Codacy

Codacy posts status checks, summaries, annotations and review comments on pull requests in GitHub, GitLab and Bitbucket cloud, creates Jira tickets from findings and imports Jira issues labeled security each day, sends critical alerts to Slack and fires outbound webhooks. Inside a buyer's coding agent, the MCP server and the Cloud CLI let the agent set up repositories, change tools and patterns and ignore issues through Codacy's own API. On GitHub, the app reads repository contents without write access to code.

Sourcedocs.codacy.com/repositories-configure/integrations/github-integrationread 2026-11-08

Codacy supplies the steps and the buyer's agent runs the loop. Guardrails instructs the coding agent to analyze each change, fix what the scan finds and analyze again, and the review skill chains both CLIs into a fix, dismiss and rescan cycle that ends when the check passes. Gate policies apply the same thresholds across an organization, and the auto configure agent runs as a queued job with time and usage caps. Codacy itself plans no multistep coding work and splits none across agents.

Sourcedocs.codacy.com/codacy-guardrails/codacy-guardrails-how-to-useread 2026-11-08

AI Reviewer works from the pull request, the linked Jira ticket and its epic, Codacy's own findings and a review instructions file in the repository, and coding agents receive issues, security findings, DAST results and coverage gaps over MCP. Coding standards, gate policies and a configuration file synced from the cloud set the rules. That context is gathered for each run from the findings store, and no searchable index of the customer's code or documents sits behind it.

Sourcedocs.codacy.com/codacy-ai/codacy-airead 2026-11-08

AI features are switched on per organization or repository, admins decide which roles may configure patterns, ignore issues or files and reanalyze, and a coding agent can change Codacy settings only within its user's permission level. Suggested fixes wait for a developer to accept them, and quality gates stop a merge only when the team requires the status in its Git provider's branch protection. Verity's public beta blocks a Claude Code run that fails its checks at the end of the run, before a commit or before a push.

Sourcedocs.codacy.com/organizations/roles-and-permissions-for-organizationsread 2026-11-08

Codacy holds SOC 2 Type II and is GDPR compliant, with encryption at rest and in transit, a bug bounty and a trust center. Access follows the roles each person holds in GitHub, GitLab or Bitbucket plus an organization manager role, and admins set which roles may configure patterns, ignore issues or reanalyze. Business adds single sign on with SAML and audit logs, while Team signs in through the Git provider. AI features run on enterprise OpenAI models that keep no prompts and never train on customer code, with secrets redacted first.

Sourcecodacy.com/trust-centerread 2026-11-08

Business keeps a year of audit logs, open to admins and exportable through the API, recording whether each action came from the app or the API, what it was, who took it and the result. Dashboards track issues, security findings and coverage across repositories, a remediation report compares time to fix with SLA targets, and SBOM and AI Inventory exports list dependencies and the AI models and providers the code calls.

Sourcedocs.codacy.com/organizations/audit-logs-for-organizationsread 2026-11-08

AI Reviewer reads its own earlier comments on the same pull request when new commits arrive, so it does not repeat itself, ignored issues keep the reason a person gave across later analyses, and findings already triaged are not triaged again. Verity, in public beta, keeps a Markdown knowledge base in the repository for later agent runs. The main platform has no memory layer with a set scope, a lifetime and a way to clear it.

Sourcedocs.codacy.com/codacy-ai/codacy-airead 2026-11-08

The cloud service runs on AWS with customer data kept in Ireland and no region to choose. The Analysis CLI runs on a developer's machine or in CI, offline if needed, so code leaves only when results are uploaded, and Business supports GitHub Enterprise Cloud with data residency and a static IP. The self hosted edition on Kubernetes is no longer sold to new customers, and purchase also runs through AWS Marketplace.

Sourcedocs.codacy.com/codacy-analysis-cliread 2026-11-08

About 60 analysis tools and more than 12,000 scan rules come ready to switch on across roughly 49 languages, grouped into coding standards an organization applies to every repository. A built in gate policy and an AI policy ruleset for unapproved model calls, AI safety, secrets and dependencies sit beside them, and Codacy Skills package ready made review, fix and coverage setup workflows for Claude Code, Codex, Copilot and Gemini CLI.

Sourcedocs.codacy.com/getting-started/supported-languages-and-toolsread 2026-11-08

Every push and pull request reaches Codacy through Git provider webhooks. AI Reviewer runs on the first review and again on request or through an API call, dependencies are rescanned each day for new CVEs and container SBOMs every 24 hours, and an analysis completed event goes out by webhook. In the editor, Guardrails analyzes code each time the agent generates a file and resyncs configuration when a file is added, and the CLI runs from any CI pipeline.

Sourcedocs.codacy.com/codacy-ai/codacy-airead 2026-11-08

AI Reviewer, auto configure and AI enhanced comments run on OpenAI enterprise models, called directly or through Amazon Bedrock, though one Codacy page says AI Reviewer runs on Gemini, and customers cannot choose or route models or bring their own key. Guardrails runs inside the buyer's own coding agent on whatever model that agent uses, and Verity's reviewer is a separate OpenAI or Gemini model that Codacy picks.

Sourcedocs.codacy.com/codacy-ai/codacy-airead 2026-11-08

The v3 REST API takes account or project tokens in a header and covers repositories, issues, pull requests, coverage, security findings, audit logs and an endpoint that starts an AI review, with a Swagger reference. The Cloud CLI adds and removes repositories, links standards, toggles tools and patterns, ignores issues in bulk and uploads SBOMs. A local MCP server with 24 tools runs on an account token, mostly reading issues, findings, pull requests and coverage.

Sourcedocs.codacy.com/codacy-api/using-the-codacy-apiread 2026-11-08

Quality gates set thresholds on new issues, security issues, complexity, duplication, coverage change and coverage of the diff, and each pull request gets a pass or fail status that can block a merge or report green to a merge queue. AI Reviewer gives an overall verdict on each change, and Verity's public beta adds a pass or block verdict from a second model plus formal verification before a push, checking what a coding agent produced.

Sourcedocs.codacy.com/repositories-configure/adjusting-quality-gatesread 2026-11-08

Dynamic application scanning runs a ZAP based scanner that crawls the customer's web app, signs in through a login form and probes it for vulnerabilities, skipping logout and delete links and never submitting POST forms, with six targets by default. It is a scanner working through requests rather than an agent operating the interface, and no Codacy agent drives a browser or a desktop.

Sourcedocs.codacy.com/security/app-scanningread 2026-11-08