Open a file and it is scored in-process: functions, complexity, smells, committed credentials, and every finding pinned to a line. Free covers a file; Pro adds the whole-repository view.
Runs in VS Code and its forks (Cursor, Windsurf, VSCodium, Trae) and in JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand and more). One analysis engine behind all of them, so the same file gets the same score, findings, and gate decision wherever you open it.
Recurring workspace issues ranked by density and impact, with the raw counts and percentages kept visible.
Free path-aware snake_case, kebab-case, camelCase, or PascalCase checks with ordered role rules, framework exemptions, and baseline-aware rollout.
Every function listed with its complexity and exact line numbers.
Console logs, magic numbers, TODOs, and unused vars and functions.
Flags any usage, @ts-ignore, and missing return types.
Two layers: suspicious names plus known token formats.
Nine patterns: eval/exec, SQL injection, insecure RNG, ReDoS regex, disabled TLS, weak hashing, open redirects, debug flags, and localhost URLs. Each counts as a Blocker.
Token-window matching finds copy-pasted blocks within and across files - renamed identifiers and changed literals do not hide them. Workspace duplication percentage, a filterable table, and a Pro side-by-side diff.
Squiggles and Problems-panel entries, opt-in per workspace.
Live score in the status bar; complexity above each function.
Pop the report into its own window or export it to HTML.
2 snapshots on Free; unlimited history on Pro to chart long-range health.
Every blocking issue and warning aggregated into one filterable list.
Every TODO, FIXME, and HACK note collected across the codebase.
Every finding clicks straight to the exact line it lives on.
Version audit and CVE scan for npm, Go, Python, RubyGems, and NuGet dependencies - lockfile-accurate, monorepo-aware, and filtered to the version you actually run.
Check staged, unstaged, and untracked Git files before anyone else reviews them.
Walk past commits for secrets that were committed and later removed - masked, local, rotation-first.
Start from a preset, preview it read-only against your own repository, then commit one .irisconfig.json that the editor, the hooks, and CI all read.
Commit it once - a one-line presetId gets you started; custom limits and per-language thresholds take over on Pro.
Stricter explicit limits for teams reviewing AI-assisted code at volume, without imposing a team-specific naming style.
Pick a preset on the web and push it straight to your editor with a diff preview.
Failing file names, scores, and warning pills inside each preset row.
Block on secret count, complexity ceiling, file size, or smell density.
Tune how much each finding type costs the health score - make secrets fatal and TODOs cosmetic, or the reverse.
A visual editor for your full config, synced back to your editor - no hand-editing JSON.
Set thresholds and per-file gate caps independently for TypeScript, JavaScript, Go, Python, Ruby, C#, Java, and Rust; Vue and Svelte scripts follow their matching TS or JS policy.
Enforcement is the paid half: the same config that showed you the score now decides whether a push is allowed.
Block any push that falls below your health threshold.
Stop JS, Go, Python, and Ruby builds before they run.
Monthly and total pushes blocked, plus health delta since Pro.
Set one CI secret and an existing gate step posts its result to Slack. No pipeline edit and no flag. The message is built and sent by your own runner, carries file paths, scores and counts only, and never passes through an Iris Code server. Setup guide.
CLI, hooks, and the editor extensions.
AGENTS.md rules block, and the pre-push hook where your licence allows it. Safe to run again.~/.iris/credentials.--staged, and --changed on Pro.package.json, go.mod, requirements.txt for CVEs. Lockfile-aware and monorepo-aware.--severity threshold. Built for CI gates.init generates a config with a preset; validate checks an existing one.Every language below goes through the same parser, so a file scores identically in the editor, the CLI, and CI. Where a language cannot support a check honestly, the check is absent rather than guessed.
.ts .tsxfull metrics + type safety
.js .jsxfull metrics + smells
.vuescript blocks + native lines
.sveltescript blocks + native lines
.gocomplexity, smells, secrets
.pycomplexity, smells, secrets
.rbRails checks, ERB, Gemfile
.cs.NET smells, .csproj secrets
.javaunused imports, .properties secrets
.rstest-aware unwrap and panic checks