Loading Iris Code...
Loading Iris Code...
Iris Code checks what you and your coding agents write, in VS Code, JetBrains and the terminal. It finds leaked passwords, unsafe packages and risky code, and points to the exact line, on your machine.
Your agent added cancelOrder() and asked Iris Code to check it.
export async function cancelOrder(id: string) { const token = "ghp_a83x0Pf2Le..."Committed credential - GitHub token. Blocks the push.
const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Complexity 14, limit 10.
console.log("cancelling", id) // debug output}Not ready to push. 2 problems break your rules.
No new dashboard to learn. Iris Code sits in the editor, the terminal and the pipeline you already use, and answers one question about every change: does it follow your rules?
.irisconfig.json in your repository sets the limits, and your editor, your agent, your hooks and CI all read that same file.One engine and one set of rules behind all three, so they always give the same answer.
Over MCP, the agent checks its own changes and gets each problem back with the rule and the line.
{
"command": "npx",
"args": ["-y", "@iris-code/mcp"]
}Run iris check on a file as you go, or on the whole project when the agent is done.
iris check src/cancel_order.ts
iris check . --inspectReview My Changes checks the files you changed since your last commit, in VS Code or JetBrains.
> Iris Code: Review My ChangesOne file is free everywhere. A free account adds a monthly allowance of whole-project checks; Pro removes the limit and adds enforcement.
Your rules live in one file. Iris Code checks them while the code is written, before a package is installed and before anything is pushed.
Commit one .irisconfig.json. Your editor, your coding agent, your hooks and CI all read it, so everyone works to the same limits. Start from a free preset, or set your own limits with Pro.
{
"presetId": "balanced",
"minHealthScore": 75,
"gateMaxSecrets": 0,
"gateMaxSecuritySmells": 0,
"packageGuard": { "blockSeverity": "high" }
}When an agent installs a package, the package guard checks it first. A malicious or yanked version, or one with a high or critical vulnerability, is blocked and a safe version is named. Free, for Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI and Windsurf.
Every check reports hardcoded passwords, keys and tokens by line. With the pre-push hook (Pro), a push that still contains one is refused under every preset except Legacy, so it never reaches the repository.
An agent can change ten files to fix one bug. Before you check them, see which files import what it changed and which tables its queries use.
The schema diagram shows the tables, keys and relationships a change depends on, read from the schema in your repository (Prisma, SQL migrations, Drizzle, Django, Rails, Diesel). No database connection needed. Whole-schema structure, focused-table usage and exports are Free.
order_idPKproduct_idPKquantityIntidPKuser_idFKidPKemailStringPick a file and Code Map shows every file that imports it, plus cycles and imports that do not resolve. The open file's neighbourhood is Free.
lib/auth.ts is below the minimum, and three files import it.
Commit one .irisconfig.json and every developer, every coding agent, every hook and every pipeline works to the same thresholds. A team adds seats, shared configuration, repository evidence, analytics and an audit trail of what ran under each policy version. Without storing anyone's source.
Clear answers about privacy, supported languages, pricing, editors, and AI-generated code.
VS Code and every VS Code-compatible editor (Cursor, Windsurf, VSCodium) via the Marketplace extension, and JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, Android Studio) via the JetBrains Marketplace plugin. Both hosts run the same analysis engine, so a file scores identically in either one, and one sign-in covers your editors and the CLI. Everything else runs from the iris CLI in any terminal or pipeline.
Editor, CLI, hook, and CI scans run on your machine or your own runner; Iris Code does not upload that source for analysis or send it to a model. Cloud scans are a separate, explicit opt-in workflow: Iris Code temporarily fetches the connected repository, scans it, deletes the working copy, and retains the report. Limited network requests also support sign-in, licensing, dependency lookups, and optional product-use events.
TypeScript and JavaScript (.ts, .tsx, .js, .jsx, .mjs, and .cjs) get the full metric set, including TypeScript-specific type-safety signals where applicable, and the script blocks inside Vue and Svelte components go through the same checks. Go (.go), Python (.py), Ruby, C# (.cs and .csproj), Java (.java and .properties), and Rust (.rs) are scored for complexity, smells, and secrets. Ruby covers .rb and the Ruby DSL extensions, extensionless files such as Gemfile and Rakefile, and .erb templates. Secrets detection runs across these supported source-file types.
Free: checking any single file in the editor, the terminal or through your agent, secrets detection, the package guard that stops an agent installing a bad package, project rules for agents, and the schema diagram. Sign in, still free, and you also get a monthly allowance of whole-project checks. Pro removes that monthly limit and adds enforcement: the gate, pre-push and build hooks that refuse a failing push, CI, and gating on dependency vulnerabilities. Teams adds seats and one shared configuration.
File analysis runs locally as you edit. Repeat editor workspace scans reuse unchanged results; pre-push and build hooks scan the workspace. Scan time depends on repository size and enabled checks. The editor, CLI, and CI use the same analysis engine and committed policy.
Commit one .irisconfig.json so developers, coding agents, hooks, and CI work from the same thresholds. A team adds seats, shared configuration, repository evidence, analytics, roles, and audit history across the organisation.
No. Iris Code does not guess who or what wrote the code. It independently checks the result against deterministic rules for secrets, duplication, security smells, complexity, and maintainability, whether the code was written by a person, an AI assistant, or both.
Yes. It reads the schema declared in your repository (Prisma, SQL migrations, Drizzle, Django, Rails, Diesel) and draws the tables, columns, keys and the relationships between them. Reads schema declarations in your repository. No live database connection or credentials are needed. It does not query your data or verify the deployed database. Whole-schema structure, focused-table usage and exports are Free. Aggregate schema usage and warnings are available from earned project evidence; fresh project inspection uses applicable project access.
Install the extension, open any file, and see its score. File scans are free and need no account.