Per fileFree
One number, recomputed on every save.
Complexity, code smells, type safety, and secrets - weighted into a single 0-100 health score.
0HEALTH
Complexity64
Type safety91
Smells70
Secrets2 left
01
Analysis
19 capabilitiesDetect and measure - every file, every save.
Open a file and Iris Code scores it instantly - functions, complexity, secrets, and every smell pinned to a line. Free covers analysis; Pro adds the whole-repo view.
Pro · Workspace
The whole codebase in one view.
Aggregate stats, ranked files, and unused packages across the repo.
Repo health0 / 100
Files scored0
Below threshold0 files
Unused packages0
Free
Every editor, one engine
Runs in VS Code and its forks (Cursor, Windsurf, VSCodium, Trae) and in JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand and more). One analysis engine behind all of them, so the same file gets the same score, findings, and gate decision wherever you open it.
Free
Quality Signals
Recurring workspace issues ranked by density and impact, with the raw counts and percentages kept visible.
Free
File naming conventions
Free path-aware snake_case, kebab-case, camelCase, or PascalCase checks with ordered role rules, framework exemptions, and baseline-aware rollout.
Free
Function inventory
Every function listed with its complexity and exact line numbers.
Free
Code smells
Console logs, magic numbers, TODOs, and unused vars and functions.
Free
TypeScript quality
Flags
any usage, @ts-ignore, and missing return types.Free
Hardcoded secrets
Two layers: suspicious names plus known token formats.
14 API_TOKEN =
15 password =
Free
Security smells
Nine patterns: eval/exec, SQL injection, insecure RNG, ReDoS regex, disabled TLS, weak hashing, open redirects, debug flags, and localhost URLs. Each counts as a Blocker.
Free to Pro
Duplicate code
Token-window matching finds copy-pasted blocks within and across files - renamed identifiers and changed literals do not hide them. Workspace duplication percentage, a filterable table, and a Pro side-by-side diff.
Free
Inline diagnostics
Squiggles and Problems-panel entries, opt-in per workspace.
Free
Status bar + Code Lens
Live score in the status bar; complexity above each function.
Free
Detached panel + export
Pop the report into its own window or export it to HTML.
Free to Pro
Trend tracking
2 snapshots on Free; unlimited history on Pro to chart long-range health.
Pro
Issues tab
Every blocking issue and warning aggregated into one filterable list.
Pro
TODOs tab
Every TODO, FIXME, and HACK note collected across the codebase.
Pro
Jump to line
Every finding clicks straight to the exact line it lives on.
Pro
Dependents table
Version audit and CVE scan for npm, Go, and Python dependencies - lockfile-accurate, monorepo-aware, and filtered to the version you actually run.
Free
Review my changes
Check staged, unstaged, and untracked Git files before anyone else reviews them.
Pro
Git history secrets scan
Walk past commits for secrets that were committed and later removed - masked, local, rotation-first.
02
Configuration
7 capabilitiesSet the bar once; align the whole team.
Scan read-only against six presets, watch the fail count change, and apply the one that fits. One ".irisconfig.json" drives diagnostics, hooks, and CI for everyone.
Gate PreviewFree
Cycle presets, see what fails.
iris gate-preview
70threshold
2 of 528 files would fail this gate.
Configuration
One config, same rules everywhere.
Commit it once - a one-line presetId gets you started; custom limits take over on Pro.
.irisconfig.json
1{
2 "presetId": "balanced",
3 "minHealthScore": 80,
4 "enforce": {
5 "prePush": true,
6 "maxSecrets": 0
7 },
8 "overrides": {
9 "src/legacy/**": { "min": 60 }
10 }
11}
Free
AI-assisted preset
Stricter explicit limits for teams reviewing AI-assisted code at volume, without imposing a team-specific naming style.
Free
Dashboard config sync
Pick a preset on the web and push it straight to your editor with a diff preview.
Pro
Gate Preview drilldown
Failing file names, scores, and warning pills inside each preset row.
Pro
Custom enforcement limits
Block on secret count, complexity ceiling, file size, or smell density.
Pro
Custom scoring weights
Tune how much each finding type costs the health score - make secrets fatal and TODOs cosmetic, or the reverse.
Pro
Config Studio
A visual editor for your full config, synced back to your editor - no hand-editing JSON.
Pro
Per-language overrides
One config, honest thresholds per language - a 500-line Python cap next to a 300-line TypeScript one.
03
Enforcement
3 capabilitiesBlock what falls below the line.
Secrets and sub-threshold files stop at the pre-push and build hooks - before they ever ship. The same gate runs locally and in CI.
Score → Gate → Hook
Nothing broken gets past.
Set the bar once. The hook scores changed files and stops the ones that fall short - and any leaked secret - at the door.
2
secrets caught
1
push blocked
<1s
per file
# pre-push -> iris gate · min 80-> scanning 6 changed files... ✕ src/config/keys.ts 14 const API_TOKEN = "ghp_a83x..."✕ src/db/migrate.ts - 38 / 80
●2 secrets · 1 below threshold - blockedEXIT 1
Pro
Git pre-push hook
Block any push that falls below your health threshold.
Pro
Build hook
Stop JS, Go, and Python builds before they run.
Pro
Push-blocked counter
Monthly and total pushes blocked, plus health delta since Pro.
04
CLI
12 commandsTwelve commands for terminals and CI.
The same engine as the extension, scriptable. Single-file scans are free; the gate, deps audits, and directory scans unlock on Pro.
$ iris check src/checkout/cart.ts
cart.ts 68/100 3 issues · complexity 7/10
! line 42 function exceeds complexity budget
! line 88 magic number — extract a constant
i line 91 TODO left in source
$ iris secrets --dir src
✕ src/config/keys.ts:14 GitHub token
✕ src/config/keys.ts:15 weak password literal
no authentication required · nothing uploaded
2 secrets found — exit 1
$ iris security --dir src
✕ src/db/query.ts:22 SQL built by string concatenation
✕ src/utils/hash.ts:9 weak hashing (MD5)
no authentication required · nothing uploaded
2 security smells found — exit 1
$ iris gate --staged --min 80
✓ session.ts 94 ✓ handlers.ts 88
✕ migrate.ts 38 ✕ keys.ts · 2 secrets
gate failed — 2 of 6 below threshold (exit 1)
$ iris report --out iris-report.html
✓ scored 128 files · repo health 81/100
✓ wrote iris-report.html (standalone)
open it in any browser — no server needed
Get started
One line to install.
CLI, hooks, and the editor extensions.
$ npm i -g @iris-code/cli▸ iris ready · run iris check
iris authFree
Sign in via browser or licence token. Stored at
~/.iris/credentials.iris checkFree to Pro
Single-file scan is free. Directory,
--staged, and --changed on Pro.iris secretsFree
Hardcoded credentials, API keys, and tokens. No auth required.
iris securityFree
Eval usage, SQL injection, insecure RNG, weak hashing, and more. No auth required.
iris depsPro
Audit
package.json, go.mod, requirements.txt for CVEs. Lockfile-aware and monorepo-aware.iris cvePro
Same scan as deps, but exits 1 only at or above a
--severity threshold. Built for CI gates.iris sbomPro
Export a CycloneDX 1.5 SBOM across npm, Go, and Python. Fully offline.
iris todosPro
Collect every TODO, FIXME, and HACK comment across the codebase.
iris gatePro
Full enforcement gate. Exits 1 below threshold. Designed for CI.
iris reportFree
Export a standalone HTML health report to the current directory.
iris hookFree to Pro
Status check is free. Install/uninstall pre-push & build hooks on Pro.
iris configFree
init generates a config with a preset; validate checks an existing one.05
Languages
6 languagesParsed and scored natively.
Four languages plus Vue and Svelte components, one engine. Script blocks in SFCs use the same JavaScript/TypeScript checks, while template markup and styles stay out of scoring and duplicate matching. Go and Python are scored for complexity, smells, and secrets.
TypeScript
.ts .tsx - full metrics + type safety
JavaScript
.js .jsx - full metrics + smells
Vue
.vue - script blocks + native lines
Svelte
.svelte - script blocks + native lines
Go
.go - complexity, smells, secrets
Python
.py - complexity, smells, secrets