Code analysis
Find the line. Understand the risk.
Open a supported file and Iris Code analyses it locally. See its health score, function complexity, code smells, secrets and risky patterns without sending the source away for that analysis.
export async function cancelOrder(id: string) { const token = "ghp_a83x0Pf2Le..."Committed credential - GitHub token. Blocks the push.
const rows = await db.query("select * from o where id=" + id)SQL built by concatenation. Complexity 14, limit 10.
console.log("cancelling", id) // debug output}What it does
A score is the starting point. The findings explain it.
Code analysis inspects the instructions in a source file without running the application. Iris Code measures function complexity and flags supported patterns such as leaked credentials, duplicated blocks and security smells.
The File view brings those checks together: a health score, blockers, warnings and individual functions with line numbers. Select a finding to inspect the code behind it. Language coverage differs, so the supported-language guide explains which checks apply to your files.
- See complexity and exact line numbers for each function.
- Inspect findings in the panel, Code Lens or opt-in inline diagnostics.
- Find duplicated blocks, including blocks with renamed identifiers.
Why use it
Know what to inspect before you ask for review.
A working feature can still contain a credential, an oversized function or copied code. Named findings give you a concrete next step.
- Start with the relevant line
- A warning becomes useful when you can find its cause. Findings jump to the source, while function metrics show where complexity is concentrated.
- Check the result of an edit
- Save a change and inspect the recalculated file. You can see whether the finding remains instead of treating an improved score as proof that everything is fixed.
- Keep routine checks close to the work
- The status bar, panel and Code Lens put evidence beside the file you are editing. Opt-in inline diagnostics also bring findings into the editor's Problems panel.
How to use it
From an open file to an inspected finding.
Start in your editor. The first file check needs no account or command.
Open a supported source file
Install Iris Code, open your project and select a supported source file. Open the Iris Code panel to inspect its File view.
ResultThe file's score, blockers, warnings and function metrics are visible.
Follow one finding
Select a blocker or warning. Read the named problem and inspect the line Iris Code highlights before deciding on a fix.
ResultYou can connect the reported pattern to the source that caused it.
Change, save and check again
Make the change you intend, save the file and review the recalculated findings. Keep running your tests and reviewing behaviour as well.
ResultYou can see whether the specific finding cleared and what still needs attention.
Expand to the workspace
Run the workspace scan when you need a project-wide view. An anonymous introductory scan remains available. Sign in for recurring project actions where enabled; the account shows current limits. Saved results remain readable after exhaustion.
Command palette Iris Code: Scan WorkspaceResultA saved snapshot brings together workspace readiness, hotspots, findings and duplication.
The capabilities, in detail.
- Every editor, one engineFree
- Runs in VS Code and its forks (Cursor, Windsurf, VSCodium, Trae) and in JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, GoLand and more). One analysis engine behind all of them, so the same file gets the same score, findings, and gate decision wherever you open it.
- Quality SignalsFree
- Recurring workspace issues ranked by density and impact, with the raw counts and percentages kept visible.
- File naming conventionsFree
- Free path-aware snake_case, kebab-case, camelCase, or PascalCase checks with ordered role rules, framework exemptions, and baseline-aware rollout.
- Function inventoryFree
- Every function listed with its complexity and exact line numbers.
- Code smellsFree
- Console logs, magic numbers, TODOs, and unused vars and functions.
- TypeScript qualityFree
- Flags
anyusage,@ts-ignore, and missing return types. - Hardcoded secretsFree
- Two layers: suspicious names plus known token formats.
- Security smellsFree
- Nine patterns: eval/exec, SQL injection, insecure RNG, ReDoS regex, disabled TLS, weak hashing, open redirects, debug flags, and localhost URLs. Each counts as a Blocker.
- Duplicate codeFree / Pro scopes
- Token-window matching finds copy-pasted blocks within and across files - renamed identifiers and changed literals do not hide them. Workspace duplication percentage, a filterable table, and a Pro side-by-side diff.
- Inline diagnosticsFree
- Squiggles and Problems-panel entries, opt-in per workspace.
- Status bar + Code LensFree
- Live score in the status bar; complexity above each function.
- Detached panelFree
- Pop Iris Code into its own editor window for a wider view.
- Shareable reportFree / Pro scopes
- Share a scan as a card or a PDF you choose the pages of. Free shares your saved first workspace scan; Pro any fresh scan.
- Trend trackingFree / Pro scopes
- 2 snapshots on Free; unlimited history on Pro to chart long-range health.
- Findings tabPro
- Every blocking issue and warning aggregated into one filterable list.
- TODOs tabPro
- Every TODO, FIXME, and HACK note collected across the codebase.
- Jump to lineFree
- Every finding clicks straight to the exact line it lives on.
- Review my changesFree
- Check staged, unstaged, and untracked Git files before anyone else reviews them.
- Git history secrets scanPro
- Walk past commits for secrets that were committed and later removed - masked, local, rotation-first.
Choose your scope
What's included.
- Free
- File scans, findings and secrets detection are Free. An anonymous introductory workspace scan is saved locally. Sign in for recurring project actions where enabled.
- Pro and Teams
- Pro adds local project work without the Free monthly action constraint, paid automation and applicable history features.
Know the boundary
What it doesn't promise.
A score summarises the checks that ran. It does not prove the program is correct or replace tests and review.
Start here.
Install the extension and open a supported source file. Its score appears in the editor status bar.