Run Iris Code before you push so the same scoring rules fire locally, in hooks, and in CI. One policy, three checkpoints — editor, hook, pipeline.
Score every file in one pass. Iris Code uses the same engine as the editor sidebar — no drift between what you see and what the gate checks.
Score a file or the whole workspace. Same engine as the editor sidebar — no drift between what you see and what the gate checks. Single-file scans are free; directory scans require Pro.
Scan for hardcoded API keys, tokens, and passwords across JS/TS/Go/Python/Ruby. No licence required.
FreeScan for eval usage, SQL injection, insecure RNG, weak hashing, and more. No licence required.
FreeInstall Git and build hooks when the team is ready to block pushes or builds that fall below the agreed threshold. One command, zero boilerplate.
The Git hook runs iris check on every push and blocks if any file falls below the configured threshold. Install it once — the hook lives in .git/hooks/ and runs locally for every developer.
Runs on pre-push. Scans the whole workspace and blocks the push if any file falls below the threshold. Zero config after install.
FreeWires into your build command — npm prebuild for Node, a Makefile target for Go, Python, and Ruby. Fails the build when workspace health drops.
ProSee which hooks are installed — git and build, in one command. Free.
FreeUse one committed .irisconfig.json so editor diagnostics, Gate Preview, and enforcement all speak the same policy. Every developer gets the same rules — no drift between machines.
Commit .irisconfig.json to your repo. The editor, hooks, and CI all read from the same source — a threshold change is a one-line diff that the whole team gets on pull.
Interactively generate .irisconfig.json from a preset (legacy, balanced, or strict). Free — Pro users can also set custom gate limits.
FreeChecks your config for schema errors, unknown keys, and invalid values — before you commit.
FreeFull enforcement gate with machine-readable JSON output — pipe into CI reporters, dashboards, or any tool that reads JSON.
ProWrites this project's limits, naming convention and gate rules into the files your coding agents read - AGENTS.md, CLAUDE.md, Cursor or Copilot - so an agent follows your standards while it writes instead of after review. Generated from your .irisconfig.json, and no AI model is involved. Free. How it works.
FreeSet IRIS_SLACK_WEBHOOK in CI and an existing gate step posts its result to Slack. No pipeline edit, no flag. The message is built and sent by your own runner, carries file paths, scores and counts only, and never passes through an Iris Code server. Free. Setup guide.
FreeAll fifteen Iris Code CLI commands in one place. Full flags and exit codes live in the command reference.
Set a project up in one command: three short questions, a recommended preset, a commented config, an AGENTS.md rules block, and the pre-push hook where your licence allows it. Safe to run again.
FreeSign in via browser or licence token. Stored at ~/.iris/credentials.
FreeSingle-file scan is free. Directory, --staged, and --changed on Pro.
Remove the findings Iris Code can prove are safe to remove, including fixes that span several lines: an isolated debug statement, an unused literal variable inside a function, an unused import or import name, and compatible imports merged into one. Previews first. One file is free; folder and workspace scope on Pro.
A refactor plan for one file: your repository's conventions, the fixes that are safe to apply, and ranked structural suggestions with evidence and risk. --verify compares the result with git HEAD and reports improved, not improved or regressed.
FreeThe import graph the Code Map draws, as text or JSON for agents and CI. One file's imports and importers are free; the whole graph on Pro.
Hardcoded credentials, API keys, and tokens. No auth required.
FreeEval usage, SQL injection, insecure RNG, weak hashing, and more. No auth required.
FreeAudit package.json, go.mod, and requirements.txt for CVEs. Lockfile-aware and monorepo-aware.
ProCheck packages before they install: known vulnerabilities, malicious-package reports, yanked and brand-new versions. With no package names, checks a whole cloned project first, lockfile and install scripts included.
FreeRemove packages with the project's own package manager. Also runs as iris uninstall and iris rm.
FreeSame scan as deps, but exits 1 only at or above a --severity threshold. Built for CI gates.
ProExport a CycloneDX 1.5 SBOM across npm, Go, Python, RubyGems, and NuGet. Fully offline.
ProCollect every TODO, FIXME, and HACK comment across the codebase.
ProFull enforcement gate. Exits 1 below threshold. Designed for CI.
ProSet up and test Slack notifications for check and gate runs. setup validates your webhook and sends a test message; manifest creates a pre-configured Slack app.
FreeWrite this project's limits, naming convention, and gate rules into the file your coding agent reads. AGENTS.md by default, or Claude, Cursor, and Copilot targets.
FreeServe Iris Code to AI agents over the Model Context Protocol. Single-file findings, project config, and safe fixes are free; workspace scope, gate status, rule detail, and dependency risk on Pro.
Export a standalone HTML health report to the current directory.
FreeThe agent hook that checks packages before a coding agent installs them is free, as is every status check. Pre-push and build hooks install on Pro, and hook verify warns in CI when a pushed commit has no Team hook receipt.
init generates a config with a preset; validate checks an existing one.
FreeDepending on where your team is, one of these paths gets you to enforcement fastest.