Codacy
Code quality and security platform aggregating third-party analyzers across 40+ languages, with SAST, SCA, secrets, coverage and a free IDE extension.
Deployment
Cloud
Languages
51+
Pricing model
Per developer seat, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Codacy operates.
8 yes
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | Guardrails extension for VS Code, Cursor, Windsurf, JetBrains; scans offline, syncs org config. |
| AI Agent Guardrails | Yes | MCP integration scans AI-generated code for Copilot, Cursor, Windsurf, Claude; AI can auto-remediate. |
| Local Analysis (Pre-Commit) | Yes | Codacy Analysis CLI runs static analysis fully locally, no API round-trip; pre-commit hook not confirmed. |
| Inline PR Comments | Yes | Inline PR comments and status checks on GitHub, GitLab merge requests, Bitbucket PRs. |
| Quality Gates (Merge Blocking) | Yes | Merge gates enforce quality, coverage and security thresholds via branch protection. |
| Full Repo Scan | Yes | Unlimited cloud scans with no pipeline integration required; full scan within minutes of signup. |
| Scheduled Rescans | Yes | Daily proactive SCA and malicious-package re-scans without new commits; Business plan only. |
| Runtime Monitoring | Yes | DAST scans deployed web apps and APIs on a schedule; Business plan only. |
Security scanning
10 yes 3 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Bandit, Checkov, Clang-Tidy, Gosec, Opengrep, SpotBugs across 20+ security categories. |
| Taint Analysis (Data-Flow) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Secrets Detection | Yes | Opengrep and Trivy detect 50+ secret patterns in code, IaC and config files. |
| Secrets Validation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SCA | Yes | Trivy scans 12+ package ecosystems with dependency-chain visualization and CVE/GHSA/CVSS metadata. |
| Reachability Analysis | Yes | Affected-functions analysis AI-checks whether vulnerable dependency code is actually used. |
| Malicious Package Detection | Yes | Cross-references OpenSSF database for typosquatting and supply-chain compromise; daily rescans Business only. |
| License Compliance | Yes | SPDX identification with allowlists, blocklists, category policies and license inventory reporting. |
| SBOM Generation | Yes | SBOM exports available as a compliance feature; Business plan only. |
| IaC Scanning | Yes | Checkov, Hadolint, Spectral cover Terraform, CloudFormation, Kubernetes, Dockerfile, Helm, GitHub Actions, Ansible. |
| Container Scanning | Yes | Container image scanning included; Business plan only, scanner and scope not named. |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | Yes | OWASP ZAP integration scans web apps, OpenAPI, GraphQL, REST APIs; Business plan only. |
Code quality
6 yes 1 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Ten issue categories including code style, comprehensibility, documentation, best practice, unused code. |
| Complexity Metrics | Yes | Cyclomatic complexity via Lizard and detekt; feeds the repository A-F grade. |
| Duplication Detection | Yes | PMD CPD, jscpd, PHPCPD and Flay with cloning reports; feeds the grade. |
| Dead Code Detection | Yes | Dedicated unused-code issue category; deadcode and aligncheck analyzers. |
| Test Coverage Tracking | Yes | Coverage Reporter CLI ingests Cobertura, JaCoCo, lcov, Clover, Istanbul and 8 more formats. |
| Diff Coverage (New Code) | Yes | Diff coverage of newly added or modified lines on PRs, commits and dashboard. |
| Architecture Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Technical Debt Quantification | Partial | Grade A-F and issues-per-kLoC trending only; no remediation-time or cost debt model described. |
| Behavioral Code Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI review & fixes
2 yes 3 partial
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Partial | AI Reviewer (Google Gemini) checks PR changes against the PR description and linked Jira ticket for logic gaps; currently GitHub only. |
| PR Summaries & Walkthroughs | Partial | AI-generated issue summaries and remediation suggestions on PRs; no change-by-change walkthrough described. |
| Autofix Suggestions | Yes | One-click and batch fixes for ESLint, Opengrep, markdownlint; free IDE autofix for four languages. |
| Autofix Pull Requests | Partial | MCP lets AI assistants auto-remediate flagged code; no autofix pull-request creation described. |
| AI Triage (False-Positive Filtering) | Yes | AI scores false-positive likelihood with reasoning; opt-in, enabled via support request. |
Rules & repo support
1 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Custom scan rules, patterns and org-wide coding standards via UI or .codacy.yml. |
| Monorepo Support | No | Not supported. Direct confirmation from Codacy that monorepos are not supported. |
AI capabilities
5 yes 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | AI Reviewer (GitHub) combines static analysis with Gemini contextual review using PR, Jira, history context. |
| Bring Your Own Model | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| MCP Server | Yes | MCP integration for Copilot, Cursor, Windsurf, Claude Code and Claude.ai; included free. |
| AI Code Governance | Yes | AI Inventory, AI Risk Hub and org-wide AI Coding Policies govern AI-generated code; Business plan. |
| Conversational Review | Yes | Codacy findings surfaced in the IDE AI chat panel for context-aware discussion; Team and Business. |
| Learning From Feedback | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Code Excluded From Training | Yes | AI Reviewer uses enterprise Gemini instances; code not used for training, secrets redacted, prompts not stored. |
Models used
OpenAI GPT (AI-enhanced PR comments on GitLab/Bitbucket)Google Gemini (AI Reviewer for GitHub, enterprise-grade instances)
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Org-wide event audit logs with CSV/JSON/API export and 90+ day retention; Business plan only. |
| SSO (SAML) | Yes | SAML 2.0 with Okta, Azure AD, Google Workspace and JIT provisioning; Business plan only. |
| Role-Based Access Control | Yes | Owner, Admin, Manager, Developer, Read-only roles; 'advanced RBAC' listed as Business. |
| Compliance Reporting & Exports | Yes | Compliance-ready SBOM and audit-trail exports on Business; CSV/JSON finding exports available on Team. |
Certifications
SOC 2 Type 2GDPRCCPAISO 27001
Standards mapping
OWASP Top 10 (DAST scan profile)SPDX License ListCVE/GHSA identifiers with CVSS scores
Integrations
7 yes 3 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | No |
| Bitbucket | Yes |
| Bitbucket Data Center | No |
| Azure DevOps | No |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub ActionsGitLab CI/CDCircleCIJenkinsAzure PipelinesTravis CIBitbucket PipelinesDrone CIGoCDBambooTeamCityAppVeyorCirrus CIBuildkiteany HTTP/webhook-compatible systemcustom pipelines via REST API
IDEs
Visual Studio CodeCursorWindsurfIntelliJ IDEAPyCharmWebStormGoLandCLionRiderRubyMineDataGripPhpStormAppCodeAndroid StudioVim/Neovim (plugin)Emacs (plugin)GitHub Codespaces
Issue trackers
Jira CloudJira Server (8.0+)
Chat & notifications
Slack (public, private channels and DMs; immediate, daily or weekly digest)Mattermost (webhooks)Email (daily/weekly digests, critical alerts)Generic webhooks
Languages
Languages and frameworks named in Codacy's documentation.
ApexAsyncAPIAWS CloudFormationAzure Resource Manager TemplatesCC++C#CoffeeScriptCrystalCSSDartDockerfileElixirFlutterGitHub ActionsGoGroovyHelmJavaJavaScriptJSONJSPKotlinKubernetesLessMarkdownObjective-COpenAPIPHPPL/SQLPostgreSQLPowerShellPythonRubyRustSassScalaServerless FrameworkShellSwiftSQLTerraformTransact-SQLTypeScriptUnityVelocityVisual BasicVisualforceXMLXSLYAML
Pricing & plans
$18/dev/month billed annually ($216/dev/year) ($21/dev/month if billed monthly)
Minimum seats: None — no minimum seats; Team plan capped at 30 developers (Business required above that)
Trial: 14 days, no credit card required, full access to Team plan features (extended trial offered on Business)
Developer$0 (free forever)Individual developers, open-source maintainers, students, hobby projects
- Guardrails IDE extension, unlimited, with real-time SAST, secrets, dependency, complexity and duplication scanning
- Works offline with periodic org config sync
- Auto-fix on demand for JavaScript, TypeScript, Python, Java
- MCP integration with Copilot, Cursor and Claude
- Free forever for open-source projects
- IDE-only: no cloud platform access
- No PR analysis, merge gates, dashboards or API/CLI
- Language coverage for this IDE-only plan is not separately documented and may be narrower than the platform's
Team$18/dev/month annual ($216/dev/year) or $21/dev/month monthlyModern teams up to 30 developers; growing teams, startups, mid-size companies
- Full cloud platform with unlimited pipeline-less scans, 54 tools and 12,000+ scan rules
- SAST, secrets, IaC, SCA of new code, malicious package detection, license scanning
- AI Reviewer (GitHub), AI PR comments (GitLab/Bitbucket), smart false-positive triage
- Merge gates for quality, coverage and security; test coverage tracking
- GitHub/GitLab/Bitbucket, 2-way Jira, Slack; REST API v2/v3 and CLI
- Org-wide Security & Risk Management Dashboard and shared coding standards
- Maximum 30 developers (Business plan required above that)
- Up to 100 private repos (unlimited LOC); unlimited public repos
- No DAST, container scanning, audit logs, SSO/SAML, SBOM export or data residency
- Standard email and in-app chat support only
BusinessCustom pricing (contact sales)Large enterprises and regulated industries (FinTech, HealthTech, Defense) with 100+ developers
- DAST (web, API, GraphQL), container image scanning, penetration testing integration
- Daily proactive SCA and malicious-package re-scans
- Audit logs, SBOM exports, GitHub Enterprise Cloud data residency (EU/US)
- AI Inventory, AI Risk Hub and org-wide AI Coding Policies
- SSO/SAML 2.0, advanced RBAC, static IP allowlisting, session management
- Dedicated CSM and Solutions Engineer, priority screen-share support, AI-generated custom reports
- Quote-only, no published price
- Custom Business agreements may carry longer-term contracts
- Everything in this tier is unavailable on Team, including SSO/SAML and audit logs
Who it's for
Best for teams that want AI code review, code quality and code security from one configuration, without setting up CI.
Team plan positioned for teams up to 30 developers; Business plan for enterprise scale of 100+ developers.
A good fit if
- You want quality, security, coverage and AI review results from one setup across 40+ languages
- Your developers use AI coding agents and you want free IDE guardrails for the code they write
- You want pricing per developer, with no scan or line-of-code limits
Consider alternatives if
- You must self-host or run air-gapped
- Your code is in Azure DevOps Repos
- You need SSO, audit logs or SBOM export on a self-serve plan
Similar tools
Other Code Quality Platform tools in the directory.
CodeSceneBehavioral code analysis platform scoring Code Health, hotspots, knowledge distribution and delivery risk from version-control history.DeepSourceStatic analysis and code security platform that reviews every commit and PR, with an AI review agent and Autofix remediation.QltyGitHub-only static analysis, security scanning and code coverage platform, split between a free open-source CLI and hosted Qlty Cloud.SonarQubeCode quality and security analysis platform for 40+ languages, delivered as SonarQube Cloud SaaS or self-managed SonarQube Server.
FAQ
When should you choose Codacy?
Codacy is best for teams that want AI code review, code quality and code security from one configuration, without setting up CI. It's a good fit if:
- You want quality, security, coverage and AI review results from one setup across 40+ languages
- Your developers use AI coding agents and you want free IDE guardrails for the code they write
- You want pricing per developer, with no scan or line-of-code limits
Consider alternatives if:
- You must self-host or run air-gapped
- Your code is in Azure DevOps Repos
- You need SSO, audit logs or SBOM export on a self-serve plan
What languages does Codacy support?
Codacy supports 51+ languages and frameworks, including Apex, AsyncAPI, AWS CloudFormation, Azure Resource Manager Templates, C, C++, C#, CoffeeScript, Crystal, CSS, and 41 more.
What does Codacy integrate with?
Codacy integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab and Bitbucket
- CI systems: GitHub Actions, GitLab CI/CD, CircleCI, Jenkins, Azure Pipelines and 9 more, plus others through its CLI or API
- IDEs: VS Code, Cursor, Windsurf, IntelliJ IDEA, PyCharm and 12 more
What tools are similar to Codacy?
Other code quality platforms tracked here:
What are Codacy's plans and pricing?
Codacy has a free plan, and paid plans start at $18/dev/mo. Enterprise pricing is by quote.
Opens www.codacy.com in a new tab. Review Radar is published by Codacy.