Agent output.
Your standard.
An AI agent asked to clean up a file has no way to know what your project counts as clean. It can count lines and guess at a limit, and its guess changes between runs. Iris Code answers over MCP with the thresholds your pre-push hook actually enforces, so the agent works against your committed standard instead of inventing one.
Six tools
Pro tools stay listed and describe themselves as Pro rather than hiding, so your assistant can say what an upgrade would add. Entitlement is checked when a tool runs, not when it is listed, so a cached tool list cannot be replayed for Pro work. Full behaviour is in the MCP guide.
Findings for a path, each with a rule id, a line, a real severity, and a stable id the agent can pass back. One file free; folder and workspace on Pro.
The project's resolved thresholds, scoring weights, and gate limits, exactly as the pre-push hook and CI would apply them.
FreePreview, then apply, only the changes Iris Code can prove safe. Refuses per finding with a reason. One file free; folder and workspace on Pro.
Findings plus the rule detail behind them, so an agent can act on the reason rather than the label.
ProWhether the configured gate would pass, and which files fail which rule. The same answer the hook gives.
ProOSV advisories for a dependency at its installed version, with severity, confidence, and the nearest fixed version.
ProIt shows you the change
before it makes it
iris_fix_safe previews by default and returns a single-use token. Applying requires that token, so Iris Code only ever writes a change set it has already put in front of you. Refusals are per finding with a reason, and one refusal never blocks the fixes that are provable.
What it will not do
Handing an agent write access to a repository is only reasonable if the boundaries are explicit. Each of these is enforced in the server process, not left to the client.
iris_fix_safe returns the exact changes it would make plus a single-use token. Applying requires that token, so Iris Code only ever writes a change set it has already shown you. A confirmation flag alone would not give you that, because the model sets the flag.
A hardcoded secret is never auto-fixed. A debug print sharing its line with real code is left alone, because deleting the line would take the code with it. One refusal never blocks the fixes that are provable.
Every requested path must resolve inside --root, checked after resolving symlinks, so a link pointing outside your workspace is refused rather than followed. There is no shell-execution tool and no command passthrough.
Secret values are never returned to the agent, only the masked form every other Iris Code surface shows. Analysis runs on your machine; only dependency and advisory lookups reach the network, and those ask first.
Large results drop the lowest severities first and report what was withheld, so a critical finding is never cut to make room for a magic number and a partial answer cannot look complete.
An agent can count lines and guess at a limit, and its guess changes between runs. Iris Code answers with the thresholds your pre-push hook actually enforces, so work that passes here passes there.
One command,
any client
This is not something you type in a terminal. It goes in your agent's MCP configuration, and your agent runs it. The npx form needs no install and picks up new releases on its own. Pass --root to pin the folder Iris Code may read and write, or leave it out and your editor tells Iris Code which project is open.
Rules while it writes, checks while it works
MCP lets an agent ask questions as it goes. Project rules tell it your limits before it starts. They cover different moments, and both are free.