Qlty

A VS Code extension is referenced only in Qlty's migration-comparison table; no IDE documentation exists

CLI acts as agent quality gate via CLAUDE.md, AGENTS.md, copilot-instructions.md, git hooks and agent hooks.

Open-source CLI runs qlty check and qlty fmt locally, wired as pre-commit and pre-push git hooks

Qlty Cloud posts inline comments (max 50 per PR) plus a summary comment grouped by check

Quality Gate commit statuses for issues, total coverage and diff coverage feed GitHub branch protection

qlty check --all locally; Cloud analyzes the whole default branch on a schedule

Default branch re-analyzed every 24 hours by default, frequency configurable, plus manual builds

Not offered in vendor documentation reviewed as of 2026-09-05.

Semgrep plus Bandit, Brakeman, PMD, radarlint analyzers and ESLint security rules

Not offered in vendor documentation reviewed as of 2026-09-05.

Gitleaks and TruffleHog plugins detect API keys, passwords and other committed secrets

Not offered in vendor documentation reviewed as of 2026-09-05.

OSV-Scanner and Trivy cover npm, Maven, PyPI, NuGet, Conan, CocoaPods and Swift ecosystems

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Trivy, Checkov, Hadolint, ShellCheck, TFLint, KubeLinter over Terraform, CloudFormation, Dockerfiles, Helm, Kubernetes

Dockerfile linting via Hadolint and Trivy misconfiguration checks; no container image vulnerability scanning

Built-in Code Smells (Structure and Duplication) plus 70+ linter plugins across 14 documented languages

First-party cognitive complexity engine plus cyclomatic complexity at file, directory and project level

Rust/Tree-sitter fingerprinting engine detects identical and similar duplication, largest-match wins

dead_code issue category; Knip plugin for unused JavaScript and TypeScript code

qlty coverage publish accepts lcov, cobertura, clover, jacoco, simplecov, coverprofile and a generic JSONL format

Diff Coverage is the primary quality gate, with configurable minimum and minimum diff size

Components (path-glob groupings) and Applications aggregate metrics; no dependency or layering rule enforcement

Effort in remediation minutes, Technical Debt total, and Technical Debt Ratio using the COCOMO model

Hotspot score combines file change frequency with code interconnectedness to rank risky files.

Summary comment lists new issues grouped by check and coverage per file; no AI narrative walkthrough

ast-grep and Semgrep YAML rules plus ripgrep regex checks, with qlty.toml triage overrides

Single-line Autofixes as GitHub suggestions; opt-in AI Autofixes via OpenAI, and qlty check --fix locally

Manual triage rules and ignore reasons; aggregated non-identifying data trains smart issue prioritization and grouping

Sandboxed per-plugin installs, prefix/package_file scoping, directory-scoped triage, differential analysis, directory-level UI

LLM powers opt-in AI autofixes and AI issue explanations alongside deterministic linter analysis.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

False-positive ignore reasons are recorded; aggregated issue data trains issue prioritization and grouping.

Business customers' code is never trained on absent explicit opt-in; individual and open-source code may be.

Audit logs listed as Enterprise-only on the pricing comparison table

GitHub OAuth SSO only; no SAML, no password storage, no other identity providers documented

'Custom permissions' (RBAC) is Enterprise-only on the pricing comparison table

qlty check --sarif output and raw coverage data download; no compliance or audit report exports