Qlty
GitHub-only static analysis, security scanning and code coverage platform, split between a free open-source CLI and hosted Qlty Cloud.
Deployment
Cloud · Self-Hosted (partial)
Languages
15+
Pricing model
Per contributing developer
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Qlty operates.
6 yes 2 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | No | A VS Code extension is referenced only in Qlty's migration-comparison table; no IDE documentation exists |
| AI Agent Guardrails | Yes | CLI acts as agent quality gate via CLAUDE.md, AGENTS.md, copilot-instructions.md, git hooks and agent hooks. |
| Local Analysis (Pre-Commit) | Yes | Open-source CLI runs qlty check and qlty fmt locally, wired as pre-commit and pre-push git hooks |
| Inline PR Comments | Yes | Qlty Cloud posts inline comments (max 50 per PR) plus a summary comment grouped by check |
| Quality Gates (Merge Blocking) | Yes | Quality Gate commit statuses for issues, total coverage and diff coverage feed GitHub branch protection |
| Full Repo Scan | Yes | qlty check --all locally; Cloud analyzes the whole default branch on a schedule |
| Scheduled Rescans | Yes | Default branch re-analyzed every 24 hours by default, frequency configurable, plus manual builds |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
4 yes 1 partial 8 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Semgrep plus Bandit, Brakeman, PMD, radarlint analyzers and ESLint security rules |
| Taint Analysis (Data-Flow) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Secrets Detection | Yes | Gitleaks and TruffleHog plugins detect API keys, passwords and other committed secrets |
| Secrets Validation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SCA | Yes | OSV-Scanner and Trivy cover npm, Maven, PyPI, NuGet, Conan, CocoaPods and Swift ecosystems |
| Reachability Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Malicious Package Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| License Compliance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SBOM Generation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| IaC Scanning | Yes | Trivy, Checkov, Hadolint, ShellCheck, TFLint, KubeLinter over Terraform, CloudFormation, Dockerfiles, Helm, Kubernetes |
| Container Scanning | Partial | Dockerfile linting via Hadolint and Trivy misconfiguration checks; no container image vulnerability scanning |
| CSPM | No | |
| DAST | No |
Code quality
8 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Built-in Code Smells (Structure and Duplication) plus 70+ linter plugins across 14 documented languages |
| Complexity Metrics | Yes | First-party cognitive complexity engine plus cyclomatic complexity at file, directory and project level |
| Duplication Detection | Yes | Rust/Tree-sitter fingerprinting engine detects identical and similar duplication, largest-match wins |
| Dead Code Detection | Yes | dead_code issue category; Knip plugin for unused JavaScript and TypeScript code |
| Test Coverage Tracking | Yes | qlty coverage publish accepts lcov, cobertura, clover, jacoco, simplecov, coverprofile and a generic JSONL format |
| Diff Coverage (New Code) | Yes | Diff Coverage is the primary quality gate, with configurable minimum and minimum diff size |
| Architecture Governance | Partial | Components (path-glob groupings) and Applications aggregate metrics; no dependency or layering rule enforcement |
| Technical Debt Quantification | Yes | Effort in remediation minutes, Technical Debt total, and Technical Debt Ratio using the COCOMO model |
| Behavioral Code Analysis | Yes | Hotspot score combines file change frequency with code interconnectedness to rank risky files. |
AI review & fixes
1 yes 2 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | No | |
| PR Summaries & Walkthroughs | Partial | Summary comment lists new issues grouped by check and coverage per file; no AI narrative walkthrough |
| Autofix Suggestions | Yes | Single-line Autofixes as GitHub suggestions; opt-in AI Autofixes via OpenAI, and qlty check --fix locally |
| Autofix Pull Requests | No | |
| AI Triage (False-Positive Filtering) | Partial | Manual triage rules and ignore reasons; aggregated non-identifying data trains smart issue prioritization and grouping |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | ast-grep and Semgrep YAML rules plus ripgrep regex checks, with qlty.toml triage overrides |
| Monorepo Support | Yes | Sandboxed per-plugin installs, prefix/package_file scoping, directory-scoped triage, differential analysis, directory-level UI |
AI capabilities
3 yes 4 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | LLM powers opt-in AI autofixes and AI issue explanations alongside deterministic linter analysis. |
| Bring Your Own Model | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| MCP Server | No | |
| AI Code Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Conversational Review | No | |
| Learning From Feedback | Yes | False-positive ignore reasons are recorded; aggregated issue data trains issue prioritization and grouping. |
| Code Excluded From Training | Yes | Business customers' code is never trained on absent explicit opt-in; individual and open-source code may be. |
Compliance & governance
2 yes 2 partial
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Audit logs listed as Enterprise-only on the pricing comparison table |
| SSO (SAML) | Partial | GitHub OAuth SSO only; no SAML, no password storage, no other identity providers documented |
| Role-Based Access Control | Yes | 'Custom permissions' (RBAC) is Enterprise-only on the pricing comparison table |
| Compliance Reporting & Exports | Partial | qlty check --sarif output and raw coverage data download; no compliance or audit report exports |
Certifications
SOC 2 Type II
Integrations
3 yes 1 partial 6 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | No |
| GitLab | No |
| GitLab Self-Managed | No |
| Bitbucket | No |
| Bitbucket Data Center | No |
| Azure DevOps | No |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Partial |
CI/CD systems
GitHub Actions (with OIDC)CircleCI (official Orb)Travis CIGitLab CIBuildkiteJenkinsBitriseSemaphoreCodefreshany CI provider meeting CLI system requirements
IDEs
Visual Studio Code
Issue trackers
GitHub Issues
Languages
Languages and frameworks named in Qlty's documentation.
CC++C#GoJavaJavaScriptKotlinPHPPythonRubyRustScalaSwiftTypeScriptVB.NET
Pricing & plans
$20/contributor/month billed annually ($24/contributor/month if billed monthly)
Minimum seats: None stated (volume discounts: 5% off at 100+ seats, 10% off at 200+ seats, annual only)
Trial: No trial period documented; the free-forever Free plan (unlimited repos & contributors) is the no-cost entry point
Free$0/monthThe best linting and auto-formatting for your PR workflow
- Linting & auto-formatting
- Code coverage
- Maintainability & duplication
- Security scanning (SAST, SCA), secrets scanning, IaC security, custom checks
- Open, extensible Rust CLI
- Unlimited public/private repositories and contributors
- 1,000 analysis minutes/month
- 100 AI autofixes/month
- Community support
- No accelerated analysis, REST API, monorepo support or trends/hotspots
- No custom permissions or audit logs
- Community support only
Pro$20/contributor/month billed annually ($24/contributor/month if billed monthly)Your complete, AI-powered code health platform
- Everything from Free plus:
- Shared configurations
- Trends & hotspots (1 year of history)
- Accelerated analysis
- REST API
- 20,000 analysis minutes/month
- 5,000 AI autofixes/month
- Web-based (email) support
- No monorepo support, custom permissions or audit logs (Enterprise only)
- 1 year of trend history vs 3 years on Enterprise
Enterprise$30/contributor/month billed annually ($36/contributor/month if billed monthly)Advanced capabilities for large organizations
- Everything from Pro plus:
- Monorepo support (per pricing page feature table)
- Advanced analytics, 3 years of trend history, hotspots
- Organization policies, custom permissions (RBAC), audit logs
- Priority support with SLA, Slack support, named account manager
- 75,000 analysis minutes/month
- Manual/invoiced billing available at $10k+ annual spend
- Additional analysis minutes at $0.01/minute pay-as-you-go
- Volume discounts (5%/10%) only apply to annual purchases of 100+/200+ seats
- Custom terms available only above $40k annual spend; no minimum seat count published otherwise
Who it's for
Best for GitHub teams that want one configuration for linting, security scanning and coverage, with the same checks locally and in CI.
A good fit if
- Your code is on GitHub
- You want the same checks on a developer's machine, in git hooks and in CI
- You want published self-serve pricing on every plan
Consider alternatives if
- Your code is on GitLab, Bitbucket or Azure DevOps
- You need an AI reviewer or PR walkthroughs
- You need SAML SSO
Similar tools
Other Code Quality Platform tools in the directory.
CodacyCode quality and security platform aggregating third-party analyzers across 40+ languages, with SAST, SCA, secrets, coverage and a free IDE extension.CodeSceneBehavioral code analysis platform scoring Code Health, hotspots, knowledge distribution and delivery risk from version-control history.DeepSourceStatic analysis and code security platform that reviews every commit and PR, with an AI review agent and Autofix remediation.SonarQubeCode quality and security analysis platform for 40+ languages, delivered as SonarQube Cloud SaaS or self-managed SonarQube Server.
FAQ
When should you choose Qlty?
Qlty is best for GitHub teams that want one configuration for linting, security scanning and coverage, with the same checks locally and in CI. It's a good fit if:
- Your code is on GitHub
- You want the same checks on a developer's machine, in git hooks and in CI
- You want published self-serve pricing on every plan
Consider alternatives if:
- Your code is on GitLab, Bitbucket or Azure DevOps
- You need an AI reviewer or PR walkthroughs
- You need SAML SSO
What languages does Qlty support?
Qlty supports 15+ languages and frameworks, including C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, and 5 more.
What does Qlty integrate with?
Qlty integrates with:
- Source control: GitHub
- CI systems: GitHub Actions, CircleCI, Travis CI, GitLab CI/CD, Buildkite and 4 more, plus others through its CLI or API
- IDEs: VS Code
What tools are similar to Qlty?
Other code quality platforms tracked here:
What are Qlty's plans and pricing?
Qlty has a free plan, and paid plans start at $20/contributor/mo.
Opens qlty.sh in a new tab. Review Radar is not affiliated with Qlty Software.