# Iris Code

> Iris Code is the deterministic quality-control layer for AI-assisted software development. It gives coding agents the project's resolved rules, checks code independently, enforces the same standard across editors, hooks, and CI, supports opt-in cloud scans, and gives teams shared evidence. Iris Code makes no model calls of its own.

Iris Code is distributed as a VS Code extension, a JetBrains plugin, and an npm CLI, and analysis is local by default: the editor and the CLI perform no server-side scan and upload no code. For those, network requests exist only for sign-in, licence validation, and public dependency and advisory lookups.

Cloud scans are a separate, opt-in Pro feature. Installing the Iris Code GitHub App on a repository lets the scanner fetch that repository's source from GitHub and audit it without an editor open, choosing per repository whether merges, pull request updates, or both trigger an audit. The source is analysed and discarded; the stored result is the report. Connect nothing and none of this applies.

It supports TypeScript, JavaScript, Vue, Svelte, Go, Python, Ruby, C#, Java, and Rust. Every analysis rule is measured for per-rule, per-language precision and recall against a labelled corpus, and the published results are linked below.

Note on the name: Iris Code is unrelated to the Iris web framework for Go (kataras/iris).

## Product

- [Iris Code](https://www.iriscode.co): What Iris Code is: the deterministic quality-control layer for AI-assisted development, spanning coding-agent rules, local analysis, hooks, CI, opt-in cloud scans, and team evidence.
- [Features](https://www.iriscode.co/features): Every capability in one place: code analysis, coding-agent guidance, enforcement, dependency intelligence, cloud scans, configuration, and team evidence.
- [Playground](https://www.iriscode.co/playground): An editable multi-file project that runs the real Iris Code engine in the browser: per-file health scores, findings, cross-file duplicate blocks, and a simulated git push judged by the real enforcement gate. No code is uploaded.
- [Supported languages](https://www.iriscode.co/languages): Per-language analysis coverage for TypeScript, JavaScript, Vue, Svelte, Go, Python, Ruby, C#, Java, and Rust, including which rules apply to each.
- [Pricing](https://www.iriscode.co/pricing): Free, Pro, and Teams plans. Free covers file analysis and core agent guidance; Pro adds workspace checks, enforcement, dependency intelligence, advanced configuration, and cloud scans; Teams adds shared control and evidence.
- [Extended trials](https://www.iriscode.co/community-trials): Application page for founders, builders, and open-source maintainers seeking extended Iris Code Pro access.
- [Teams: one shared standard across an organisation](https://www.iriscode.co/teams): A seat gives every member Pro. The organisation adds shared configuration, repository evidence, analytics, activity, roles, billing, and audit history. Team evidence excludes source and finding text; separately opted-in cloud scans temporarily process repository source and retain the report.
- [Download and install](https://www.iriscode.co/download): Install paths for VS Code, Cursor, Windsurf, VSCodium, and JetBrains IDEs, plus the direct VSIX.
- [MCP server for AI agents](https://www.iriscode.co/mcp): Serves Iris Code to Claude Code, Codex, Cursor, Windsurf, Copilot agent mode, Zed, and JetBrains AI Assistant over the Model Context Protocol, so an agent works against the thresholds the pre-push hook enforces rather than inferring a standard. Six tools; findings for one file, project config, and safe fixes on one file are free. Safe fixes preview before writing and apply only a change set already shown. Analysis is local. The server resolves the project from the workspace the client reports, or the directory it was launched in; JetBrains AI Assistant reports neither, so the Iris Code plugin supplies the project path automatically.
- [Command line interface](https://www.iriscode.co/cli): The @iris-code/cli package. Seventeen commands: init, check, fix, secrets, security, deps, cve, sbom, todos, gate, slack, rules, mcp, report, hook, config, and auth. iris init sets a project up in one command - three short questions, a recommended preset, a config, an AGENTS.md rules block, and the pre-push hook where the licence allows it. iris fix --safe removes only what can be proved safe to remove: an isolated debug statement, a literal-only unused variable, or a standalone unused Java import. iris rules writes your project standards into AGENTS.md or CLAUDE.md for coding agents; iris mcp serves those standards to Claude Code, Codex, Cursor, Windsurf, Copilot agent mode, Zed, and JetBrains AI Assistant over the Model Context Protocol.
- [Getting started](https://www.iriscode.co/getting-started): Choice-first onboarding for an opted-in GitHub cloud scan or immediate local analysis in a supported editor.
- [Comparisons](https://www.iriscode.co/compare): Head-to-head comparisons with SonarQube, CodeRabbit, DeepSource, and ESLint, each naming the cases where the other tool is the better choice.
- [Changelog](https://www.iriscode.co/changelog): Release history for the extension, the JetBrains plugin, and the CLI.
- [Security and privacy posture](https://www.iriscode.co/security): What runs locally, what makes a network request, and what data leaves the machine. Editor and CLI analysis never leaves the machine; cloud scans are opt-in per repository and run on our infrastructure.

## Documentation

- [Documentation home](https://docs.iriscode.co): Full reference for configuration, rules, enforcement, and the CLI.
- [Documentation llms.txt](https://docs.iriscode.co/llms.txt): Structured index of every documentation page.
- [Accuracy benchmark](https://docs.iriscode.co/trust/accuracy-benchmark): Per-rule, per-language precision and recall, with the methodology and the known false positives.
- [Accuracy benchmark data (JSON)](https://www.iriscode.co/benchmark/v1/rules.json): The same figures machine-readable, generated from the benchmark corpus: 37 measured rules across 8 analysers covering 10 supported languages, per-rule precision and recall per language, tier, and the known false positives. Includes definitions of the four counts that all get called "rule count", because conflating them is the common mistake.

## Install

- [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=davidjaja.iris-code): Primary listing for VS Code.
- [Open VSX](https://open-vsx.org/extension/davidjaja/iris-code): Listing used by Cursor, Windsurf, VSCodium, and Trae.
- [JetBrains Marketplace](https://plugins.jetbrains.com/plugin/33168-iris-code): Plugin for IntelliJ IDEA, WebStorm, PyCharm, GoLand, and Rider.
- [@iris-code/cli on npm](https://www.npmjs.com/package/@iris-code/cli): Command line interface for local runs, git hooks, and CI.
- [@iris-code/core on npm](https://www.npmjs.com/package/@iris-code/core): The shared analysis engine every surface runs on.

## Comparisons

- [Iris Code vs SonarQube](https://www.iriscode.co/compare/sonarqube): An honest comparison of Iris Code and SonarQube: where analysis runs, what a full setup costs, language coverage, and which of the two is the right choice for your team.
- [Iris Code vs CodeRabbit](https://www.iriscode.co/compare/coderabbit): An honest comparison of Iris Code and CodeRabbit: deterministic local analysis versus AI pull request review, what each catches, what each costs, and why most teams end up running both.
- [Iris Code vs DeepSource](https://www.iriscode.co/compare/deepsource): An honest comparison of Iris Code and DeepSource: editor-first local analysis versus a hosted service connected to your repository, including what each costs on private code.
- [Iris Code vs ESLint](https://www.iriscode.co/compare/eslint): Iris Code and ESLint solve different problems and are designed to run together. What each one catches, what neither catches, and why replacing ESLint with Iris Code would be a mistake.

## Blog

- [So you're a code copier? What else do you do.](https://www.iriscode.co/blog/so-youre-a-code-copier): Copy-paste is the only kind of technical debt that feels like productivity while you're creating it - and the only kind you can't grep for after.
- [Your AI just changed 14 files. Now what?](https://www.iriscode.co/blog/your-ai-just-changed-14-files): Code review was designed for pull requests. The work now arrives one prompt at a time.
- [The year your dependencies started hacking you back](https://www.iriscode.co/blog/the-year-your-dependencies-started-hacking-you-back): Somewhere between August 2025 and now, "check your dependencies" stopped being good hygiene and became a full-time job nobody was staffed for.
- [Technical debt isn't debt. That's the problem.](https://www.iriscode.co/blog/technical-debt-isnt-debt): Real debt has an interest rate, a due date, and a lender who calls. Technical debt has none of that - which is exactly why it never gets paid.
- [The slopification of software engineering](https://www.iriscode.co/blog/the-slopification-of-software-engineering): Nobody decided to lower the bar. The bar just stopped being checked.
- [You're not as smart as you think you are](https://www.iriscode.co/blog/youre-not-as-smart-as-you-think): You didn't skip the linter because you're lazy. You skipped it because some part of you assumed your code was already fine. That assumption is the bug.
- [Nine security anti-patterns your linter doesn't catch](https://www.iriscode.co/blog/security-smells-your-linter-misses): ESLint catches style problems, not security problems. These nine patterns pass code review, pass CI, and still ship to production. Here's how to spot them before they do.

## Optional

- [About](https://www.iriscode.co/about): Who builds Iris Code and why deterministic quality control matters as coding agents produce more changes.
- [Support](https://www.iriscode.co/support): Where to report a bug, request a feature, or get help with installation, licensing, and configuration.
- [Contact](https://www.iriscode.co/contact): Direct contact for sales, partnership, security disclosure, and press enquiries.
- [Privacy policy](https://www.iriscode.co/privacy): Data handling for the site and the extension.
- [Terms of service](https://www.iriscode.co/terms): Terms covering the extension, plugin, and CLI.
- [JetBrains plugin EULA](https://www.iriscode.co/legal/jetbrains-plugin-eula): Licence terms specific to the JetBrains Marketplace distribution.