What are quality gates?

A gate is what turns advice into policy. Implemented as a required status check, it stops a merge when a condition fails: a new critical vulnerability, coverage below threshold on new code, a license violation.

Gates only survive if they are trusted. A gate that fires on false positives gets bypass permissions handed out within a month, at which point it is theater, so tune the threshold before enforcing it, not after.

What to look for

Granularity, by severity, issue type or repository
New-code-only conditions so legacy debt does not block delivery
Documented, audited bypass process for genuine emergencies
How the gate behaves when the scan itself fails or times out

Best 18 code quality, security and code review tools with quality gates

Every tool in the directory whose documentation covers this, 16 fully and 2 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

Status checks and merge gate enforcement; GitLab merge request approval rules

AI Coding Agent

ChatGPT / Codex

Codex Security --fail-on-severity fails the CI step; Codex Action can gate merges.

Code Security Platform

Checkmarx One

Policies can 'Break the Build' on violation; Protected Branches patterns govern which branches trigger scans and gates.

Code Quality Platform

Codacy

Merge gates enforce quality, coverage and security thresholds via branch protection.

PR Review Tool

CodeAnt AI

Quality gates enforce standards before merge; auto-approve PR for trusted changes

PR Review Tool

CodeRabbit

Pre-merge checks in error mode block merges via Request Changes Workflow; custom checks Pro+

Code Quality Platform

CodeScene

Custom quality gates plus goal-violation and code-health-decline detection via GitHub Checks API and CI

Code Security Platform

Corgea

Blocks GitHub/Azure/Harness merges, or CI via --block-on; Blocking Rules at Scale

PR Review Tool

Cursor (Bugbot)

Status check can fail on unresolved issues to block merges; defaults to neutral otherwise.

Code Quality Platform

DeepSource

Quality Gates fail checks on category, severity, or metric thresholds; AI Review status can be a required check.

Code Security Platform

GitHub Advanced Security

'Require code scanning results' and 'Require code quality results' rulesets; dependency review fail-on-severity

Code Quality Platform

Qlty

Quality Gate commit statuses for issues, total coverage and diff coverage feed GitHub branch protection

Code Security Platform

Semgrep

Block mode fails CI (exit code 1); remediation policies block merge; developer exception approval flow.

Code Security Platform

Snyk

PR checks set SCM status and GitLab MR pipeline status; severity and fixability failure conditions.

Code Quality Platform

SonarQube

Quality gates block PRs and branches via status checks; custom gates require Team or Enterprise.

Code Security Platform

Veracode

Veracode checks configurable as required status checks; --fail_on_severity/--fail_on_cwe break builds

PR Review Tool

Greptile

statusCheck posts a review status check on GitHub, GitLab, Bitbucket and Gitea; no fail criteria documented.

PR Review Tool

Qodo

Compliance labels such as 'Failed compliance check' must be wired into CI actions to block merges

Real-Time IDE Feedback AI Agent Guardrails Local Analysis (Pre-Commit)Inline PR Comments Full Repo Scan Scheduled Rescans

FAQ