What is Custom Rule Authoring?

Every codebase has rules no vendor ships: use this internal HTTP client, never call that deprecated helper, all handlers must check this permission. Custom rules turn tribal knowledge and repeated review comments into automated checks.

The deciding factor is authoring cost. A rule language you can write in an afternoon gets used; one requiring a compiler plugin and a week of study does not, however powerful it is.

Top 19 Custom Rule Authoring tools

Every tool in the directory documented as supporting Custom Rule Authoring, 16 fully, 3 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

1. 1
   CodacyQuality PlatformTeam

   Custom scan rules, patterns and org-wide coding standards via UI or .codacy.yml.

2. 2
   ChatGPT / CodexAgent Coding ToolPlus

   Nested AGENTS.md '## Code Review Rules', custom review instructions, --scan-prompt-file, knowledge-base docs.

3. 3
   Checkmarx OneCode Security Platform

   SAST Query Editor/Auditor writes and edits queries with an AI Query Builder GPT; custom presets for SAST and IaC.

4. 4
   Claude CodeAgent Coding Tool

   REVIEW.md, hierarchical CLAUDE.md, and up to 50 custom regex patterns in security-patterns.yaml.

5. 5
   CodeAnt AIPR Review

   Custom review rules, code review instructions, agent personas and global repository configuration

6. 6
   CodeRabbitPR ReviewPro

   ast-grep YAML rules and shareable packages; natural-language Custom Checks require Pro+

7. 7
   CorgeaCode Security PlatformScale

   PolicyIQ UI or corgea.yaml policies; YAML needs Scale/Enterprise; Custom Rules named at Scale

8. 8
   Cursor (Bugbot)PR ReviewPro

   Team Rules, .cursor/BUGBOT.md, learned rules and glob-scoped manual rules merged by precedence.

9. 9
   Gemini Code AssistAgent Coding ToolGating not documented (preview)

   Natural-language styleguide.md in .gemini/, per repository or managed across repos from Cloud console.

10. 10
    GitHub Advanced SecurityCode Security PlatformAdd-on: Code Security and Secret Protection (free on public repos for CodeQL)

    Custom CodeQL query suites and packs, model packs (preview), custom secret patterns, custom auto-triage rules

11. 11
    GreptilePR Review

    Dashboard rules plus .greptile/ folder (config.json, rules.md, files.json) and legacy greptile.json

12. 12
    QltyQuality PlatformFree (CLI)

    ast-grep and Semgrep YAML rules plus ripgrep regex checks, with qlty.toml triage overrides

13. 13
    QodoPR ReviewPro-Teams

    Natural-language Review Standards, best_practices.md, pr_compliance_checklist.yaml, REVIEW.md

14. 14
    SemgrepCode Security Platform

    YAML pattern rules in web Editor or locally, tested with ruleid:/ok: annotations; CE includes custom rules.

15. 15
    SnykCode Security PlatformIgnite

    Snyk Code sanitizer Rule Extensions, IaC custom-rule SDK, custom secret regex; custom rules need Ignite or Enterprise.

16. 16
    VeracodeCode Security Platformadd-on

    Buyers author custom regex secret rules plus Rego container and IaC policies.

17. 17
    CodeSceneQuality PlatformPartialFree (open source) / standard

    Customizable Code Health rules, custom quality gates and thresholds; no rule-authoring language or custom checks documented

18. 18
    DeepSourceQuality PlatformPartial

    No custom rule authoring documented; third-party SARIF analyzers plug in via the Community Analyzer framework.

19. 19
    SonarQubeQuality PlatformPartialTeam

    Custom quality profiles configure language rule sets on Team and Enterprise; authoring new rules not documented.

What to look for

• The rule language and how steep the learning curve really is
• Whether rules live in your repository and go through code review
• Testing support for rules before rolling them out
• Whether custom rules are available on your plan tier

Related terms

FAQ