What is custom rule authoring?

Every codebase has rules no vendor ships: use this internal HTTP client, never call that deprecated helper, all handlers must check this permission. Custom rules turn tribal knowledge and repeated review comments into automated checks.

Authoring cost largely decides whether custom rules get written. A rule language you can learn in an afternoon tends to get used; one requiring a compiler plugin and a week of study is used less, even though it can express checks a simpler language cannot.

What to look for

The rule language and how steep the learning curve really is
Whether rules live in your repository and go through code review
Testing support for rules before rolling them out
Whether custom rules are available on your plan tier

Best 19 code quality, security and code review tools with custom rules

Every tool in the directory whose documentation covers this, 16 fully and 3 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

AI Coding Agent

ChatGPT / Codex

Nested AGENTS.md '## Code Review Rules', custom review instructions, --scan-prompt-file, knowledge-base docs.

Code Security Platform

Checkmarx One

SAST Query Editor/Auditor writes and edits queries with an AI Query Builder GPT; custom presets for SAST and IaC.

AI Coding Agent

Claude Code

REVIEW.md, hierarchical CLAUDE.md, and up to 50 custom regex patterns in security-patterns.yaml.

Code Quality Platform

Codacy

Custom scan rules, patterns and org-wide coding standards via UI or .codacy.yml.

PR Review Tool

CodeAnt AI

Custom review rules, code review instructions, agent personas and global repository configuration

PR Review Tool

CodeRabbit

ast-grep YAML rules and shareable packages; natural-language Custom Checks require Pro+

Code Security Platform

Corgea

PolicyIQ UI or corgea.yaml policies; YAML needs Scale/Enterprise; Custom Rules named at Scale

PR Review Tool

Cursor (Bugbot)

Team Rules, .cursor/BUGBOT.md, learned rules and glob-scoped manual rules merged by precedence.

AI Coding Agent

Gemini Code Assist

Natural-language styleguide.md in .gemini/, per repository or managed across repos from Cloud console.

Code Security Platform

GitHub Advanced Security

Custom CodeQL query suites and packs, model packs (preview), custom secret patterns, custom auto-triage rules

PR Review Tool

Greptile

Dashboard rules plus .greptile/ folder (config.json, rules.md, files.json) and legacy greptile.json

Code Quality Platform

Qlty

ast-grep and Semgrep YAML rules plus ripgrep regex checks, with qlty.toml triage overrides

PR Review Tool

Qodo

Natural-language Review Standards, best_practices.md, pr_compliance_checklist.yaml, REVIEW.md

Code Security Platform

Semgrep

YAML pattern rules in web Editor or locally, tested with ruleid:/ok: annotations; CE includes custom rules.

Code Security Platform

Snyk

Snyk Code sanitizer Rule Extensions, IaC custom-rule SDK, custom secret regex; custom rules need Ignite or Enterprise.

Code Security Platform

Veracode

Buyers author custom regex secret rules plus Rego container and IaC policies.

Code Quality Platform

CodeScene

Customizable Code Health rules, custom quality gates and thresholds; no rule-authoring language or custom checks documented

Code Quality Platform

DeepSource

No custom rule authoring documented; third-party SARIF analyzers plug in via the Community Analyzer framework.

Code Quality Platform

SonarQube

Custom quality profiles configure language rule sets on Team and Enterprise; authoring new rules not documented.

Monorepo Support

FAQ