Iris Code
FeaturesPlaygroundMCPTeamsPricingDocs
Get Iris Code Free
Sign inGet Iris Code Free
Quality control for AI-assisted development

Keep AI-assisted code up to your standards.

Give coding agents your project rules, check every change independently, and stop work that falls below the standard before it reaches review. Local analysis runs without sending your source to Iris Code or another model.

Install for VS CodeInstall for JetBrains

Free file analysis - no account or configuration needed to start

cancel_order.tsiris code
src / checkout
session.ts94
handlers.ts88
cancel_order.ts72
legacy.ts61
migrate.ts38
38export async function cancelOrder(id: string) {
39 const token = "ghp_a83x0Pf2Le..."
Committed credential - GitHub token. Blocks the push.
40 const rows = await db.query("select * from o where id=" + id)
SQL built by concatenation. Complexity 14, limit 10.
41 console.log("cancelling", id) // debug output
42}
Health
72/ 100
-9 since last commit
Push blocked

2 blockers across 14 changed files.

pre-push hook - exit 1

Runs in the editors you already use. Understands the stack you already have.

VS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRider
VS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRiderVS CodeCursorWindsurfVSCodiumTraeIntelliJ IDEAWebStormPyCharmGoLandRider
TypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRust
TypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRustTypeScriptJavaScriptVueSvelteGoPythonRubyC#JavaRust
npmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargo
npmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargonpmGo modulesPyPIRubyGemsNuGetMavenGradleCargo
How it works

Set the standard once. Check it everywhere.

Start with immediate file feedback, choose the limits that fit your project, then use the same configuration in the editor, hooks, and CI.

  1. 01Measure

    See what needs attention.

    Open a file and Iris Code checks complexity, size, duplication, security patterns, and committed credentials on save. Every finding points back to a rule you can inspect.

    cancel_order.tsneeds work
    72/ 100
    complexity
    14 / 10
    functions
    6 / 8
    file length
    142 / 200
  2. 02Configure

    Choose a standard that fits the project.

    Preview six presets against your own repository before enabling one. The selected limits live in a committed .irisconfig.json that developers and coding agents can share.

    Gate Previewread-only
    lenient0 would fail
    balanced3 would fail
    strict24 would fail

    Applying a preset writes one .irisconfig.json.

  3. 03Enforce

    Stop weak changes before review.

    Use the same configuration for editor diagnostics, pre-push and build hooks, and the CI gate. When a change crosses the line, Iris Code names the rule, file, and location that failed.

    git push origin mainexit 1
    iris gate - 14 changed files
    FAIL src/api/client.ts secret: github token (12)
    FAIL src/db/orders.ts sql concatenation (47)
    push rejected by pre-push hook
The AI workflow

Check the agent's changes before a reviewer has to.

Review staged, unstaged, and untracked files together. Iris Code puts security blockers first and links every finding to the line that caused it.

  • Blockers first. Committed credentials and security smells sit above style noise, so the first thing you read is the thing that matters.
  • Only what changed. Staged, unstaged, and untracked files - not a full-repository scan you have to sit through.
  • Click to the line. Every finding opens its exact location, which is faster than re-prompting an agent and hoping.

Change review is free, and the diff never leaves your editor.

Change review2 blockers
blockerHardcoded secretsrc/api/client.ts:12
blockerSQL string concatenationsrc/db/orders.ts:47
warningComplexity 14 (limit 10)src/services/sync.ts:88
warningDebug output left in placesrc/components/upload.tsx:31
10 changed files clean14 files reviewed in 0.8s
For AI agents

Give coding agents the rules they are expected to follow.

Iris Code writes your configured limits into the instruction files coding agents already read. Through MCP, an agent can also request the real findings and gate result instead of guessing what your project considers acceptable.

Model Context Protocol6 tools
iris_checkFindings with rule ids and linesFree / Pro
iris_configThe project's resolved limitsFree
iris_fix_safePreview, then apply, safe fixesFree / Pro
iris_explainThe rule detail behind a findingPro
iris_gateWhether the gate would passPro
iris_check_dependencyOSV advisories for a packagePro
npx -y @iris-code/mcpClaude Code, Codex, Cursor, Windsurf, Copilot, Zed
Project rulesiris rules --all
AGENTS.mdCodex, Cursor, CopilotFree
CLAUDE.mdClaude CodeFree
Cursor rulesCursorFree
Copilot instructionsGitHub CopilotFree
Generated from .irisconfig.jsonNo AI model involved
See how agents work with Iris Code
What it checks

Concrete findings, backed by rules you can inspect.

Iris Code checks security, complexity, duplication, dependencies, naming, and maintainability. It shows the rule and underlying evidence instead of asking a model for an opinion.

Measure

Health score

Every file scored out of 100 from complexity, size, smells, and security signal. The same file always produces the same number.

Detect

Committed credentials

API keys, tokens, and passwords caught in source and in configuration files, with the value masked everywhere it is reported.

Detect

Security smells

eval and exec, SQL built by string concatenation, insecure randomness, weak hashing, and unchecked process execution.

Measure

Function inventory

Every function listed with its cyclomatic complexity and exact line numbers, so a long function is a line reference, not a feeling.

Detect

Duplicate blocks

Repeated logic matched across the workspace after comments and formatting are stripped, so a copy is found even when it was retyped.

Detect

Dependencies and CVEs

Eight package ecosystems audited against OSV advisories, with the nearest fixed version and a CycloneDX 1.5 SBOM export.

Enforce

Naming conventions

Path-aware snake_case, kebab-case, camelCase, or PascalCase rules with framework exemptions and baseline-aware rollout.

Measure

Quality signals

Recurring workspace issues ranked by density and impact, with the raw counts kept visible instead of rolled into one grade.

Enforce

Gate preview

Scan read-only against six presets and see exactly which files would fail before any threshold is switched on.

All 55 capabilities, by tier
Coverage

One engine, ten languages, eight package ecosystems.

The same analysis core produces consistent findings in VS Code, JetBrains IDEs, the CLI, and CI. Each language uses its own parser, and unsupported checks are omitted instead of approximated.

10languages parsed and scored

Complexity, functions, smells, secrets, naming, and duplicates, with language-specific rules where the language earns them.

Per-language matrix
8ecosystems audited against OSV

Lockfiles where a lockfile exists, declared manifests where one does not, and the report says which it read.

npmGo modulesPyPIRubyGemsNuGetMavenGradleCargo
Terminal and CI

The same standard from the first edit to the final gate.

Commit one .irisconfig.json for the CLI, pre-push hook, build hook, and CI. A failed gate names what crossed the limit and returns the exit code your pipeline expects.

  • Fifteen commands. check, secrets, security, deps, cve, sbom, todos, gate, slack, rules, mcp, report, hook, config, and auth.
  • Hooks you can uninstall. A pre-push or build hook that scans only the changed files, installed and removed by the CLI rather than hand-edited.
  • Slack from your own CI. Set one webhook and check and gate results post themselves. The message is built and sent locally and never passes through our servers.
Every command and its tier
CI - quality gateiris-code/cli
$iris gate . --min-score 75
scanned 214 files in 0.9s
FAIL src/api/client.ts secret: github token (line 12)
FAIL src/db/orders.ts sql built by concatenation (line 47)
WARN src/services/sync.ts complexity 14 (limit 10)
gate failed - 2 blockers, average score 71/75
exit 1
Same rules as the pre-push hookSlack notification optional
Teams

Give every repository the same standard - and keep the evidence.

Every seat includes Pro. The team workspace adds shared configuration, repository evidence, analytics, activity, roles, billing, and an audit log of what ran under each policy version.

Shared configuration

One standard for the organisation, built in the workspace Config Studio and committed beside the code.

Projects from CI

Repositories report their audits into the workspace, each keeping its own findings, dependencies, and trend.

Analytics

Health score, files scored, and pushes blocked across the organisation, with the delta against the previous period.

Activity

A daily signal chart, the longest active streak, and the mix of what your team actually ran.

Audit log

Every recorded event, filterable by signal, showing who ran what and under which version of the policy.

Workspace report

An exportable report with per-project tables, for the review that happens outside the tool.

Members and roles

Owner, admin, and member roles, invitations with expiry, and a seat limit the workspace enforces.

Organisation billing

Seats billed to the organisation at your region's resolved rate, starting with a 14-day trial.

Team-wide evidence without storing anyone's source.

Team evidence records execution outcomes and aggregate counts. It never contains source, file paths, repository URLs, snippets, or finding text.

Start a Teams trial
Acme Engineeringlast 30 days
84workspace health
checkout-service91+4
web-dashboard84+1
billing-api76-2
legacy-importer58-6
4 projects - 12 seatsconfig synced 2h ago
Try the real analysis engine

See what Iris Code finds before you install it.

The Playground runs the same analysis and gate engine on a seeded multi-file project. Inspect the evidence, fix the findings, and see how the configured gate responds.

Open the Playground
Pricing

Start with the signal. Pay when you need enforcement or shared control.

Free covers file analysis and core agent guidance. Pro adds workspace checks, enforcement, dependency intelligence, advanced configuration, and cloud audits. Teams gives every member Pro and adds the shared workspace.

Freeno account
$0/ month

Forever. Measurement is not the paid part.

Install free

No credit card, no sign-in

Included in Free

  • Health score out of 100, on every save
  • Cyclomatic complexity per function
  • Function inventory with exact line numbers
  • TypeScript-specific type-safety metrics
  • Code smells: debug output, magic numbers, TODOs, unused vars
  • Health score trend tracking (2 snapshots)
  • Hardcoded secrets, with the value masked in every report
  • eval and exec usage
  • SQL built by string concatenation
  • Insecure randomness and weak hashing
  • Duplicate block matching across the file
  • Inline diagnostics: squiggles and the Problems panel
  • Status bar score and Code Lens
  • Detached panel
  • Standalone HTML report export
  • VS Code, Cursor, Windsurf, VSCodium, Trae, and JetBrains IDEs
  • .irisconfig.json preset configs (presetId)
  • Gate Preview - read-only pass/fail against six presets
  • Project rules written into AGENTS.md, CLAUDE.md, Cursor, or Copilot
  • MCP server on one file: findings, resolved config, and safe fixes
  • iris check - single-file health scan
  • iris secrets - credential scanner, no auth required
  • iris security - eval, SQL injection, weak hashing, no auth required
  • iris rules - write project rules for coding agents
  • iris report - standalone HTML report
  • iris hook status, iris config init and validate
Promost popular
$6/ month

Enforcement: the half that can stop a push.

Start free trial

14-day trial by request, no card

Everything in Free, plus:

  • Connect a GitHub repository and it is audited without your editor open
  • 50 scans a month - every audit spends one, however it started
  • Choose the trigger per repository: merges, pull requests, or both
  • Every finding opens at its line on GitHub
  • Dependency and CVE audit against the audited commit
  • The 50 most recent audits kept, with score history and trends
  • Personal activity and audit history across connected repositories
  • Whole-workspace and per-folder scans
  • Gate Preview drilldown - exactly which files fail each preset
  • Issues tab with blocker and warning filters
  • TODOs tab aggregation
  • Clickable jump-to-line on every finding
  • Unlimited trend history and the trends table
  • Git pre-push hook
  • Build hook
  • Custom enforcement limits: secrets, complexity, file size, smells
  • Custom health score weights per finding type
  • Retention controls - regression threshold and baseline mode
  • Push-blocked counter, with the health delta since Pro started
  • Dependents table with a version audit
  • CVE scan against OSV advisories across eight ecosystems
  • Nearest fixed version for every advisory
  • CycloneDX 1.5 SBOM export
  • Custom .irisconfig.json threshold overrides
  • Config Studio - build, preview, and sync to your editor
  • Per-language overrides
  • MCP at folder and workspace scope
  • Gate status: whether the configured gate would pass
  • Rule detail behind a finding, not just its label
  • Dependency risk for a package at its installed version
  • iris gate - full enforcement gate for CI
  • iris deps - dependency and CVE audit
  • iris cve - fail CI at or above a severity threshold
  • iris sbom - CycloneDX 1.5 export
  • iris todos - aggregate TODO and FIXME
  • iris hook install and uninstall
  • iris check - directory and staged file scans
Teamsorganisation
Per seat

One shared standard, and a record of who changed it.

Create a team

Billed monthly at your region's rate

Everything in Pro, for every member, plus:

  • 100 scans per seat a month, so the three-seat minimum has 300
  • One allowance, shared across every repository in the workspace
  • Triggers set per repository: merges, pull requests, or both
  • Each audit recorded against the policy version it ran under
  • One organisation-wide standard, committed beside the code
  • Built and previewed in the workspace Config Studio
  • Synced, so a new machine enforces it on its first push
  • Repositories report their audits into the workspace
  • Per-project findings, dependencies, and trend history
  • Evidence panels per project
  • Health score, files scored, and pushes blocked across the org
  • The delta against the previous period
  • Daily signal chart, longest active streak, and signal mix
  • Every recorded event, filterable by signal
  • Who ran what, and under which version of the policy
  • An exportable workspace report with per-project tables
  • Owner, admin, and member roles
  • Invitations with expiry, and revocation
  • A seat limit the workspace enforces
  • Seats billed to the organisation, not to individuals
  • Country-resolved pricing, billed monthly
  • A 14-day trial that starts when the workspace is created
Full side-by-side comparison
FAQ

What Iris Code does - and where its boundaries are.

Clear answers about privacy, supported languages, pricing, editors, and AI-generated code.

Editor, CLI, hook, and CI analysis run on your machine or your own runner; Iris Code does not upload that source for analysis or send it to a model. Cloud audits are a separate, explicit opt-in workflow: Iris Code temporarily fetches the connected repository, scans it, deletes the working copy, and retains the report. Limited network requests also support sign-in, licensing, dependency lookups, and optional product-use events.

TypeScript and JavaScript (.ts, .tsx, .js, .jsx, .mjs, and .cjs) get the full metric set, including TypeScript-specific type-safety signals where applicable, and the script blocks inside Vue and Svelte components go through the same checks. Go (.go), Python (.py), Ruby, C# (.cs and .csproj), Java (.java and .properties), and Rust (.rs) are scored for complexity, smells, and secrets. Ruby covers .rb and the Ruby DSL extensions, extensionless files such as Gemfile and Rakefile, and .erb templates. Secrets detection runs across these supported source-file types.

Free covers per-file analysis, secrets detection, Gate Preview, project rules for coding agents, and core CLI and MCP workflows. Pro adds workspace analysis, hooks and CI enforcement, advanced configuration, dependency intelligence, and metered cloud audits. Teams gives each member Pro and adds a shared workspace, seats, repository evidence, analytics, and audit history.

Files are scored incrementally on save in well under a second. The pre-push hook only scans changed files, so a typical push adds a beat - not a coffee break. The same engine powers the editor, CLI, and CI, so results never disagree.

Commit one .irisconfig.json so developers, coding agents, hooks, and CI work from the same limits. A Teams workspace adds seats, shared configuration, repository evidence, analytics, roles, and audit history across the organisation.

VS Code and every VS Code-compatible editor (Cursor, Windsurf, VSCodium) via the Marketplace extension, and JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, Android Studio) via the JetBrains Marketplace plugin. Both hosts run the same analysis engine, so a file scores identically in either one, and one sign-in covers your editors and the CLI. Everything else runs from the iris CLI in any terminal or pipeline.

No. Iris Code does not guess who or what wrote the code. It independently checks the result against deterministic rules for secrets, duplication, security smells, complexity, and maintainability, whether the code was written by a person, an AI assistant, or both.

Check your own code

Install Iris Code and inspect your first file.

File analysis is free and starts without configuration or sign-in. See the findings, inspect the rules behind them, and decide whether Iris Code belongs in your workflow.

Install for VS CodeInstall for JetBrains

Also on Open VSX for Cursor, Windsurf, VSCodium, and Trae

Iris Code

Keep AI-assisted code up to your standards.

Product
FeaturesPricingTeamsPlaygroundCompare
Surfaces
CLIMCP for agentsLanguagesDownloadVS Code MarketplaceOpen VSXJetBrains Marketplace
Learn
DocsGetting startedHealth scoreGit hooks.irisconfig.jsonCLI reference
Company
AboutBlogChangelogExtended trialsContactSupportX / Twitter
Legal
SecurityPrivacy PolicyTerms of ServiceJetBrains Plugin EULA
© 2026 Iris Code — built by David Jaja.v1.26.0