Codacy
Code quality and security platform with AI guardrails for AI-assisted engineering
💬 What is Codacy?
Codacy is a code quality and security platform that adds AI-driven review and policy enforcement to engineering workflows. It consolidates static analysis, secret scanning, software composition analysis, DAST, IaC scanning, and AI coding-policy checks into a single tool that plugs into Git, IDEs, and AI coding agents. It is built for fast-moving engineering teams that need to govern both human-written and AI-generated code without slowing delivery. Distinctive capabilities include AI Reviewer for pull-request feedback with auto-fix suggestions and Codacy Guardrails, which scans AI-generated code against organizational policies at the prompt level.
Who it's for
Best for: Engineering leaders and DevSecOps teams at fast-paced organizations that need to govern AI-assisted and human-written code at scale
- Reviewing AI-generated pull requests with automated, low-noise feedback
- Enforcing coding standards and security policies across hundreds of repositories
- Detecting secrets, SQL injections, and SAST issues pre-commit and at PR time
- Monitoring third-party dependencies for CVEs and supply-chain risk
- Generating audit-ready SBOMs and compliance evidence for SOC 2 and ISO 27001
Pros & cons
- Consolidates code quality, SAST, SCA, secrets, IaC, DAST, and AI policy checks in one platform
- 14-day free trial with no credit card required and full scans within minutes
- Used by 15,000+ organizations and 200,000+ developers
- Integrates with Git providers, IDEs, Jira, and Slack
- Compliance reporting covers SOC 2, ISO 27001, PCI DSS, HIPAA, HITRUST, and NIST SSDF
- Starting price and specific plan tiers are not published on the homepage
- Self-healing gates for Claude is listed as beta and may not be production-ready
- Full feature breadth may introduce setup overhead for smaller teams with simple needs
Key features
- AI Code Review with pull-request summaries, fix suggestions, and automated false-positive detection
- Codacy Guardrails that scan AI-generated code in IDEs and coding agents against defined policies
- AI Risk Hub for centralized AI coding policies covering unapproved models, prompt injection, and vulnerable training-data libraries
- Static Application Security Testing (SAST) across application and infrastructure code
- Software Composition Analysis (SCA) with daily CVE and malware rescans
- Secret scanning and hardcoded credential detection
- Infrastructure-as-code security scanning
- DAST runtime testing for apps and API endpoints
Pricing
Paid pricing from $18, free tier, free trial, enterprise on request. Plans: Free, Team, Business, Custom, Unlimited, Enterprise, Premium, Standard, Pro.
Confirm before buying.
💬 Community sentiment (from public reviews)
No third-party reviews found yet. Grade reflects our 30% verification confidence.
💬 Codacy user reviews (0)
Write a reviewNo reviews yet. Be the first to review!
Trust & safety
Badge for Codacy
OptionalListing is free and never requires a link. If codacy.com links back to this page, the listing earns Partner perks: a higher category rank, a Partner badge on its card, and an ad-free direct “Visit” link. Use any link attributes you like — rel="nofollow" is fine.
Frequently asked
Does Codacy support AI-generated code?
Yes. Codacy Guardrails scans AI-generated code at the prompt level inside IDEs and coding agents, and AI Reviewer provides pull-request feedback and auto-fix suggestions for code produced by humans or AI.
Which compliance frameworks are supported?
Codacy provides audit-ready reports and SBOMs for SOC 2, ISO 27001, PCI DSS, HIPAA, HITRUST, and NIST SSDF.
Is there a free trial?
Yes. Codacy offers a 14-day free trial with no credit card required, and full scans can run within minutes.