Pro tools stay listed and describe themselves as Pro rather than hiding, so your assistant can say what an upgrade would add. Entitlement is checked when a tool runs, not when it is listed, so a cached tool list cannot be replayed for Pro work. Full behaviour is in the MCP guide.
Findings for a path, each with a rule id, a line, a real severity, and a stable id the agent can pass back. One file free; folder and workspace on Pro.
The project's resolved thresholds, scoring weights, and gate limits, exactly as the pre-push hook and CI would apply them.
FreePreview, then apply, only the changes Iris Code can prove safe. Refuses per finding with a reason. One file free; folder and workspace on Pro.
Findings plus the rule detail behind them, so an agent can act on the reason rather than the label.
ProWhether the configured gate would pass, and which files fail which rule. The same answer the hook gives.
ProOSV advisories for a dependency at its installed version, with severity, confidence, and the nearest fixed version.
Proiris_fix_safe previews by default and returns a single-use token. Applying requires that token, so Iris Code only ever writes a change set it has already put in front of you. Refusals are per finding with a reason, and one refusal never blocks the fixes that are provable.
Handing an agent write access to a repository is only reasonable if the boundaries are explicit. Each of these is enforced in the server process, not left to the client.
iris_fix_safe returns the exact changes it would make plus a single-use token. Applying requires that token, so Iris Code only ever writes a change set it has already shown you. A confirmation flag alone would not give you that, because the model sets the flag.
A hardcoded secret is never auto-fixed. A debug print sharing its line with real code is left alone, because deleting the line would take the code with it. One refusal never blocks the fixes that are provable.
Every requested path must resolve inside the project root, checked after resolving symlinks, so a link pointing outside your workspace is refused rather than followed. There is no shell-execution tool and no command passthrough.
Secret values are never returned to the agent, only the masked form every other Iris Code surface shows. Analysis runs on your machine; only dependency and advisory lookups reach the network, and those ask first.
Large results drop the lowest severities first and report what was withheld, so a critical finding is never cut to make room for a magic number and a partial answer cannot look complete.
An agent can count lines and guess at a limit, and its guess changes between runs. Iris Code answers with the thresholds your pre-push hook actually enforces, so work that passes here passes there.
This is not something you type in a terminal. It goes in your agent's MCP configuration, and your agent runs it. The npx form needs no install and picks up new releases on its own. It names no folder on purpose: your editor tells Iris Code which project is open, so one entry covers every workspace you work in.
MCP lets an agent ask questions as it goes. Project rules tell it your limits before it starts. They cover different moments, and both are free.