- When it checks
- At the pull request, after the code is shared
- Where it runs
- On a vendor's servers
- What you get
- An opinion that can change between runs
- What it can do
- Leave a comment someone approves anyway
Loading Iris Code...
Loading Iris Code...
Iris Code gives every file a score out of 100 and catches leaked passwords, copy-pasted code and risky patterns while you type.
Workspace health
84+8 in 30 days
Push gate, 7 days
3blocked
38 of 41 pushes passed
Secrets
0shipped
2 caught before the push
Needs attention
Recent pushes
84% of developers now use AI to write code. Only 29% trust what it writes. Duplicated code is up 81%, and AI-assisted commits leak secrets at twice the usual rate.
So who checks all of it?
+81%
more duplicated code since 2023
2.1×
the rate AI-assisted commits leak secrets
Follow one file, cancel_order.ts, from the moment it is opened to the moment it merges: what Iris Code checks, where, and when it says no. An illustrative ten minutes.
Iris Code scores the file out of 100 on open and on every save, and ties each finding to the rule behind it: a committed GitHub token, a query built by concatenation, a stray console.log.
Your coding agent reads the same project rules over MCP, so it fixes what your standard asks for. The token moves to an environment variable and the score climbs.
The pre-push hook checks the change against your committed .irisconfig.json. Your config allows no security smells and one is left, so the push stops on your machine and names the rule it broke.
A parameterised query clears the blocker. The push goes through, and CI runs the same gate with the same config, so it passes for the same reasons.
export async function cancelOrder(id: string) { const token = "ghp_a83x0Pf2Le..."Committed credential - GitHub token. Blocks the push.
const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Complexity 14, limit 10.
console.log("cancelling", id) // debug output}Iris Code scores the file out of 100 on open and on every save, and ties each finding to the rule behind it: a committed GitHub token, a query built by concatenation, a stray console.log.
export async function cancelOrder(id: string) { const token = "ghp_a83x0Pf2Le..."Committed credential - GitHub token. Blocks the push.
const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Complexity 14, limit 10.
console.log("cancelling", id) // debug output}Your coding agent reads the same project rules over MCP, so it fixes what your standard asks for. The token moves to an environment variable and the score climbs.
export async function cancelOrder(id: string) { const token = process.env.GITHUB_TOKEN const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Complexity 14, limit 10.
console.log("cancelling", id) // debug output}The pre-push hook checks the change against your committed .irisconfig.json. Your config allows no security smells and one is left, so the push stops on your machine and names the rule it broke.
export async function cancelOrder(id: string) { const token = process.env.GITHUB_TOKEN const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Blocks the push.
console.log("cancelling", id) // debug output}A parameterised query clears the blocker. The push goes through, and CI runs the same gate with the same config, so it passes for the same reasons.
export async function cancelOrder(id: string) { const token = process.env.GITHUB_TOKEN const rows = await db.query("select * from o where id=$1", [id]) console.log("cancelling", id) // debug output}Iris Code doesn't ask another model what it thinks of your code. It checks the code against the rules you wrote down, and gives the same answer every time.
Push refused
cancel_order.ts:40SQL built by concatenation
exit 1 · nothing left your machine
Editors
VS Code · Cursor · Windsurf · VSCodium · Trae · IntelliJ IDEA · WebStorm · PyCharm · GoLand · Rider
Languages
Dependency audits
npm · Go modules · PyPI · RubyGems · NuGet · Maven · Gradle · Cargo
Commit one .irisconfig.json and every developer, every coding agent, every hook and every pipeline works to the same thresholds. A team adds seats, shared configuration, repository evidence, analytics and an audit trail of what ran under each policy version. Without storing anyone's source.
We don't detect AI-written code. We don't find every bug. We don't judge whether your feature is a good idea. And we don't pretend the gate can't be skipped. We name the rule, the file and the line. Every time.
Clear answers about privacy, supported languages, pricing, editors, and AI-generated code.
VS Code and every VS Code-compatible editor (Cursor, Windsurf, VSCodium) via the Marketplace extension, and JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, Android Studio) via the JetBrains Marketplace plugin. Both hosts run the same analysis engine, so a file scores identically in either one, and one sign-in covers your editors and the CLI. Everything else runs from the iris CLI in any terminal or pipeline.
Editor, CLI, hook, and CI scans run on your machine or your own runner; Iris Code does not upload that source for analysis or send it to a model. Cloud scans are a separate, explicit opt-in workflow: Iris Code temporarily fetches the connected repository, scans it, deletes the working copy, and retains the report. Limited network requests also support sign-in, licensing, dependency lookups, and optional product-use events.
TypeScript and JavaScript (.ts, .tsx, .js, .jsx, .mjs, and .cjs) get the full metric set, including TypeScript-specific type-safety signals where applicable, and the script blocks inside Vue and Svelte components go through the same checks. Go (.go), Python (.py), Ruby, C# (.cs and .csproj), Java (.java and .properties), and Rust (.rs) are scored for complexity, smells, and secrets. Ruby covers .rb and the Ruby DSL extensions, extensionless files such as Gemfile and Rakefile, and .erb templates. Secrets detection runs across these supported source-file types.
Free file checks, secrets, package guard and focused tools need no paid plan. Sign in for custom configuration and recurring project actions where enabled. The account shows current local and cloud allowances. Earned results remain readable after exhaustion. Pro adds continuous enforcement and local project work beyond the Free action constraint. Free Teams share capacity and allowances; paid teams add applicable seats and automation.
File analysis runs locally as you edit. Repeat editor workspace scans reuse unchanged results; pre-push and build hooks scan the workspace. Scan time depends on repository size and enabled checks. The editor, CLI, and CI use the same analysis engine and committed policy.
Commit one .irisconfig.json so developers, coding agents, hooks, and CI work from the same thresholds. A team adds seats, shared configuration, repository evidence, analytics, roles, and audit history across the organisation.
No. Iris Code does not guess who or what wrote the code. It independently checks the result against deterministic rules for secrets, duplication, security smells, complexity, and maintainability, whether the code was written by a person, an AI assistant, or both.
Follow declared relationships, inspect columns and keys, and check the database names your code actually uses before changing a query or migration. It reads Prisma, SQL migrations, Drizzle, Django, Rails, Diesel. Reads schema declarations in your repository. No live database connection or credentials are needed. It does not query your data or verify the deployed database. Whole-schema structure, focused-table usage and exports are Free. Aggregate schema usage and warnings are available from earned project evidence; fresh project inspection uses applicable project access. Cloud reports include Schema when supported declarations can be read. Cloud scanning uses the selected account or team allowance and repository permissions. Repositories start manual-only; automatic triggers are an explicit opt-in within the same allowance, including Free. Schema-only repositories do not produce a code-health audit.
Install the extension, open any file, and see its score. File scans are free and need no account.
AIreview-bot commented on line 40
This query may be vulnerable to SQL injection. Consider using parameterised queries.
Approved and merged 2 minutes later