Codacy

Codacy is a code quality and security platform for engineering teams, running static analysis, SAST and AI pull request review on GitHub, GitLab and Bitbucket.

Codacy catches bugs, security flaws and style drift in source code before a pull request is merged, whether a person or a coding agent wrote it. The Lisbon company of the same name has developed it since 2012 and remains independent. Its aim is one set of coding standards, applied the same way in the editor, in the pull request and across every repository an organisation owns. Code Quality analysis reports issues, duplication and complexity on each commit and pull request. It runs on code patterns that teams switch on or off per repository. The Security module covers SAST, SCA for dependencies, hardcoded secrets and infrastructure-as-code misconfigurations, with DAST, license scanning and container image scanning beside them. Coverage takes test reports from the build and tracks coverage on new code, and quality gates turn those results into a status check that can block a merge. AI Reviewer adds AI-enhanced comments and fix suggestions to the pull request, while AI Guardrails runs the same checks inside IDEs and coding agents, and AI Risk Hub sets policies against risks such as unapproved models and invisible prompt injections. Codacy suits engineering managers and platform leads who want one rule set enforced on every repository without wiring a separate tool into each pipeline. Security leads see SAST, dependency and secrets findings next to code quality results. Individual developers can start with the IDE plugin before their team connects a git host. Organisations with compliance needs can use SSO/SAML, audit logs and Codacy Self-hosted on their own Kubernetes cluster. Open-source maintainers use it to hold outside contributions to a project's own standards. Findings first appear in VS Code, JetBrains IDEs or Cursor as the developer types, so an issue can be fixed before the commit. When the pull request opens on GitHub, GitLab or Bitbucket, Codacy reports its status to the git host and comments on the new issues it finds. Security findings can become Jira tickets, and critical security alerts can reach a Slack channel. Engineering leads then follow trends across teams and projects to decide which repositories need cleanup next.