The same engine, not a copy
The page imports the published @iris-code/core package - the analysers, the scoring and the rules that the VS Code extension, the JetBrains plugin and the CLI all share. A score here is the score your editor would show.
Live, not a recording
Run Iris Code on real code, in your browser
This page loads the same analysis engine the extension and the CLI ship with, and runs it on whatever is in the editor. Break something, watch the score move, then push and see the gate stop you. Nothing you type or paste leaves this tab.
We record anonymous usage counts, never your code.
The sample project
Choose the seeded workspace to explore a multi-file review target with real problems planted in it: a committed Stripe key, SQL built by concatenation, duplicated logic across two files, an MD5 fingerprint, and a file named against the project’s own convention. Fix them and watch the gate respond.
Why the verdict is worth trusting
A demo that scripts its own outcome tells you nothing about the product. This one cannot: it has no script to run.
The same gate the hook runs
Push calls the same function the installed pre-push hook decides on, and prints what the hook prints, down to the exit code. Only the git transport is simulated - the pass or fail is real, measured against the policy in the config file you can edit.
Nothing is uploaded
Iris Code reads code, it never runs it, so there is no sandbox and nothing to upload: analysis happens in this tab. One request does leave, and only when you open the dependency audit, which sends package names and versions to OSV.dev and never your source. Share a project and it is encoded into the part of the URL after the #, which browsers never send in a request. The link carries your files; we never see them.
What the playground cannot show you
Worth saying plainly, so nothing here reads as the whole product.
- The full dependency tree. The audit here reads the manifests in this workspace, so it covers the versions they declare. Installed, Iris Code reads your lockfiles too, which is what resolves the transitive tree that most vulnerabilities actually live in.
- Git history secret scanning and trend tracking. Both need your repository’s history, which a browser tab does not have.
- Editor integration. Squiggles here are a demonstration of the idea. Installed, the findings arrive in Problems, on hover, in CodeLens, in the Explorer and as one-click renames.
- Very large files. The engine caps duplicate comparison at 5,000 lines per file and skips minified files, the same as it does locally. When it skips something, it says so rather than reporting a clean result.
Run it on your own repository next
The editor extension is free for per-file analysis, secrets, security smells and duplicate detection. Enforcement, whole-project scans and the dependency audits are Pro.
Catch regressions before human review
Install Iris Code, set a threshold, and make every change answer to the same deterministic rules. Source analysis runs locally. The same rules run in VS Code, JetBrains IDEs, the iris CLI, hooks, and CI.
VS CodeCursorWindsurfVSCodiumIntelliJ IDEAWebStormPyCharmGoLandVS CodeCursorWindsurfVSCodiumIntelliJ IDEAWebStormPyCharmGoLand