Codacy

Quality and security platform

Free tier + paidCode review, testing & securitycodacy.com

What it is

Combines static analysis across 49 languages with SAST, hardcoded-secret detection, dependency SCA, malicious-package checks and IaC scanning, plus test coverage tracking with merge gates. It runs as a hosted service over repository webhooks, so it needs no CI pipeline changes, and ships plugins for VS Code, JetBrains and Cursor.

Why it earns a slot

The coverage merge gate is the useful lever: it blocks a pull request when AI-written code arrives with no tests attached, which is the default state of nearly every vibe-coded feature.

Know before you commit

Enabling all default rule sets at once produces a huge first-run backlog of findings. Configure the rule set before inviting the rest of the team.

Field notes

0 from the community

Loading notes…

Field check

Unverified

Pricing snapshot

Developer IDE plugin free forever; free forever for open source projects; Team $18/dev/mo billed annually or $21 monthly, up to 30 devs; Business custom

Snapshots move fast — verify at checkout, and post a field note if it changed.

Drop into your Lovable chat

Evaluate Codacy (https://www.codacy.com) for this project, then use it only if it fits what we are already building.
Context: Quality and security platform. Combines static analysis across 49 languages with SAST, hardcoded-secret detection, dependency SCA, malicious-package checks and IaC scanning, plus test coverage tracking with merge gates. It runs as a hosted service over repository webhooks, so it needs no CI pipeline changes, and ships plugins for VS Code, JetBrains and Cursor.
Reviewer notes (general, not written for this codebase): The coverage merge gate is the useful lever: it blocks a pull request when AI-written code arrives with no tests attached, which is the default state of nearly every vibe-coded feature.
Watch out for: Enabling all default rule sets at once produces a huge first-run backlog of findings. Configure the rule set before inviting the rest of the team.
Pricing: Developer IDE plugin free forever; free forever for open source projects; Team $18/dev/mo billed annually or $21 monthly, up to 30 devs; Business custom
Rules: treat the notes above as background only. Do not assume a theme, style, layout or feature that is not already in this project — inspect the existing code first and ask me before changing visual direction.

/api/public/tools/codacy

Neighbourhood

How Codacy sits against the rest of the atlas — swaps, companions and the tools builders actually save alongside it.

Instead of thisDependabot Gitleaks Playwright Stagehand Storybook test runner Testing Library Trivy Vitest Aikido Security

Named in the wiringCursor

Also in Code review, testing & security

Aikido Security

aikido.dev

All-in-one AppSec scanner

Free tier + paidCode review, testing & security

Developer free forever: 2 users, 10 repos, 2 container images, 1 domain, 250k protected requests/mo, 10 AI autofixes/mo; Basic $300/mo base for 10 users and 100 repos; Pro $600/mo for 200 repos; Advanced $600/mo for 500 repos; Enterprise custom

Open dossier

Arcjet

arcjet.com

In-app rate limiting and bot defence

PaidCode review, testing & security

No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial

Open dossier

Bito

bito.ai

AI PR review agent

PaidCode review, testing & security

Team $12/seat/mo annually or $15 monthly; Professional $20/seat/mo annually or $25 monthly; both include 5,000 lines reviewed per seat per month, overage $5 per 1,000 lines; Enterprise custom; 14-day trial

Open dossier

Browserbase

browserbase.com

Hosted headless browser cloud

Free tier + paidCode review, testing & security

Free: 1 browser hour/mo; Developer $20/mo with 100 browser hours then $0.12/hr; Startup $99/mo with 500 hours then $0.10/hr; Scale custom with 250+ concurrent browsers

Open dossier