHub Actions Integration
- Bundle Analysis
- Test Analytics
For issues with Codecov integration:
- Check Codecov Support
- Review GitHub Actions logs
- Verify configuration files are valid
- Contact Codecov support for platform issues